(Credit: PCMag Composite; Serhiy Stakhnyk, Lazy_Bear, yanik88/iStock; Orhan Turan/Creatas Video; Alis)
LAS VEGAS—Major networks get hacked every week, and at Praetorian Security, Adam Crosser’s job is to find new and different ways to break into valuable targets. His goal is to help network defenders head off new attacks, and his session at the Black Hat security conference in Las Vegas exposed a new way that scammers could get past network security by misusing two major video conferencing platforms. Spoiler alert—one of them patched their software to foil this attack just before Black Hat started. But the other one didn’t.
How Do Hackers Compromise Networks?
In the movies, network hacking is fast. A hacker in a hoodie pounds the keyboard for a few minutes and announces, “I’m in!” In the real world, infiltrating a corporate network is a gradual process. Hackers start by slipping a tiny, nondescript program into the network. Then, they send instructions that let that program gradually expand its access, quietly and steadily working toward full control.
Modern network security naturally aims to prevent this kind of skullduggery. The essential command and control communication with that initial intruding process is a big red flag for network intrusion monitors. A modern hacker needs a communication avenue that doesn’t stand out.
What Makes a Connection Perfect for Hackers?
Crosser's team set out to find an ideal connection for short-term command and control. They identified four important criteria. “First is latency," he said, meaning the connection needs to be fast and responsive. “Then throughput,” he continued, meaning the amount of data. “You need both.”
His next criterion was reach—the technology must be widely available. He gave Tor and IRC as examples of tech that never got (and still don't) have sufficient reach. Finally, the technology must be trusted by its users and network administrators.
Crosser reviewed several connection types, demonstrating that each failed one or more of the four criteria. These included using DNS communication, working through cloud storage, and even email. Web conferencing systems such as Zoom and Teams, however, checked all four boxes, making them ideal intrusion methods.
Zoom and Teams Can Break Network Security
Crosser noted that web conferencing systems themselves have to do a lot of work breaking through network restrictions. Microsoft Teams support recommends using split tunneling to avoid connecting through a VPN, for example. If your network security keeps the CEO from attending video meetings, well, he’s not going to be happy.
Recommended by Our Editors
Crosser, going into detail comprehensible only to the network-savvy attendees, laid out all the steps Zoom may go through trying to connect from within a highly secure network. In short, if one technique doesn’t work, it just tries and tries again until it finds a way to connect, or just fails, prompting that call from the CEO to the IT department.
“Zoom and Teams are the most popular by a wide margin,” noted Crosser. “We focused on these two solutions. Even if your business uses Google Meet internally, you surely have external meetings that use one of these.” The point here is that your attack won’t get caught breaking through security because the video conferencing tool has already punched right through it.
Hijacking the Connection
Crosser explained how the team extracted authentication credentials from a Zoom or Teams call and used them to piggyback their own traffic on that connection. In live demos, he showed that it was possible to covertly download a file to the victim's system. That's where the real danger lies: someone who thinks they're trying to connect to a video call ends up with malware on their company computer that could steal their data or the company's data or, worse, launch a ransomware attack against the whole firm.
The attack technique involves a technology called TURN, a network protocol for connecting devices that can’t easily connect directly. The team coded up an app that they called TURNt, for TURN tunneler, which Crosser made available to attendees.
Crosser noted that just before Black Hat, Zoom released a patch that defeats the TURNt attack, but Teams is still vulnerable. He concluded with thoughts for future research in this area. “It’s a good entry point for new researchers,” he said. “Pick a topic, expand on it, see if you can make something that functions.”