Please notice: This article is more than 3 years old
Content, Source code or links may no longer be correct in the meantime.

Due to a vulnerability (CVE-2020-3419), attackers could join Webex meetings without being listed in the participants list. Hidden as a “ghost” from the other participants, attackers could eavesdrop on audio and video content.

This is what Heise writes in his article today.¹

But this is only possible (…) if attackers have access to meetings in the form of shared links and a password.

Sounds quite trivial, but it isn’t. The objectives of confidentiality and integrity are lost when others eavesdrop unnoticed during a job interview for instance. Access data can be collected in unencrypted emails. It is not unusual for permanent meeting rooms to keep the same access data over an extended period of time.

Together with other vulnerabilities in Cisco’s server components this results in a desolate picture. Not all products could be fixed so far. The Cisco Security Advisory provides further assistance.²

Anyway, if US providers are used, no legal basis is not applicable.³ In discussions with particularly confidential content or in projects with NDA or confidentiality clauses involving poenals, this is exactly what can become a risk. I would be pleased to show you more examples in a webinar.⁴ In this blog, I have made various side-blows about Discord⁵ or digitisation projects in medium-sized businesses in general.⁶

I’m glad to help, no matter if in the form of a Managed-Server or in form of own servers within a corporate infrastructure.

I also like to refer to my current promotion till the end of the year.⁷

Just give me a call!

Tomas Jakobs