DEF CON 33: Ghost Calls - Abusing Web Conferencing for Covert Command and Contrl

Red teams often struggle with interactive C2 in monitored networks. Low-and-slow channels are stealthy but insufficient for high-bandwidth tasks like SOCKS proxying, pivoting, or hidden VNC. Our research solves this by using real-time collaboration protocols—specifically, whitelisted media servers from services like Zoom—to create short-term, high-speed C2 channels that blend into normal enterprise traffic.

We introduce TURNt, an open-source tool that automates covert traffic routing via commonly trusted TURN servers. Since many enterprises whitelist these conferencing IPs and exempt them from TLS inspection, TURNt sessions look just like a legitimate Zoom meeting. Operators can maintain a persistent, stealthy channel while periodically activating higher-bandwidth interactivity for time-sensitive operations.

This talk will show how to set up these “ghost calls,” discuss the trade-offs and detection challenges, and explore defensive countermeasures. Attendees will learn how to integrate short-term, real-time C2 into existing red team workflows—and how to identify and mitigate this emerging threat.

Transcript

1. #BHUSA @BlackHatEvents Ghost Calls: Abusing Web Conferencing for Covert Command & Control Adam Crosser Ghost Calls: Abusing Web Conferencing for Covert Command & Control
2. Introduction
3. Types of Command-and-Control Channels
5. Ideal Command and Control System Attributes THROUGHPUT LATENCY TRUST REACH
6. DNS over HTTP (DoH) LATENCY THROUGHPUT REACH TRUST
7. Cloud File Storage LATENCY THROUGHPUT REACH TRUST
8. Attacker Virtual Machine with Classified Domain LATENCY THROUGHPUT REACH TRUST
9. Email and Messaging Applications LATENCY THROUGHPUT REACH TRUST
10. Web Conferencing LATENCY THROUGHPUT REACH TRUST
11. Microsoft Teams Split Tunneling Guidelines source
12. Microsoft Teams TLS Inspection source
13. Zoom Split Tunneling Recommendations source
14. Zoom TLS Inspection Recommendations source
16. General Web Conferencing Architecture
17. General Web Conferencing Architecture
18. General Web Conferencing Architecture
19. What is TURN? source
20. WebRTC Core Protocols
21. WebRTC Benefits
22. WebRTC Handshake Process source
23. Reverse Engineering Zoom
24. Reverse Engineering Zoom
25. Reverse Engineering Zoom
26. Reverse Engineering Google Meet
27. Reverse Engineering Google Meet
28. Example Zoom Desktop Egress Attempts
29. Example Zoom Desktop Egress Attempts
30. Custom Protocol over TLS on 443/TCP Example Zoom Desktop Egress Attempts
31. Custom Protocol over TLS on 443/TCP Example Zoom Desktop Egress Attempts
32. WebSockets over HTTPS on 443/TCP Example Zoom Desktop Egress Attempts
33. WebSockets over HTTPS on 443/TCP Example Zoom Desktop Egress Attempts
34. Custom Protocol over 8801/UDP Custom Protocol over 443/TCP Example Zoom Desktop Egress Attempts
35. Custom Protocol over 8801/UDP Custom Protocol over 443/TCP Example Zoom Desktop Egress Attempts
36. WebSockets over HTTPS on 443/TCP Example Zoom Desktop Egress Attempts
37. WebSockets over HTTPS on 443/TCP Example Zoom Desktop Egress Attempts
38. WebSockets over HTTPS on 443/TCP Example Zoom Web Client Egress Attempts
39. WebSockets over HTTPS on 443/TCP Example Zoom Web Client Egress Attempts
40. WebRTC over 8801/UDP Example Zoom Web Client Egress Attempts
41. WebRTC over 8801/UDP Example Zoom Web Client Egress Attempts
42. TURN over TLS on 443/TCP Example Zoom Web Client Egress Attempts
43. TURN over TLS on 443/TCP Example Zoom Web Client Egress Attempts
44. WebSockets over HTTPS on 443/TCP Example Zoom Web Client Egress Attempts
45. WebSockets over HTTPS on 443/TCP Example Zoom Web Client Egress Attempts
46. Highly Adaptable to Changing Environments
47. Developing the Capability
48. source Analyzing Vendor Market Share
49. Analyzing Vendor Market Share source
50. Reverse Engineering Zoom
51. Reverse Engineering Zoom
52. Zooming in on TURN source
53. Reverse Engineering Microsoft Teams
54. Reverse Engineering Microsoft Teams
55. #BHUSA @BlackHatEvents Ghost Calls: Abusing Web Conferencing for Covert Command & Control Adam Crosser Ghost Calls: Abusing Web Conferencing for Covert Command & Control
56. TURNt (TURN tunneler): A Tool for Short-Term C2
57. Use-Cases and Capabilities
58. Tool Components
59. Zoom Video Demo
60. Examining Wireshark Traffic (Zoom)
61. Examining Wireshark Traffic (Zoom)
62. Microsoft Teams Video Demo
63. Examining Wireshark Traffic (Microsoft Teams)
64. Examining Wireshark Traffic (Microsoft Teams)
65. Examining Wireshark Traffic (Microsoft Teams)
66. #BHUSA @BlackHatEvents Ghost Calls: Abusing Web Conferencing for Covert Command & Control Adam Crosser Ghost Calls: Abusing Web Conferencing for Covert Command & Control
67. #BHUSA @BlackHatEvents Ghost Calls: Abusing Web Conferencing for Covert Command & Control Adam Crosser Ghost Calls: Abusing Web Conferencing for Covert Command & Control
68. #BHUSA @BlackHatEvents Ghost Calls: Abusing Web Conferencing for Covert Command & Control Adam Crosser Ghost Calls: Abusing Web Conferencing for Covert Command & Control
69. Last Mile Delivery is the Traditional Bottleneck source source
70. Global Fiber Connectivity Map source
71. U.S.A. Backbone Fiber Infrastructure Map source
72. Internet Routing is a Lot Messier Than Expected source
73. Performance Killers When Tunneling over TCP TCP Meltdown Packet Loss Head-Of-Line Blocking
74. TCP Meltdown and Head-of-Line Blocking
75. Routing Can Impact Performance Significantly (ExpressVPN)
76. Recommend: Microsoft Teams for Cross Continent Tunneling
78. #BHUSA @BlackHatEvents Ghost Calls: Abusing Web Conferencing for Covert Command & Control Adam Crosser Ghost Calls: Abusing Web Conferencing for Covert Command & Control
79. Future Works
80. Additional Resources • Ghost Calls: Abusing Web Conferencing for Covert Command & Control (Part 1 of 2) • Ghost Calls: Abusing Web Conferencing for Covert Command & Control (Part 2 of 2) • https://github.com/praetorian-inc/turnt
81. #BHUSA @BlackHatEvents Ghost Calls: Abusing Web Conferencing for Covert Command & Control Adam Crosser Ghost Calls: Abusing Web Conferencing for Covert Command & Control