Re: [rtcweb] I-D Action: draft-ietf-rtcweb-ip-handling-01.txt

[Philipp Hancke <[e-mail]>]

Am 20.03.2016 um 23:31 schrieb [e-mail]:
>
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Real-Time Communication in WEB-browsers of the IETF.
>
>          Title           : WebRTC IP Address Handling Recommendations
>          Authors         : Justin Uberti
>                            Guo-wei Shieh
> 	Filename        : draft-ietf-rtcweb-ip-handling-01.txt
> 	Pages           : 8
> 	Date            : 2016-03-20

I stumbled upon a (now deleted) stackoverflow posting yesterday in which 
obfuscated code "used webrtc" to hack the users router.
Basically webrtc was used to get the local ip address from which the 
routers ip is inferred. Then a default admin account is tried.

It turns out the idea is not knew, I heard from some former coworkers 
that they used this in penetration testing before. But it has now 
reached stackoverflow which means there will soon be rumors and all 
kinds of "webrtc allows hacking your router" stories.

The principal problem here is default passwords. WebRTC makes it 
slightly easier by removing the need to run a series of http requests to 
find out the routers ip. Should this be mentioned as an example in #1 of 
the problem statement?