Machination: An Application-Agnostic Framework for Black-Box WebRTC Testing

Abstract

Video conferencing systems are a critical infrastructure for modern organizations, regularly transmitting sensitive personal, business, and governmental communications. While many vulnerabilities that may reveal sensitive data have been uncovered over time, security analyses have been performed manually. These analyses have typically focused on individual conferencing systems, not generalizing across platforms, despite many platforms relying on the same protocol suite—WebRTC. Existing WebRTC testing tools prioritize performance and interoperability metrics rather than privacy and security properties. We present Machination, the first application-layer black-box WebRTC security testing framework that operates independently of specific conferencing systems. Our framework intercepts Web-RTC connections at the browser API level. It acts as an intercepting proxy, enabling inspection and modification of all signaling and media traffic, regardless of the conferencing system's proprietary protocols. We used Machination to implement three privacy and security experiments: verifying that client-side muting stops audio and video transmission, testing whether servers enforce mute operations against malicious clients, and examining stream-closure behavior when users leave meetings or get removed. We evaluated our framework on four conferencing systems, BigBlueButton, Jitsi Meet, Cisco Webex, and Whereby, and uncovered weaknesses in all of them. The framework is available as open source to support future WebRTC security research.