Look, Listen, Leak: Out-of-Band WebRTC Pairing as an Enterprise Egress Surface

Valer Bocan

Enterprise security stacks inspect web, email, DNS, cloud, and removable-media egress on the assumption that any consequential data path crosses a control that can see it. We characterise a data-movement surface that defeats this assumption while the full standard stack remains deployed and correctly configured. A web page on a corporate workstation renders a compressed WebRTC offer as a QR code; a co-present smartphone reads it, answers with a brief acoustic burst the workstation's microphone decodes, and the two browsers open a WebRTC DataChannel directly across the local network. The receiver is an unmodified phone admitted under a bring-your-own- device policy, and no software is installed or privilege escalated. We give a formal threat model, an attack tree and a data flow diagram that locate the surface relative to the deployed controls, and a released reference implementation.