How an asymmetric attack on trusted Webex Room devices made them in to listening devices and exposed a path into password-protected meetings around the world.
Webex Room devices sit inside some of the world’s most sensitive corporate and government meeting environments. We approached them from an attacker’s perspective and discovered that trust in the device could become the weakness itself. In this deep-dive, we show how an asymmetric living-off-the-land approach bypassed expected security boundaries — including a path into password-protected meetings around the world — and what this teaches us about testing systems beyond their intended threat model.