[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRisL7dqoMf4HSFkDLV4ZWV9Uw5A68ggI9gwn_EE8PwM":3},{"article":4,"iocs":49,"watch_terms":63,"solutions":64,"lesson":67},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"38c515fe-6ffd-436f-886a-c5f6118368c2","whitelist-bypass – WebRTC Tunnels Through Video-Calling Platforms","whitelist-bypass-webrtc-tunnels-through-video-calling-platforms-9d88e3","whitelist-bypass tunnels traffic through commercial video calls, for networks that allow only approved domains. How its two tunnels work, and the claim to verify.","The whitelist-bypass tool creates tunnels through commercial video-calling platforms like VK Call, Yandex Telemost, and WB Stream to circumvent network restrictions that only allow approved domains. It offers two modes: a data channel (SCTP) for SOCKS5 tunneling and a video track (VP8) encoding, which can bypass throttling on data channels. The tool encrypts traffic using XChaCha20-Poly1305, keyed by the call's join link, and supports multiple platforms including Android, iOS, Linux, Windows, and macOS.","whitelist-bypass uses WebRTC tunnels via video calls to circumvent network restrictions.","https:\u002F\u002Fwww.darknet.org.uk\u002F2026\u002F09\u002Fwhitelist-bypass-webrtc-tunnels-through-video-calling-platforms\u002F","https:\u002F\u002Fwww.darknet.org.uk\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002Fwhitelist-bypass-webrtc-video-call-tunnels.webp","2026-09-14T19:53:26+00:00","2026-09-14T20:00:22.628031+00:00",7,[17,20,23,25,27,29],{"name":18,"type":19},"whitelist-bypass","product",{"name":21,"type":22},"WebRTC","technology",{"name":24,"type":19},"VK Call",{"name":26,"type":19},"Yandex Telemost",{"name":28,"type":19},"WB Stream",{"name":30,"type":22},"SOCKS5","02371804-cf6d-4449-98de-f1a2d4d9b266",{"id":31,"icon":33,"name":34,"slug":35},null,"Tools","tools",[37,39,44],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,53,57,60],{"type":51,"value":18,"context":52},"malware","Name of the tool used for tunneling traffic.",{"type":54,"value":55,"context":56},"mitre_attack","T1071.001","Application Layer Protocol: Web Protocols (used for tunneling)",{"type":54,"value":58,"context":59},"T1572","Protocol Tunneling (used for circumventing network restrictions)",{"type":54,"value":61,"context":62},"T1026","Encrypted Channel (used for obfuscating traffic)",[18,24,26],{"controls":65,"vendors":66},[],[],{"slug":68,"title":69,"body":70,"framework_refs":71,"framework_notes":82},"webrtc-tunnels-exploit-whitelisted-video-platforms-to-bypass-network-controls","WebRTC Tunnels Exploit Whitelisted Video Platforms to Bypass Network Controls","The whitelist-bypass tool demonstrates how attackers can abuse trusted, whitelisted domains — such as commercial video-calling platforms — to smuggle arbitrary traffic through corporate network perimeters via WebRTC data and video channels. This matters because traditional domain-based allowlists provide a false sense of security; simply permitting a known brand's domain does not prevent it from being weaponized as a covert tunnel. Traffic is encrypted with modern ciphers (XChaCha20-Poly1305), making deep inspection difficult and allowing SOCKS5 proxying or arbitrary data exfiltration to blend in with legitimate video call traffic. Organizations relying solely on DNS or URL whitelisting without deeper behavioral or protocol-level inspection are effectively blind to this class of attack.",[72,73,74,75,76,77,78,79,80,81],"CIS Control 9 – Email and Web Browser Protections","CIS Control 12 – Network Infrastructure Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 SC-7 – Boundary Protection","NIST SP 800-53 AC-17 – Remote Access","NIST SP 800-53 SI-4 – System Monitoring","NIST SP 800-207 – Zero Trust Architecture","MITRE ATT&CK T1572 – Protocol Tunneling","MITRE ATT&CK T1071.001 – Application Layer Protocol: Web Protocols","ISO\u002FIEC 27001 Annex A.13.1 – Network Security Management",{}]