Subject: Re: (ab)use of IETF webex accounts -- End the Meeting explicitely

From: Toerless Eckert <[email-masked]>
Date: Mon, 5 Mar 2018 23:45:01 +0100

Pascal, Acee:

Do you folks from Cisco want to open a case with webex to have them
resolve this ?

If you think thats not effective, we can try to find the most important
head in the IETF and send an official question to [email-masked]
to get this escalated.

This is all nonwithstanding propagating best practices to us WG-chairs
to try to minimize the risk of this happening for the conferences we
host.

Cheers
    Toerless

On Mon, Mar 05, 2018 at 09:38:14PM +0000, Acee Lindem (acee) wrote:
> Hi Pascal, 
> How did you become aware of the breach?
> Thanks,
> Acee
> 
> ???On 3/5/18, 4:24 PM, "WGChairs on behalf of Pascal Thubert (pthubert)" <[email-masked] on behalf of [email-masked]> wrote:
> 
>     Hello Stewart,
>     
>     The host role can be transferred just like the presenter role. I got another meeting abused last week. We had the interim canceled but I forgot to cancel the webex as well. Again it was used fraudulently...
>     
>     
>     Regards,
>     
>     Pascal
>     
>     > Le 5 mars 2018 à 20:42, Stewart Bryant <[email-masked]> a écrit :
>     > 
>     > 
>     > The abuse is worrying.
>     > 
>     > However we don't want to end up in a situation where the host drops prematurely
>     > the whole meeting is closed. Also we don't what to end up in a situation where the
>     > chair who hosts the meeting needing  to leave ends a productive discussion that if
>     > continued for a little while longer would resolve an issue that required significant
>     > context.
>     > 
>     > - Stewart
>     > 
>     > 
>     >> On 05/03/2018 18:24, Michael Richardson wrote:
>     >> Hi,
>     >> 
>     >> At a number of virtual interim meetings we have seen various reasonable
>     >> sounding names that join the webex, but never seem to connect to the audio.
>     >> Curious, at first we were thrilled to have new participants, but sad that
>     >> they never figured out how to actually join us. "FAIL!" we thought.
>     >> 
>     >> Pascal has investigated and heard that this is apparently some scam where
>     >> a fake user joins and remains in the meeting until after the last participant
>     >> has left and winds up with control of the meeting.  They then... use the
>     >> webex connection to (I guess) rendezvous using the toll-free numbers to get
>     >> free international calls.  Effectively, webex provides a TURN server for
>     >> toll-free PSTN calls.
>     >> 
>     >> I'm surprised that there aren't better and less hassle ways of doing voice.
>     >> Apparently there is a popular packet switched network that has no-settlement
>     >> that can be used, but I'm not cool enough to know what it's called.
>     >> 
>     >> Pascal points out that we should "End Meeting" as the Host rather than just
>     >> all leaving.  I'm wondering if there are other webex settings that need to
>     >> be tweaked, or have their defaults changed?
>     >> 
>     >> We essentially publish our "passwords" because our meetings are open to
>     >> anyone, and we put the link into the archives.
>     >> We could enable: "Require attendees to have an account..", but that would not
>     >> be acceptable.
>     >> 
>     >> I noticed a new option: "let anyone with a host account on this site host my
>     >> meeting",  which should probably be on so that virtual and design team
>     >> meetings can go ahead even if the person who made the meeting is unavailable.
>     >> 
>     >> What I think that we want is that the meeting ends when the original (logged
>     >> in) host leaves.   This seems like something that webex could easily fix
>     >> with some new option.
>     >> 
>     >> --
>     >> Michael Richardson <[email-masked]>, Sandelman Software Works
>     >>  -= IPv6 IoT consulting =-
>     >> 
>     >> 
>     >> 
>     > 
>     
> 

-- 
---
[email-masked]

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Mon, 5 Mar 2018 22:55:32 +0000

On 3/5/18, 5:45 PM, "Toerless Eckert" <[email-masked]> wrote:

    Pascal, Acee:

No - but you are certainly welcome to do so if you have the time and energy. It seems there are varying levels of RBAC for WebEx and, like many such applications, it needs to be used properly. 

Acee 

    
    Cheers
        Toerless

    -- 
    ---
    [email-masked]

---

From: Toerless Eckert <[email-masked]>
Date: Tue, 6 Mar 2018 00:00:20 +0100

Who is the official contact in IETF for the accounts we have ? We should
pass this information back to that person first. Escalating from
webex directly to psirt is just a plan b if webex itself can not
respond sufficiently well themselves.

WHom do we get our webex accounts from - secretariat ?
Open case with secretariat ?

Cheers
    Toerless

On Mon, Mar 05, 2018 at 10:55:32PM +0000, Acee Lindem (acee) wrote:
> 
> 
> ???On 3/5/18, 5:45 PM, "Toerless Eckert" <[email-masked]> wrote:
> 
>     Pascal, Acee:
>     

-- 
---
[email-masked]

---

From: Cullen Jennings <[email-masked]>
Date: Mon, 5 Mar 2018 22:45:48 -0700

No need to open a case with WebEx or PSIRT yet. Let Richard, Alissa, and I try and see how to deal with this. I greatly appreciate folks pointing it out. I appreciate chairs ending the meetings with the webex app in the mean time. 

Sent with my thumbs. Sorry

> On Mar 5, 2018, at 3:45 PM, Toerless Eckert <[email-masked]> wrote:
> 
> Pascal, Acee:
>