Cisco Webex - huge critics by Dutch government

FanJ · Jun 5, 2024

The Dutch government has huge negative critics regarding Cisco Webex.
They say that they were not informed about hacks and dataleaks.

Following links are in Dutch (at the moment I don't have it in English):

Dutch newspaper NRC - 5 juni 2024
Software voor videovergaderingen rijksoverheid gehackt, kabinet belooft onderzoek
https://www.nrc.nl/nieuws/2024/06/0...id-gehackt-kabinet-belooft-onderzoek-a4855441

Security.nl - 5 juni 2024
Overheid onderzoekt datalek bij Webex, uit felle kritiek op Cisco
https://www.security.nl/posting/844...datalek bij Webex, uit felle kritiek op Cisco

PS BTW:
One could question whether the Dutch government itself shouldn't be better informed and take appropriate measures. Oh well...

nicolaasjan · Jun 7, 2024

FanJ said: ↑

Dutch newspaper NRC - 5 juni 2024
Software voor videovergaderingen rijksoverheid gehackt, kabinet belooft onderzoek
https://www.nrc.nl/nieuws/2024/06/0...id-gehackt-kabinet-belooft-onderzoek-a4855441
Click to expand...

Translated:

Webex, a video conferencing software program used by the government, has recently been hacked. This is what outgoing State Secretary Alexandra van Huffelen (Digitalization, D66) writes in a letter to the House of Representatives . The leak came to light in an investigation by a German journalist for Die Zeit .
With the hack, the journalist was able to retrieve data from ministers who used the software. According to the ANP news agency, this includes data from video meetings of ministers Mark Harbers (Infrastructure and Water Management), Conny Helder (VWS), Hugo de Jonge (Home Affairs and Kingdom Relations), Franc Weerwind and Dilan Yeşilgöz (Justice and Security) and Van Huffelen yourself.
Van Huffelen tells Nieuwsuur that she will investigate the data breach, about which the government was informed by Die Zeit . “I find it unacceptable that this could have happened and that these vulnerabilities in the government came to us through the German media, instead of through the supplier,” she writes. “Directors and civil servants must be able to assume that they can consult safely at all times. The Ministry of the Interior and Kingdom Relations therefore takes this matter very seriously and is investigating how this could have happened.”
Die Zeit began the investigation after a Webex video meeting from February, in which German officers discussed supporting Ukraine, was shared in Russian media . The journalist in question discovered that the software is vulnerable and spent months collecting information about video meetings by various European governments, including Germany, France, Italy and therefore the Netherlands. She could even dial into some meetings. The journalist did not do this at Dutch meetings, but was able to find out the subject of meetings, the date and participants.
Click to expand...

FanJ · Jun 8, 2024

nicolaasjan said: ↑

Translated:
Click to expand...

Thank you

FanJ · Jun 8, 2024

The Register - Fri 7 Jun 2024 15:04 UTC
Cisco fixes WebEx flaw that allowed government, military meetings to be spied on
https://www.theregister.com/2024/06/07/cisco_fixes_webex_flaw_which/

Researchers were able to glean data from 10,000 meetings held by top Dutch gov officials
Click to expand...

Cisco squashed some bugs this week that allowed anyone to view WebEx meeting information and join them, potentially opening up security and privacy concerns for highly sensitive meets.

The issues first came to light on May 4 when German news outlet Zeit Online published an investigation into the issues which saw it able to view the meeting details of circa 10,000 Dutch government confernece calls.
Click to expand...

==========

Cisco Security Advisory
Cisco Webex Meetings Meeting Information and Metadata Issue June 2024
https://sec.cloudapps.cisco.com/sec...iscoSecurityAdvisory/cisco-sa-webex-june-2024

Advisory ID:
cisco-sa-webex-june-2024
First Published:
2024 June 4 21:00 GMT
Last Updated:
2024 June 5 20:30 GMT
Version 1.1:

Summary
In early May 2024, Cisco identified bugs in Cisco Webex Meetings that we now believe were leveraged in targeted security research activity allowing unauthorized access to meeting information and metadata in Cisco Webex deployments for certain customers. These bugs have been addressed and a fix has been fully implemented worldwide as of May 28, 2024.
Click to expand...

Cisco has notified those customers who had observable successful attempts to access meeting information and metadata based on available logs. Since the bugs were patched, Cisco has not observed any further attempts to obtain meeting data or metadata leveraging the bugs.
Click to expand...

Workarounds
A workaround is not needed; the issue is corrected.
Click to expand...

Read more at those links!

==========
Note by me:
Cisco says "Cisco has notified those customers who had observable successful attempts to access meeting information and metadata based on available logs."
Three possibilities:
1. Cisco did NOT notify customers immediatally; and/or
2. Cisco did NOT notify the Dutch government; and/or
3. The Dutch government was sleeping.

I see no other option than one of the three above mentioned options (or any combination ...)

FanJ · Jun 10, 2024

Germany:
Bundesamt for Sicherheit in der Informationstechnik (BSI)
Federal Office for Information Security

Article in German:
Version 1.0: Webex by Cisco: Schwachstelle ermöglicht
https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2024/2024-248744-1032_csw.html

There is a .pdf document there in German
Webex by Cisco: Schwachstelle ermöglicht Abfluss von Metadaten
Version 1.0, 10.06.2024
https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2024/2024-248744-1032.pdf?__blob=publicationFile&v=2

Interesting is, among other things, this part:

Die Sicherheitslücke ist laut Cisco seit dem 28.05.2024 behoben [CISC24a]. Cisco hat gemäß eigener Aussage die Kunden über die erkannten Ausnutzungen informiert. Nach Erkenntnissen des BSI sind allerdings nicht alle potentiell betroffenen Kunden informiert worden, und die Informationen waren auch nicht vollständig.
Click to expand...

So, in short, the BSI is saying that not everyone was informed and that the information was not complete and sufficient.

=======

Interesting is also the difference between the German and Dutch advice with respect to allready planned video meetings.
For that see article in Dutch on 10 June at:
https://www.security.nl/posting/845... Webex-lek: communicatietools geliefd doelwit

This part in Dutch:

Waar het NCSC het advies geeft om dit te doen voor vergaderingen die vóór 4 juni zijn aangemaakt, hanteert de Duitse overheidsdienst 28 mei als datum.
Click to expand...

So, in short, the Dutch say: cancel all video meetings made before 4 June, while the Germans say: use the date 28 May.

Which rizes the question whether the German and Dutch governments actually speak to eachother and inform eachother ...

Log in or Sign up

Cisco Webex - huge critics by Dutch government

FanJ Updates Team

nicolaasjan Registered Member

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

Log in or Sign up

Cisco Webex - huge critics by Dutch government

FanJ Updates Team

nicolaasjan Registered Member

FanJ Updates Team

FanJ Updates Team

FanJ Updates Team

Useful Searches