Cisco is rolling out fixes for three vulnerabilities in its Webex video-conference software that made it possible for interlopers to eavesdrop on meetings as a “ghost,” meaning being able to view, listen, and more without being seen by the organizer or any of the attendees.
The vulnerabilities were discovered by IBM Research and the IBM’s Office of the CISO, which analyzed Webex because it’s the company’s primary tool for remote meetings. The discovery comes as work-from-home routines have driven a more than fivefold increase in the use of Webex between February and June. At its peak, Webex hosted up to 4 million meetings in a single day.
The vulnerabilities made it possible for an attacker to:
- Join a meeting as a ghost, in most cases with full access to audio, video, chat, and screen-sharing capabilities
- Maintain an audio feed as a ghost even after being expelled by the meeting leader
- Access full names, email addresses, and IP addresses of meeting attendees, even when not admitted to a conference room.
Cisco is in the process of rolling out a fix now for the vulnerabilities, which are tracked as CVE-2020-3441, CVE-2020-3471, and CVE-2020-3419. Below is a video demonstration and deeper explanation:
Manipulating the handshake
Attacks work by exploiting the virtual handshake that Webex uses to establish a connection between meeting participants. The process works when an end user and server exchange join messages that include information about the attendees, the end-user application, meeting ID, and meeting-room details. In the process, Webex establishes a WebSocket connection between the user and the server.
“By manipulating some of the key fields about an attendee sent over a WebSocket when joining a meeting, the team was able to inject the carefully crafted values that allow someone to join as a ghost attendee,” IBM researchers wrote in a post published on Wednesday. “This worked because of improper handling of the values by the server and other participants’ client applications. For example, injecting null values into ‘Lock’ and ‘CB_SECURITY_PARAMS’ fields caused an issue.”
Elsewhere in the report, the researchers wrote:
A malicious actor can become a ghost by manipulating these messages during the handshake process between the Webex client application and the Webex server back-end to join or stay in a meeting without being seen by others. In our analysis, we identified the specific values of the client information that could be manipulated during the handshake process to make the attendee invisible on the participants’ panel. We were able to demonstrate the ghost attendee issue on MacOS, Windows, and the iOS version of Webex Meetings applications and Webex Room Kit appliance.
The only indication participants would have that a ghost had sneaked into a meeting is a beep when the ghost joins. Sometimes, conference leaders disable the tones, and even when the tones remain on, it’s often hard to count the number of beeps to make sure they correspond to the number of attendees.
There is also little or no indication when someone exploits the vulnerability that allows them to stay in a meeting after being expelled or dismissed. This often happens when a leader is hosting back-to-back meetings with different attendees. In these cases, the ghost can listen to the meeting but doesn’t have access to video, chat, or screen sharing.
Wednesday’s report stated:
Even with the best practices, a host could still find themselves in a meeting with a guest who is unwanted and needs to be removed, whether it’s someone who has crashed the meeting (e.g., ‘Zoombombed’) or a participant who walked away from their computer and forgot to disconnect. Either way, the host has the power to expel attendees, but how do you know they are really gone? It turns out that with this vulnerability, it is extremely difficult to tell. Not only could an attacker join meetings undetected or disappear while maintaining audio connectivity, but they could also simply disregard the host’s expel order, stay in the meeting and keep the audio connection.
Exploits that allow ghost attendees can be used by the ghosts to obtain information that’s confidential or proprietary. The vulnerability allowing attackers to obtain personal data of attendees could be especially useful during the mass shift of working from home, since home networks often don’t have the same security defenses found on work premises. The vulnerabilities affect Cisco Webex software issued before Wednesday. Cisco has more details here, here, and here.