The IT security researchers at F-Secure have identified a critical set of vulnerabilities within Barco’s Clickshare product – a wireless presentation system that could allow attackers to access crucial information during presentations and also steal sensitive information such as passwords.
Furthermore, by exploiting these vulnerabilities attackers could also install backdoors and other forms of malware on targeted devices.
See: Vulnerability in Zoom video conference app lets Mac’s camera hijacking
While the common user may not have much to lose among the presentations they make and hence not relate, the main users of the software such as investors and companies possess data that is highly confidential. Losing it to the public or a company can be disastrous which shows the seriousness of the flaw at hand.
This is evident from stats released by Futuresource Consulting which indicate that about 40% of Fortune 1000 companies are customers of Clickshare.
Talking about the reason they randomly decided to test Clickshare, Dmitry Janushkevich who’s a senior security consultant at F-Secure explained that,
“The everyday objects that people trust without a second thought make the best targets for attackers, and because these systems are so popular with companies, we decided to poke at it and see what we could learn.”
However, it would be a mistake to assume this discovery was the fruit of a one-time effort. According to the company’s official blog post, they continued their research on an “on-and-off basis for several months” after which they came across several flaws.
10 of these were found to have Common Vulnerability and Exposure (CVE) identifiers which basically means that these particular vulnerabilities were already known publicly as having been discovered in other systems before.
| CVE-2017-7936, CVE-2017-7932, CVE-2019-18824, CVE-2019-18825, CVE-2019-18826, CVE-2019-18827, CVE-2019-18828, CVE-2019-18829, CVE-2019-18830, CVE-2019-18831, CVE-2019-18832 and CVE-2019-18833. |
Talking how they can be exploited, some of them required physical access while others could have been done through remote means. Moreover, even though physical access is something not easy to pull off, experienced black hats can do so through effective social engineering techniques they’re usually trained in.
See: Critical zero-day vulnerabilities hit Lifesize video conferencing products
F-Secured identified and reported the vulnerability to Barco in October this year. In response to this, recently, the latter has released an update termed 1.9.1 to help users remain secure through a coordinated effort with the former.
However, since many of these revolve around hardware issues, they will take a long time to exist as physical access is required which can become a lengthy process.
The key takeaway from this is that companies need to step up their security efforts in an active sense. What this means is that not only should they have defensive systems in place to detect any intrusions or existing vulnerabilities but also take the help of ethical hacking firms to constantly attack them in a bid to patch any zero-day vulnerabilities that may be found. Because if they’re not going to do it, chances are that a malicious attacker will eventually.
Did you enjoy reading this article? Like our page on Facebook and follow us on Twitter.
