I'm building an app for browser-to-browser communication.
What is the attack surface area for WebRTC in 2015?
What kinds of attacks could be done? And more importantly, how do I craft something useful, that does it's reasonable best to be secure?
Here's a list of attacks I've found so far:
- Leak IP address behind VPN
- Persistent monitoring (audio/video). Browsers work hard on this.
- Screen sharing plugins.
Remote code execution:
- Don't open zip, pdf, or other executable files. Warn users.
- Searching Metasploit?
- Video codec exploits?
- Remediation by using a browser in a VM.
Are there any other obvious attacks? Where would you start to hack a remote browser to which you have a WebRTC connection?