Sign in / up

back to article Pwnd Android conference phone exposes risk of spies in the boardroom

Security researchers have uncovered a flaw in conference phone systems from Mitel that create a means for hackers to listen in on board meetings. Boffins at Context Information Security managed to gain root access and take full control of a Mitel MiVoice Conference and Video Phone, potentially enabling them to listen to …

COMMENTS

Post your comment
House rules Send corrections
Add to 'My topics' unstar *
  1. wolfetone Silver badge
    Holmes

    Taken from El Reg's article Google claims ‘massive’ Stagefright Android bug had 'sod all effect':

    "Despite shrill wailings by computer security experts over vulnerabilities in Android, Google claims very, very few of people have ever suffered at the hands of its bugs."

    Might want to rethink that line of propaganda Google.

    4 3 Reply
  2. Dan 55 Silver badge
    Facepalm

    Their security advisory is a joke

    They say that ADB and DHCP should be disabled, a strong admin password should be used, and no physical access to the phone should be allowed.

    How are you supposed to use it without physical access?

    Anything to avoid updating it to Android 6 or 7.

    7 0 Reply
  3. Steve Evans

    Android 2.3?

    Good grief... Whatever next, cash machines running windows 3.1.1...

    8 0 Reply
    1. Charles 9
      Reply Icon

      Re: Android 2.3?

      I believe many ATMs still run OS/2 v3.

      7 0 Reply
      1. Anonymous Coward
        Reply Icon
        Anonymous Coward

        Re: Android 2.3?

        The ones of that age I worked on all used X.25 rather than TCP/IP to talk to the bank host.

        Far less vunerable to the hackers IMHO.

        4 1 Reply
        1. Anonymous Coward
          Reply Icon
          Anonymous Coward

          Re: Android 2.3?

          The way ATMs are attacked these days, the protocol is irrelevant as they're not trying to hack back to the host but to attack the users to glean account numbers and PINs.

          1 0 Reply
          1. allthecoolshortnamesweretaken
            Reply Icon

            Re: ATMs

            "The way ATMs are attacked these days, the protocol is irrelevant as they're not trying to hack back to the host but to attack the users to glean account numbers and PINs."

            Around here, they usually just blow them up.

            All you need is duct tape, propane or butane and a lighter.

            1 0 Reply
            1. Charles 9
              Reply Icon

              Re: ATMs

              Around here, they just steal a truck and haul the machines WHOLE to the hideouts. In which case the thieves are after the cash, not the credentials, which involve a whole other set of thieves.

              0 0 Reply
    2. Crazy Operations Guy
      Reply Icon

      Re: Android 2.3?

      Funny enough, Windows 3.11 (and DOS 6.2.2) is still supported by Microsoft (if you have an agreement with them)... It was very popular for applications where you needed just a basic UI. I've seen it in automation systems, factory control units, point-of-sale terminals, ATMs, military weapons systems, and even Vehicle Control systems (Such as trains, aircraft, and passenger/cargo ships).

      It was the perfect combination of features, customization, and size. I have an old system sitting on my desk with a customized version of Windows 3.11 burned into a bank of a PROM chips (16x 16 Mbit chips), 32 MB of Static RAM, a 10-BaseT network card, a 28.8k modem, 8 RS-232 compliant serial ports, a floppy disk controller with two drives, and a massive proprietary card (Three slots wide, and full length, has a couple of odd connectors on the back, no markings other than a hand-written serial number)

      2 0 Reply

      1. This post has been deleted by its author

  4. Doctor Syntax Silver badge

    a mature security posture

    The mind boggles.

    1 0 Reply
    1. Stoneshop
      Reply Icon
      Headmaster

      Re: a mature security posture

      Misspelling. It's "amateur"

      9 0 Reply
  5. Pascal Monett Silver badge
    FAIL

    "The integrity of our customer systems and data is a high priority for Mitel"

    A high priority that apparently ranks below actually making sure the product is secure before shipping it.

    3 0 Reply
  6. Stevie

    Bah!

    Easier to subvert the microphone and camera functions in the conference room IoT lightbulbs if you ask me.

    3 0 Reply
  7. find users who cut cat tail
    Joke

    listen in on board meetings

    Good when you cannot get to sleep?

    1 0 Reply
  8. Anonymous Coward
    Anonymous Coward

    The good news on the poetic justice front is...

    That Mitel probably uses these phones in their own conference rooms!

    2 0 Reply
  9. William 3 Bronze badge

    If you need physical access

    Then you could just install a microphone in a extension cable.

    Or a lamp.

    But they gotta get their grant money somehow.

    1 0 Reply
  10. Ken Moorhouse Silver badge

    Mitel conference system used to grass on staff

    (Mitel's first product was... a lawnmower).

    0 0 Reply

POST COMMENT House rules

Not a member of The Register? Create a new account here.

Forgotten password ?

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like