Subject: (ab)use of IETF webex accounts -- End the Meeting explicitely

From: Michael Richardson <[email-masked]>
Date: Mon, 05 Mar 2018 13:24:57 -0500

Hi,

At a number of virtual interim meetings we have seen various reasonable
sounding names that join the webex, but never seem to connect to the audio.
Curious, at first we were thrilled to have new participants, but sad that
they never figured out how to actually join us. "FAIL!" we thought.

Pascal has investigated and heard that this is apparently some scam where
a fake user joins and remains in the meeting until after the last participant
has left and winds up with control of the meeting.  They then... use the
webex connection to (I guess) rendezvous using the toll-free numbers to get
free international calls.  Effectively, webex provides a TURN server for
toll-free PSTN calls.

I'm surprised that there aren't better and less hassle ways of doing voice.
Apparently there is a popular packet switched network that has no-settlement
that can be used, but I'm not cool enough to know what it's called.

Pascal points out that we should "End Meeting" as the Host rather than just
all leaving.  I'm wondering if there are other webex settings that need to
be tweaked, or have their defaults changed?

We essentially publish our "passwords" because our meetings are open to
anyone, and we put the link into the archives.
We could enable: "Require attendees to have an account..", but that would not
be acceptable.

I noticed a new option: "let anyone with a host account on this site host my
meeting",  which should probably be on so that virtual and design team
meetings can go ahead even if the person who made the meeting is unavailable.

What I think that we want is that the meeting ends when the original (logged
in) host leaves.   This seems like something that webex could easily fix
with some new option.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Stewart Bryant <[email-masked]>
Date: Mon, 5 Mar 2018 19:42:06 +0000

The abuse is worrying.

However we don't want to end up in a situation where the host drops 
prematurely
the whole meeting is closed. Also we don't what to end up in a situation 
where the
chair who hosts the meeting needing  to leave ends a productive 
discussion that if
continued for a little while longer would resolve an issue that required 
significant
context.

- Stewart

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Mon, 5 Mar 2018 21:24:03 +0000

Hello Stewart,

The host role can be transferred just like the presenter role. I got another meeting abused last week. We had the interim canceled but I forgot to cancel the webex as well. Again it was used fraudulently...

Regards,

Pascal

> Le 5 mars 2018 à 20:42, Stewart Bryant <[email-masked]> a écrit :
> 
> 
> The abuse is worrying.
> 
> However we don't want to end up in a situation where the host drops prematurely
> the whole meeting is closed. Also we don't what to end up in a situation where the
> chair who hosts the meeting needing  to leave ends a productive discussion that if
> continued for a little while longer would resolve an issue that required significant
> context.
> 
> - Stewart
> 
>

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Mon, 5 Mar 2018 21:38:14 +0000

Hi Pascal, 
How did you become aware of the breach?
Thanks,
Acee

On 3/5/18, 4:24 PM, "WGChairs on behalf of Pascal Thubert (pthubert)" <[email-masked] on behalf of [email-masked]> wrote:

    Hello Stewart,

    Regards,
    
    Pascal

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Tue, 6 Mar 2018 21:27:52 +0000

Hello Acee

I created the webex on my Cisco account. I got a message from inside about the abuse being taken seriously. 

Regards,

Pascal

> Le 5 mars 2018 à 22:38, Acee Lindem (acee) <[email-masked]> a écrit :
> 
> Hi Pascal,

---

From: Alexa Morris <[email-masked]>
Date: Thu, 8 Mar 2018 10:56:18 -0800

I’m pleased to report that we believe we have resolved this issue. 

We have changed the Meeting Center configuration so that when the host leaves the meeting, the meeting will end. If the current host needs to depart before the meeting is over, they must actively assign the host role to another participant. Once this role has been transferred, the meeting will continue after the original host has departed. 

You can reassign the host role by highlighting the name of the selected participant and going to Participant / Change Role To / Host. 

If you believe this does not solve the issue, please let me know. 

Alexa

> On Mar 6, 2018, at 1:27 PM, Pascal Thubert (pthubert) <[email-masked]> wrote:
> 
> Hello Acee
>

---

From: Toerless Eckert <[email-masked]>
Date: Thu, 8 Mar 2018 20:20:14 +0100

Thank you, Alexa!

On Thu, Mar 08, 2018 at 10:56:18AM -0800, Alexa Morris wrote:
> I???m pleased to report that we believe we have resolved this issue. 
> 
> >> ???On 3/5/18, 4:24 PM, "WGChairs on behalf of Pascal Thubert (pthubert)" <[email-masked] on behalf of [email-masked]> wrote:
> >> 
> >>   Hello Stewart,
> >> 

-- 
---
[email-masked]