Hackers turn Cisco phones into remote bugging devices
Internet phones sold by Cisco Systems ship with a weakness that allows them to be turned into remote bugging devices that intercept confidential communications in a fashion similar to so many Hollywood spy movies, SC Magazine reported.
The publication quoted consultants from Australia-based HackLabs, who said customers had lost $20,000 a day from exploits, which also included attacks that forced the devices to make calls to premium phone numbers. The consultants said the underlying weaknesses were present in the default settings and could be fixed only by making changes to the phones’ configuration settings.
“The book says to shut off web services,” HackLabs’ Peter Wesley was quoted as saying, referring to the manual that shipped with the phones. “Who’s going to read all that.”
SC Magazine said that a Cisco spokesman advised users to “apply the relevant recommendations in manuals to secure their systems. There was no explanation why phones are by default open to the attacks described in the article. A more sensible policy might be to ship the phones with the features disabled and allow customers who have a specific need for them to turn them on.
The magazine didn’t name the specific make of phone, which is also susceptible to denial of service attacks. The article is here. ®
By on 16/05/2011