Facebook Twitter Instagram
    • Privacy Policy
    • Contact Us
    Facebook Twitter Instagram Pinterest Vimeo
    AI Home SecurityAI Home Security
    • Home
    • Home Security
    • Cyber Security
    • Biometric Technology
    Contact
    AI Home SecurityAI Home Security
    Cyber Security

    Zoom ZTP & AudioCodes Phones Flaws Uncovered, Exposing Users to Eavesdropping

    justmattgBy justmattgAugust 12, 2023No Comments3 Mins Read

    [ad_1]

    Aug 12, 2023THNVulnerability / Privacy

    Multiple security vulnerabilities have been disclosed in AudioCodes desk phones and Zoom’s Zero Touch Provisioning (ZTP) that could be potentially exploited by a malicious attacker to conduct remote attacks.

    “An external attacker who leverages the vulnerabilities discovered in AudioCodes Ltd.’s desk phones and Zoom’s Zero Touch Provisioning feature can gain full remote control of the devices,” SySS security researcher Moritz Abrell said in an analysis published Friday.

    The unfettered access could then be weaponized to eavesdrop on rooms or phone calls, pivot through the devices and attack corporate networks, and even build a botnet of infected devices. The research was presented at the Black Hat USA security conference earlier this week.

    Cybersecurity

    The problems are rooted in Zoom’s ZTP, which allows IT administrators to configure VoIP devices in a centralized manner such that it makes it easy for organizations to monitor, troubleshoot and update the devices as and when required. This is achieved by means of a web server deployed within the local network to provide configurations and firmware updates to the devices.

    Specifically, it was found to lack client-side authentication mechanisms during the retrieval of configuration files from the ZTP service, thereby leading to a scenario where an attacker could potentially trigger the download of malicious firmware from a rogue server.

    The study further uncovered improper authentication issues in the cryptographic routines of AudioCodes VoIP desk phones (which support Zoom ZTP) that allow for the decryption of sensitive information, such as passwords and configuration files transmitted via a redirection server used by the phone to fetch the configuration.

    The twin weaknesses, i.e., the unverified ownership bug and flaws in the certified hardware, could then be fashioned into an exploit chain to deliver malicious firmware by abusing Zoom’s ZTP and triggering arbitrary devices into installing it.

    Cybersecurity

    “When combined, these vulnerabilities can be used to remotely take over arbitrary devices. As this attack is highly scalable, it poses a significant security risk,” Abrell said.

    The disclosure arrives nearly a year after the German cybersecurity company identified a security issue in Microsoft Teams Direct Routing functionality that could render installations susceptible to toll fraud attacks.

    “An external, unauthenticated attacker is able to send specially crafted SIP messages that pretend to originate from Microsoft and are therefore correctly classified by the victim’s Session Border Controller,” Abrell noted at the time. “As a result, unauthorized external calls are made through the victim’s phone line.”

    Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.



    [ad_2]

    Source link

    Previous ArticleSecurity Pressures Mount Around AI’s Promises & Peril
    Next Article As Phishing Gets Even Sneakier, Browser Security Needs to Step Up
    justmattg
    • Website

    Related Posts

    Cyber Security

    Name That Toon: Last Line of Defense

    April 16, 2024
    Cyber Security

    OpenJS Foundation Targeted in Potential JavaScript Project Takeover Attempt

    April 16, 2024
    Cyber Security

    Middle East Cyber Ops Intensify, With Israel the Main Target

    April 16, 2024
    Add A Comment

    Leave A Reply Cancel Reply

    Facebook Twitter Instagram Pinterest
    • Privacy Policy
    • Contact Us
    AI Home Security © 2025 All rights reserved | Designed By ESmartsSolution

    Type above and press Enter to search. Press Esc to cancel.

    ↑