Ghost Calls: Abusing Web Conferencing for Covert C2 and Exfiltration
Demonstrates how WebRTC channels and enterprise web conferencing platforms can be repurposed as stealthy command-and-control and data exfiltration pipelines.
Summary
The Rise of WebRTC and Collaboration Platforms
Enterprise organizations widely permit encrypted WebRTC and web conferencing traffic across corporate firewalls to support remote communication and collaboration.
Repurposing WebRTC Data Channels for C2
Gal Weizman shows how red teams can establish bi-directional, peer-to-peer WebRTC data channels through legitimate conferencing infrastructure to execute stealthy command-and-control operations.
Data Exfiltration via Encrypted Media Streams
Encoding stolen enterprise data into WebRTC audio/video streams or steganographic metadata bypasses standard Data Loss Prevention (DLP) and deep packet inspection proxies.
Defending Enterprise Collaboration Boundaries
Mitigating web conferencing abuse requires organizations to monitor WebRTC connection endpoints, restrict unauthorized browser extension permissions, and inspect application-layer session telemetry.
Related talks
Main Stage·42 min
Jason Lang
Introduces advanced offensive networking techniques and covert communication channels to bypass modern enterprise perimeter monitoring and EDR telemetry.
Main Stage·47 min
Vivek Ramachandran · Jeswin Mathai
Exposes Last Mile Reassembly Attacks that bypass enterprise Secure Web Gateways and releases an open-source testing toolkit.
Main Stage·45 min
RJ McDown
RJ McDown presents Obligato, a covert implant communication framework that abuses legacy Windows session architectures to decouple C2 traffic from malware processes.