Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

So Slack's VoIP uses WebRTC, which connects via UDP/TCP to always send SRTP packets through a TURN proxy (which extends STUN via ICE) to work around usual NAT problems. These guys scanned the TURN and found an SSRF which allowed them to connect to Slack's VPC on AWS using IAM temporary credentials. Interesting.

For fun, read that last paragraph out loud to a non-techy near by and watch their eyes...



This is a nice summary actually. (btw, you can read it to techy-but-not-in-the-field and still get the same look. I am not sure if I should be sad or proud from the fact that I understood 90% of what you have said without google-fu...)


If you are into SIP this is pretty well known.


I am not :). Well, at least "not anymore".


I understood every word of that and my eyes still glazed over. :)


Could be a line on CSI: Los Angeles.


Do you mean this paragraph?

"Our recommendation here is to make use of the latest coturn which by default, no longer allows peering with 127.0.0.1 or ::1. In some older versions, you might also want to use the no-loopback-peers."


I believe GP means this paragraph:

> So Slack's VoIP uses WebRTC, which connects via UDP/TCP to always send SRTP packets through a TURN proxy (which extends STUN via ICE) to work around usual NAT problems. These guys scanned the TURN and found an SSRF which allowed them to connect to Slack's VPC on AWS using IAM temporary credentials. Interesting.


Thanks! I don't know where my head was.


Sounds like you're STUNned. Try not to TURN you head and maybe put some ICE on it.


OP means they paragraph they just wrote.


Thanks! I don't know where my head was.


Hey I thought he was referring to the last paragraph in the article too…


Read it to myself and my eyes glaze over, and I've spent the past couple of weeks trying to decipher all the acronyms involved in WebRTC!


I've worked with SIP and H323 but not WebRTC so I knew about STUN/TURN/ICE, but you're right about the acronym-soup, even to those who have networking experience --- VoIP is its own little niche. (Along the same lines, I've been a bystander to a group of GSM developers' meetings and it's just as incomprehensible.)


Even a techy who isn't familiar with networking protocols would start to glaze over!


Not so much networking protocols but WebRTC maybe? I did a hello world type of implementation of WEBRTC awhile back and it made perfect sense to me.


Yeah there's the WebRTC you can hack in an afternoon and there's the WebRTC that covers the most common edge cases. The problem that the solution to one problem (for example your websocket going disconnecting mid call while WebRTC still soldiers on) can create three new problems when a different edge case arises.


I recall Elon Musk's Acronyms Seriously Suck memo


Heh, reminds me of neuromancer


I read your paragraph and almost didn’t read the actual article :(


Acronym city right here.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: