The entire process is a state machine, which indicates 'where in the process of signaling the exchange of offer and answer the connection currently is.'Īlso included optionally as part of the offer/answer exchange is the ability of the two peers to trade SDP candidates to each other so as to negotiate the actual connection between them.

The recipient then responds with an 'answer,' including a description of its endpoint. Put differently, when a user starts a WebRTC call to another user, a session description called an 'offer' is created containing all the information necessary setting up a connection - the kind of media being sent, its format, the transfer protocol used, and the endpoint's IP address and port, among others. How Signaling in WebRTC Works?Īlthough a majority of the messaging apps today rely on WebRTC for communication, the connections themselves are created by exchanging call set-up information using Session Description Protocol ( SDP) between peers in what's called signaling, which typically works by sending an SDP offer from the caller's end, to which the callee responds with an SDP answer. 'While bug was soon fixed, the fact that such a serious and easy to reach vulnerability had occurred due to a logic bug in a calling state machine - an attack scenario I had never seen considered on any platform - made me wonder whether other state machines had similar vulnerabilities as well,' Silvanovich wrote in a Tuesday deep-dive of her year-long investigation. Since then, a number of similar shortcomings have been discovered in multiple video chat apps such as Signal, JioChat, Mocha, Google Duo, and Facebook Messenger - all thanks to the work of Google Project Zero researcher Natalie Silvanovich. The vulnerability was deemed so severe that the iPhone maker removed the FaceTime group chats feature altogether before the issue was resolved in a subsequent iOS update.

In January 2019, a critical flaw was reported in Apple's FaceTime group chats feature that made it possible for users to initiate a FaceTime video call and eavesdrop on targets by adding their own number as a third person in a group chat even before the person on the other end accepted the incoming call.

Signal messenger group