6

I'm currently working on a penetration test about DTLS-SRTP strengths and weaknesses. But I'm stuck on an eavesdropping test using Wireshark.

Yes, it's protected by SRTP, but:

  1. What's DTLS actually doing/working on the media channel?
  2. What are other attack methods (apart from the eavesdropping) that can be tested on such a secured channel (to prove it works, or alternatively to prove it still has flaws)?

Specifically I'm doing it in WebRTC communications, and I'm ignoring other location's security aspects, except in the media transfer channel.

2

What kind of attack methods are you looking for? I remember it has a memory leak in the DTLS-SRTP extension parsing code. Which makes OpenSSL vulnerable to DoS attacks (for more read CVE-2014-3513).

But I suggest reading RFC 5764 and see if that answers any of your questions.

Can also recommend "Prateek Gupta, Vitaly Shmatikov (2006) Security Analysis of Voice-over-IP Protocols"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.