Corporate Boardrooms Open To Eavesdropping 120
Posted
by
Unknown Lamer
from the it's-a-feature-i-tell-ya dept.
from the it's-a-feature-i-tell-ya dept.
cweditor writes "One afternoon this month, a hacker toured a dozen corporate conference rooms via equipment that most every company has in those rooms: videoconferencing. Rapid7 says they could 'easily read a six-digit password from a sticky note over 20 feet away from the camera' and 'clearly hear conversations down the hallway from the video conferencing system.' With some systems, they could even capture keystrokes being typed in the room. Teleconferencing vendors defended their security, saying the auto-answer feature that left those system vulnerable was an effort to strike the right balance between security and usability."
Re:You're going to be disappointed...and bored (Score:4, Interesting)
I can summarize that long post to nothing ever gets accomplished in meetings, non-criminal or criminal.
Maybe you'll get to stare at a hot intern. Speaking of which, your best hope is "attending" some all-male meetings (not hard to find in the STEM fields) and then hope to catch some higher up making a "questionable" joke. Another possibility is catching people making fun of others, customers, clients, competitors, etc.
A lot of meetings are about primate dominance rituals, a sociology student Might find them interesting, but otherwise... For example maybe two decades ago I had a completely non-technical female boss in a 99% male highly technical industry who felt extreme need to assert dominance, so once a week we sat down in front of the then new ISDN video conferencing system and blew hundreds of dollars on LD costs listening to her cross examine people far away talking about stuff no one cared about which she didn't understand anyway. This was back when LD was like ten cents per minute per channel, and we used something like 8 ISDN B channels over a PRI to videoconference, which works out to something like $48/hour... per site... in addition to the spectacular labor cost of shutting down the entire multi-site department for hours on end. I figured once that with overhead each meeting was well into the 4 figure cost range, yet nothing ever really happened.
Re:You're going to be disappointed...and bored (Score:3, Interesting)
I am low down on the corporate later, but even I am regularly in meetings where things like "here is our list of suppliers who haven't been officially announced" and "this supplier is going away in two months, but they don't know it yet" are regularly discussed.
Why video conference? (Score:5, Interesting)
My experience is as a scientist and probably is of limited value in other fields, but: I've seen places where the remote meeting culture centered on video conferencing and I've seen places where it instead centered on audio, with the video replaced by slides. The slides normally show useful experimental data or borderline useful financial data. The video normally shows bored people.
When an internal meeting has video it's generally a sign that the meeting doesn't actually need to happen - it's better done through a couple emails or a quick IRC-equivalent chat. Again, outside the world of a scientist I expect this to be different.
Glad ours isn't setup that way (Score:4, Interesting)
Low-Tech Solution (Score:4, Interesting)
On the box, in handwritten black magic marker, it said "Do not remove unless participating in a video conference!" Not exactly high-tech, but I suppose it was more effective than nothing.
Re:Not just Teleconferencing... (Score:4, Interesting)
It was a test. Did you mention it to them?
[John]
Even the "experts" have problems (Score:5, Interesting)
When we bought our video conferencing system, the vendor that implemented gave us their VTC unit's number for testing. Their test VTC system is in their main conference room.
Well, one day we were demoing the unit to a group of people and we called the vendor's unit. They were in the middle of an intense meeting, the CTO of the company was nearly yelling at his staff about a missed sale - I guess he saw the camera swivel into position and yelled "Who turned that bloody thing on! Turn it off!"
Pretty funny from our point of view, and our sales rep called later to apologize.
So if the vendor that implements these for a living can't remember to turn off auto-answer when it's important, how can anyone else? I'm surprised at the number of companies that leave auto-answer turned on. (and am also surprised at the number of companies that re-use conference bridge numbers, I accidentally called into a conference bridge an hour early for a meeting, and got to listen to the vendor talking with a competitor about a new project).