Attacks/Breaches
12/21/2012
04:15 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

The 5 Coolest Hacks Of 2012

Nothing was sacred -- the nation's airspace, home power meters, videoconferences, and, in an ironic twist, popular cybercrime tools

5. Videoconference Bugs The Boardroom
Renowned researcher and Metasploit creator HD Moore late last year scanned a snapshot of addressable Internet space in search of high-end videoconferencing systems that might be found in corporate boardrooms. What he found was unnerving: a quarter of a million systems that spoke H.323, the protocol used by videoconferencing systems.

He then used a Metasploit module to call up each server and to connect for just enough time to get the public-handshake packets before disconnecting. "Any machine that accepted a call was set to auto-answer," Moore says. "It was fairly easy to figure out who was vulnerable because if they weren't vulnerable, then they would not have picked up the call."

Moore and Rapid 7 CEO Mike Tuchen were then able to pinpoint some 5,000 videoconferencing systems that auto-answered the calls. That means those systems could be abused by an external hacker who could surreptitiously join the videoconference, record video, and read email from a laptop screen of one of the attendees -- something Rapid 7 simulated in its lab.

"What made this interesting is that you are only going to find places that can afford $25,000 videoconferencing systems, so it's a pretty self-selecting set of targets," Moore says.

Moore and his fellow researchers found mostly Polycom videoconferencing systems, most of which ship with auto-answer on by default.

[Evil insulin pumps and laptop batteries, war texting, and a 'tween' hacker captured our imagination -- and our attention. See The 7 Coolest Hacks Of 2011.]

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Previous
6 of 6
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3580
Published: 2014-12-18
The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist.

CVE-2014-4801
Published: 2014-12-18
Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x through 2.0.1.1, 3.x before 3.0.1.6 iFix 4, 4.x before 4.0.7 iFix 2, and 5.x before 5.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-6076
Published: 2014-12-18
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to conduct clickjacking attacks via a crafted web site.

CVE-2014-6077
Published: 2014-12-18
Cross-site request forgery (CSRF) vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

CVE-2014-6078
Published: 2014-12-18
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not have a lockout period after invalid login attempts, which makes it easier for remote attackers to obtain admin access via a brute-force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.