It’s a good thing Rupert Murdoch’s News of the World reporters are out of business, because they would have loved the hacking opportunity recently uncovered by two security professionals.
HD Moore and Mike Tuchen of Rapid7 discovered that they could remotely infiltrate conference rooms in some of the top venture capital and law firms across the country, as well as pharmaceutical and oil companies and even the boardroom of Goldman Sachs — all by simply calling in to unsecured videoconferencing systems that they found by doing a scan of the internet.
“These are literally some of the world’s most important boardrooms — this is where their most critical meetings take place — and there could be silent attendees in all of them,” Moore told the New York Times.
Moore found he was able to listen in on meetings, remotely steer a camera around rooms as well as zoom in on items in a room to discern paint flecks on a wall or read proprietary information on documents.
Despite the fact that the most expensive systems offer encryption, password protection and the ability to lock down the movement of cameras, the researchers found that administrators were setting them up outside firewalls and failing to configure security features to keep out intruders. Some systems, for example, were set up to automatically accept inbound calls so that users didn’t need to press an “accept” button when a caller dialed into a videoconference, opening the way for anyone to call in and eavesdrop on a meeting.
