4 ms·

Cameras May Open Up the Board Room to Hackers

9 points by bcn 15y ago

losethos 15y ago
10 i = i + 5 20 PRINT i 30 IF i > 99999 THEN i = 0: GOTO 10 40 IF INKEY$ = "" THEN 10 50 PRINT "Bible, Line:", i God says... Line 37945 5:11 And it came to pass, when the priests were come out of the holy place: (for all the priests that were present were sanctified, and did not then wait by course: 5:12 Also the Levites which were the singers, all of them of Asaph, of Heman, of Jeduthun, with their sons and their brethren, being arrayed in white linen, having cymbals and psalteries and harps, stood at the east end of the altar, and with them an hundred and twenty priests sounding with trumpets:) 5:13 It came even to pass, as the trumpeters and singers were as one, to make one sound to be heard in praising and thanking the LORD; and when they lifted up their voice with the trumpets and cymbals and instruments of musick, and praised the LORD, saying, For he is good; for his mercy endureth for ever: that then the house was filled with a cloud, even the house of the LORD; 5:14 So that the priests could not stand to minister by reason of the cloud: for the glory of the LORD had filled the house of God. 6:1 Then said Solomon, The LORD hath said that he would dwell in the thick darkness. 6:2 But I have built an house of habitation for thee, and a place for thy dwelling for ever.
mdwrigh2 15y ago
HD Moore posted on the Rapid7 blog some of the technical details: https://community.rapid7.com/community/solutions/metasploit/blog/2012/01/23/video-conferencing-and-self-selecting-targets https://community.rapid7.com/community/solutions/metasploit/...
yagibear 15y ago
Previous discussion: http://news.ycombinator.com/item?id=3498438 http://news.ycombinator.com/item?id=3498438
bradleyland 15y ago
When I did independent IT consulting, I had a client with a home in Florida and an office in Pennsylvania. He purchased a very nice high-def Polycom unit for both locations so he could work from his office in Florida. It was a nice setup that would make any remote worker jealous, with all the pan/tilt/zoom you could dream of and quality that was out of this world. My first visit was to solve a problem with the conferencing system. He could see his office, but couldn't hear them. The problem ended up being an input issue on his TV, not the Polycom itself, but in the process, I discovered something horrifying. Both his unit and the one in PA were configured to auto-accept incoming IP calls. He regularly kept the television turned off at his home office, so if someone connected to his Polycom, the only evidence would be the lights. A quick inspection of the network revealed that there was no firewall. His PC connected to a VPN, but the Polycom was open on the internet. When I asked him how he was protected from a random person connecting to his Polycom, he said "No one else knows the IP address." As if it were some kind of password. I accidentally laughed out loud in one of those awkward moments where you immediately realize that laughing was the inappropriate response. I explained that attackers constantly scan IP ranges just looking for devices to exploit. He, of course, had me disable the auto-answer feature immediately, but wouldn't go the extra step of setting up a firewall between his office and PA. I was flatly appalled that a Polycom integrator would install a unit on an internet facing IP with auto-answer turned on.

9 points by bcn 15y ago

10 i = i + 5 20 PRINT i 30 IF i > 99999 THEN i = 0: GOTO 10 40 IF INKEY$ = "" THEN 10 50 PRINT "Bible, Line:", i God says... Line 37945 5:11 And it came to pass, when the priests were come out of the holy place: (for all the priests that were present were sanctified, and did not then wait by course: 5:12 Also the Levites which were the singers, all of them of Asaph, of Heman, of Jeduthun, with their sons and their brethren, being arrayed in white linen, having cymbals and psalteries and harps, stood at the east end of the altar, and with them an hundred and twenty priests sounding with trumpets:) 5:13 It came even to pass, as the trumpeters and singers were as one, to make one sound to be heard in praising and thanking the LORD; and when they lifted up their voice with the trumpets and cymbals and instruments of musick, and praised the LORD, saying, For he is good; for his mercy endureth for ever: that then the house was filled with a cloud, even the house of the LORD; 5:14 So that the priests could not stand to minister by reason of the cloud: for the glory of the LORD had filled the house of God. 6:1 Then said Solomon, The LORD hath said that he would dwell in the thick darkness. 6:2 But I have built an house of habitation for thee, and a place for thy dwelling for ever.

mdwrigh2 15y ago

HD Moore posted on the Rapid7 blog some of the technical details: https://community.rapid7.com/community/solutions/metasploit/blog/2012/01/23/video-conferencing-and-self-selecting-targets https://community.rapid7.com/community/solutions/metasploit/...

yagibear 15y ago

Previous discussion: http://news.ycombinator.com/item?id=3498438 http://news.ycombinator.com/item?id=3498438

bradleyland 15y ago

When I did independent IT consulting, I had a client with a home in Florida and an office in Pennsylvania. He purchased a very nice high-def Polycom unit for both locations so he could work from his office in Florida. It was a nice setup that would make any remote worker jealous, with all the pan/tilt/zoom you could dream of and quality that was out of this world. My first visit was to solve a problem with the conferencing system. He could see his office, but couldn't hear them. The problem ended up being an input issue on his TV, not the Polycom itself, but in the process, I discovered something horrifying. Both his unit and the one in PA were configured to auto-accept incoming IP calls. He regularly kept the television turned off at his home office, so if someone connected to his Polycom, the only evidence would be the lights. A quick inspection of the network revealed that there was no firewall. His PC connected to a VPN, but the Polycom was open on the internet. When I asked him how he was protected from a random person connecting to his Polycom, he said "No one else knows the IP address." As if it were some kind of password. I accidentally laughed out loud in one of those awkward moments where you immediately realize that laughing was the inappropriate response. I explained that attackers constantly scan IP ranges just looking for devices to exploit. He, of course, had me disable the auto-answer feature immediately, but wouldn't go the extra step of setting up a firewall between his office and PA. I was flatly appalled that a Polycom integrator would install a unit on an internet facing IP with auto-answer turned on.