Stories
Slash Boxes
Comments

SoylentNews is people

SoylentNews is powered by your submissions, so send in your scoop. Only 16 submissions in the queue.
posted by janrinok on Monday June 06 2022, @08:42AM   Printer-friendly
from the of-course-it-is-it-is-the-government,-after-all dept.

Meeting Owl videoconference device used by govs is a security disaster:

The Meeting Owl Pro is a videoconference device with an array of cameras and microphones that captures 360-degree video and audio and automatically focuses on whoever is speaking to make meetings more dynamic and inclusive. The consoles, which are slightly taller than an Amazon Alexa and bear the likeness of a tree owl, are widely used by state and local governments, colleges, and law firms.

A recently published security analysis has concluded the devices pose an unacceptable risk to the networks they connect to and the personal information of those who register and administer them. The litany of weaknesses includes:

  • The exposure of names, email addresses, IP addresses, and geographic locations of all Meeting Owl Pro users in an online database that can be accessed by anyone with knowledge of how the system works. This data can be exploited to map network topologies or socially engineer or dox employees.
  • The device provides anyone with access to it with the interprocess communication channel, or IPC, it uses to interact with other devices on the network. This information can be exploited by malicious insiders or hackers who exploit some of the vulnerabilities found during the analysis
  • Bluetooth functionality designed to extend the range of devices and provide remote control by default uses no passcode, making it possible for a hacker in proximity to control the devices. Even when a passcode is optionally set, the hacker can disable it without first having to supply it.
  • An access point mode that creates a new Wi-Fi SSID while using a separate SSID to stay connected to the organization network. By exploiting Wi-Fi or Bluetooth functionalities, an attacker can compromise the Meeting Owl Pro device and then use it as a rogue access point that infiltrates or exfiltrates data or malware into or out of the network.
  • Images of captured whiteboard sessions—which are supposed to be available only to meeting participants—could be downloaded by anyone with an understanding of how the system works.

[...] Researchers from modzero, a Switzerland- and Germany-based security consultancy that performs penetration testing, reverse engineering, source-code analysis, and risk assessment for its clients, discovered the threats while conducting an analysis of videoconferencing solutions on behalf of an unnamed customer. The firm first contacted Meeting Owl-maker Owl Labs of Somerville, Massachusetts, in mid-January to privately report their findings. As of the time this post went live on Ars, none of the most glaring vulnerabilities had been fixed, leaving thousands of customer networks at risk.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 5, Touché) by PiMuNu on Monday June 06 2022, @11:25AM (4 children)

    by PiMuNu (3823) on Monday June 06 2022, @11:25AM (#1250892)

    Sure, I have a Freedom of Information request in on the nuclear bomb codes right now...

    Starting Score:    1  point
    Moderation   +3  
       Funny=1, Touché=2, Total=3
    Extra 'Touché' Modifier   0  
    Karma-Bonus Modifier   +1  

    Total Score:   5  
  • (Score: 2, Funny) by Anonymous Coward on Monday June 06 2022, @11:35AM

    by Anonymous Coward on Monday June 06 2022, @11:35AM (#1250894)

    You can ask for them on Russian hacker sites: faster and cheaper than the US govt will process your request.

  • (Score: 1) by pTamok on Monday June 06 2022, @02:02PM (1 child)

    by pTamok (3042) on Monday June 06 2022, @02:02PM (#1250958)
    • (Score: 0) by Anonymous Coward on Monday June 06 2022, @03:16PM

      by Anonymous Coward on Monday June 06 2022, @03:16PM (#1250983)

      Brute forcing that in Fortran (starting with 1) would take the full 100 million tries.
      In C (starting at 0) would take one try.

  • (Score: 2) by sjames on Tuesday June 07 2022, @10:46AM

    by sjames (2882) on Tuesday June 07 2022, @10:46AM (#1251243) Journal

    All zeros. Has been for a long time.