Victor Goeman, Tom Cordemans, Christoph Sanders, Jorn Lapon, and Vincent Naessens, DistriNet, KU Leuven
Real-time communication (RTC) is increasingly adopted in the Internet of Things (IoT), enabling interactive capabilities in smart cameras, home assistants, and industrial devices. However, the security of RTC in IoT remains poorly understood. Unlike standardized WebRTC deployments on the web, IoT implementations are heterogeneous, employing either proprietary protocols or custom WebRTC stacks.
To address this heterogeneity, we present RTCInspect, an open-source framework for automated analysis of RTC traffic to detect protocol and cryptographic weaknesses. Using this framework, we conducted, to our knowledge, the first comparative security study of 21 real-world applications, spanning 11 consumer IoT devices and 10 major web platforms.
Our findings reveal a divide between the security practices of WebRTC in web applications and IoT devices. Web applications mainly rely on WebRTC and adhere to security best practices, although many still depend on centralized trust models. In contrast, IoT devices exhibit weaknesses, including unencrypted signaling, exposing long-term credentials, and mismanagement of certificates and keys, enabling Manin-the-Middle (MITM) attacks.
By exposing these weaknesses and releasing an automated analysis tool, our study offers both a security overview for RTC systems and practical support for developers and researchers.
