During a red team engagement several years ago, the customer CEO was surprised to learn that we had compromised the videoconferencing system in their board meeting room and could watch and listen to any meetings taking place without detection.
This is a common tactic that will be familiar to anyone that has ever conducted a sophisticated red teaming engagement, and now the FBI is warning that cyberattackers are breaching audio/visual devices on corporate networks and using them to move laterally in the organization and compromise additional devices. Here is what the FBI had to say about the threat in a recent bulletin.
“Following up The FBI identified incidents over the past few months in which cyber actors scanned for and sought to exploit audio and visual communication devices on networks to identify vulnerabilities which could later be used to gain access and unlawfully acquire information about the organization. In addition to targeting corporate information, vulnerable devices may be targeted for compromise for use in botnets or other criminal activities. The types of devices targeted include: Voice over Internet Protocol (VoIP) phones, video conferencing equipment, conference phones, VoIP routers, and cloud-based communication systems. While cyber actors have targeted VoIP and other communication devices in the past, the FBI continues to see these devices scanned by cyber actors for vulnerabilities.
Threat
Specifically, the FBI observed cyber actors identifying and probing communication devices by issuing HTTP GET requests a to a business server or network to retrieve device configuration files. Information contained in configuration files often reveals IP addresses, usernames, passwords, system management URLs, and assigned phone numbers – all of which could be used by cyber actors for malicious purposes. Many of the requests are specific to particular brands of devices. Victims will often receive several GET requests in succession with the actors scanning for multiple brands of devices.
In addition, cyber actors retrieve IP addresses for further exploitation by using businesses’ customer service VoIP hyperlinks, which are traditionally made available for customers to use in contacting the business. Once those hyperlinked calls are answered, the actor retrieves the IP address belonging to the phone which answered the call. Once the IP address is retrieved, an actor could send a large volume of packets to the IP address, overloading it and taking the service offline for the targeted business and its legitimate customers.
In addition to the above techniques, cyber actors target devices with brute-force attacks, attempting unauthorized access through the use of common usernames and passwords. Open source scanning tools can also be used to identify vulnerable communication devices and any associated ports.
All of the information obtained through scans and other methods are likely used for specific targeting efforts by cyber actors. This includes leveraging access to compromised audio and video devices to eavesdrop on meetings or conference calls, placing fraudulent international phone calls, leveraging the compromised device for use in botnets, and conducting man-in-the- middle attacks to redirect corporate network traffic.
Recommendations
The following recommendations may limit the success of these types of attacks:
- Conduct daily server log reviews to identify unusual activity, including GET and POST requestsb from external IP addresses.
- Work with the communication device/system providers to ensure servers are patched and updated regularly.
- Consider restricting access to configuration files or configuring firewalls to block traffic from unauthorized IP addresses.
- Restrict communication devices/systems to only non-sensitive business networks.
- Conduct regular penetration testing exercises on communication devices to identify and address vulnerabilities in a timely matter.
- Enable encryption on teleconference programs and applications and consider disabling auto-answer capabilities.
- Password protect configuration files, if possible.
- Regularly review and update users with access to administrative accounts.
- Segment configuration files on the network. Be sure to protect configuration and other device-related files after getting the device out of the box. Don’t just plug and play.
