Hacker News Reader

Comment by bawolff | Hacker News Reader

Other than webRTC being related to video playing, i dont see the connection. They don't really describe the exploit, so hard to say, but the webrtc leak isn't really in the video player part, its super well known (literally a feature not a bug) so i dont think you would need to pay six figures for it, and tails uses tor browser which doesn't support webrtc.

View on HN

But you can install WebRTC enabled browsers in tails. Depending on how tech-savvy someone is, they could be motivated to install one of them.

The article specificly says the issue was in code that used to be in tails and isnt anymore. Additionally, the motherboard article describes the payload as a video file uploaded to dropbox, which doesnt sound like webrtc.

Yes, I doubt that it's WebRTC. Or at least, I recall similar vulnerabilities in video player code that predated WebRTC. There used to be a Metasploit leak-testing site (Metasploit Decloaking Engine) which checked for IP leaks via video, PDFs, etc. And it included an early version of the NIT that the FBI has used since ~2011.[0]

0) https://securityaffairs.co/wordpress/43442/cyber-crime/fbi-u...

I wasn't saying that's how it happened (regarding the article). It was to expand on:

> and tails uses tor browser which doesn't support webrtc.

and how (in other instances than the situation in the article) the WebRTC flaw could be used. I wasn't specific enough.

Reply on news.ycombinator.com