Black Hat Europe: Hacking to spy & remotely control video conferencing systems

Thanks to video conferencing, we don’t always need to travel in order to conduct important business. But the reality of the situation is that an attacker can secretly conduct surveillance by taking control of the video conferencing camera and microphone. At Black Hat Europe, Moritz Jodeit presented “Hacking Video Conferencing Systems” [PDF] and demonstrated how to remotely compromise all variants of the popular Polycom HDX systems.

You might recall when Rapid7’s HD Moore alerted the public to the dangers of poorly configured video conferencing equipment being connected to the Internet. Moore highlighted the need to secure the configuration after showing that “thousands of videoconferencing systems were publicly accessible over the Internet and had the call auto-answer feature turned on." But Jodeit took it to an entirely new level and demonstrated how to remotely own the device.
Jodeit’s Black Hat presentation research [PDF] [slides] is divided into two main sections. First, he shows how to get root access to the Polycom HDX devices in order to find vulnerabilities and to develop exploits. He found vulnerabilities a malicious user might exploit such as by escalating privileges, a command injection when using the firmware update, a format string vulnerability, SQL injection, and a PUP file header MAC signature bypass. Then he explains how to remotely compromise the Polycom video conferencing system in its most secure configuration.