Tens of thousands of video conferencing setups, including some in corporate meeting rooms where the most confidential information is discussed, are vulnerable to spying attacks, researchers said this week.
After spending months rooting around top-end video conferencing hardware and software, and taking tours through meeting rooms himself, HD Moore said the danger was a "perfect storm" brought on by lazy habits and sloppy security settings.
"Many of these [video conferencing installations] are naked on the Internet," said Moore, the chief security officer at Rapid7.
Using scanning tools, Moore surveyed a small fraction of the Internet to find hardware that used the H.323 protocol -- the most widely-used by video conferencing equipment -- and discovered that 2% were at risk of hacker infiltration because they were set to automatically answer any incoming calls and were not protected by a firewall.
On the Internet as a whole, Moore estimated that more than 150,000 video conferencing setups were vulnerable to eavesdropping using the hardware's microphone and spying via the remote-controlled camera.
The biggest gaffes in video conferencing are the auto-answer feature and the positioning of the hardware sans a firewall, or outside the organization's usual defensive perimeter, said Moore. And even when they seem to be protected, some firewalls fail to properly handle the H.323 protocol, and in fact expose the hardware to infiltration.
Other issues range from known vulnerabilities in some video conferencing software to used hardware sold via outlets like eBay that have not been scrubbed of their pre-set connections to other conferencing locations.
Moore was able to access video conferences held in corporate boardrooms, and at meetings in research facilities, law offices, and venture capital firms.
"You see these very nicely-appointed conference rooms where they're having their most important conversations," said Mike Tuchen, chief executive of Rapid7 in the same interview. "Often, where video conferencing equipment gets located are the same places where the most sensitive meetings take place."
Disabling auto-answer is the easiest way to block this spying, said Tuchen.
"Most of Polycom's equipment defaults to auto-answer, but disabling that is pretty straight-forward," Tuchen said, citing the video conferencing maker that Moore found with the most systems set to automatic answer.
In one case, Moore was able to dial into an ongoing conference, then operate the camera -- zooming in on one individual to see him enter a password on his laptop -- for more than 20 minutes, all without the participants noticing the moving camera.
Exposing video conferencing hardware on the Web was the other major gaffe that Moore exploited. "Too many people take a shortcut by putting their equipment on the Internet," said Tuchen.
Moore is an accomplished vulnerability researcher and hacker -- he is also the creator of the popular open-source Metasploit penetration testing toolkit -- but he said others could duplicate his work if they had "some moderate level of technical sophistication."
Some in the video conference industry have taken exception to Moore's conclusions that spying is easy.
David Maldow, an analyst with Telepresence Options, an arm of the Human Productivity Labs consultancy, which specializes in video conferencing, countered in a blog post Tuesday, arguing that Moore was simply "random dialing and peek[ing] around some empty rooms."
Moore answered with his own post , saying that many of Maldow's comments were contrary to the facts on the ground.
Stopping such attacks is not difficult, but does require some technical know-how, which Moore and Tuchen concluded from the evidence was not always available or aimed at video conferencing.
"Video conferencing companies could solve these problems if they provided a more severe warning when auto-answer is turned on," said Tuchen. "And they could provide more technical assistance to customers in setting up H.323 gateways."
"What stuck out for me was how bad the situation was," said Moore. "The popularity of video conferencing systems among the venture capital and finance industries leads to a small pool of incredibly high-value targets for any attacker intent on industrial espionage or obtaining an unfair business advantage."
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer , on Google+ or subscribe to Gregg's RSS feed . His e-mail address is gkeizer@computerworld.com .
See more articles by Gregg Keizer .
Read more about security in Computerworld's Security Topic Center.