whitelist-bypass – WebRTC Tunnels Through Video-Calling Platforms
whitelist-bypass uses WebRTC tunnels via video calls to circumvent network restrictions.
The whitelist-bypass tool creates tunnels through commercial video-calling platforms like VK Call, Yandex Telemost, and WB Stream to circumvent network restrictions that only allow approved domains. It offers two modes: a data channel (SCTP) for SOCKS5 tunneling and a video track (VP8) encoding, which can bypass throttling on data channels. The tool encrypts traffic using XChaCha20-Poly1305, keyed by the call's join link, and supports multiple platforms including Android, iOS, Linux, Windows, and macOS.
AI summary of the linked source. Not reviewed by an editor. How this works
Run whitelist-bypass?
Get an email when a new story names whitelist-bypass, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe whitelist-bypass tool demonstrates how attackers can abuse trusted, whitelisted domains — such as commercial video-calling platforms — to smuggle arbitrary traffic through corporate network perimeters via WebRTC data and video channels. This matters because traditional domain-based allowlists provide a false sense of security; simply permitting a known brand's domain does not prevent it from being weaponized as a covert tunnel. Traffic is encrypted with modern ciphers (XChaCha20-Poly1305), making deep inspection difficult and allowing SOCKS5 proxying or arbitrary data exfiltration to blend in with legitimate video call traffic. Organizations relying solely on DNS or URL whitelisting without deeper behavioral or protocol-level inspection are effectively blind to this class of attack.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — whitelist-bypass
- mitre_attack — T1071.001
- mitre_attack — T1572
- mitre_attack — T1026