Monday, March 10, 2025
HomeCyber Attack‘Glowworm’ Attack Spy Conversations of Participants in Virtual Meeting Platforms

‘Glowworm’ Attack Spy Conversations of Participants in Virtual Meeting Platforms

Published on

SIEM as a Service

Follow Us on Google News

The analysts of the Ben-Gurion University of Negev in Israel have detected a very unique way to spy on electronic conversations. The main initiative of finding this unique method was the TEMPEST Glowworm attack.

According to the report, this attack was targeting the speech of participants in a virtual meeting platform. The threat actors of this attack measure an audio output device’s LED power light that generally turns and transforms them into audio reproductions.

However, doing this generally allows the threat actors to have all the delicate conversations and know all the data that were being discussed in the meeting.

A modern and passive approach 

According to the experts, the most active features of the Glowworm attack that makes it more powerful are its modernity and its passivity. 

However, the approach for this attack needs no current signaling, as it would be resistant to any sort of electronic countermeasure movement.

The attack has complete passivity and it differentiates it from comparable approaches like a laser microphone that can pick up audio from the fluctuations on a windowpane. The threat actors of Glowworm do not need any sudden signal leakage or any kind of intrusion.

It only requires “The Thing” well it was a Soviet gift to the US Ambassador in Moscow, and both needed “illumination” and that’s why it transmitted a clear signal while it was being illuminated. 

Defense of Glowworm

However, we know that Glowworm has the ability to spy on the conversation without revealing itself, the main thing in this attack is that Glowworm doesn’t communicate with the actual audio, as it only depends upon the side effect of electronic devices that were producing audio during the meeting.

Glowworm has no real risk as it does not capture the audio of the one those who were present in the meeting room, the threat actor generally depends upon the remote participants whose voices are impersonated over the conference room audio system.

Glowworm Probation

After investigating the attack, the analysts have demonstrated the whole Glowworm experiment, this attack may work by designating a telescope with an electro-optical sensor from 35 meters away and along with speakers which are generally equated to the laptop.

0

However, the team has successfully captured a statement that was being played on the speakers, and later it was rendered by Glowworm. 

Most of the business that was being conducted over platforms like Skype is more sensitive enough and it is also difficult to attract eavesdroppers supplied with telescopes.

Glowworm Attack Demonstration

Apart from this, the security experts have found a way to stop this attack, however, it’s a unique method that will help to expose all the data which were being discussed in the meeting room.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

WinDbg Vulnerability Allows Attackers to Execute Remote Code

Microsoft recently disclosed a critical vulnerability impacting its debugging tool, WinDbg, and associated .NET...

Thinkware Dashcam Vulnerability Leaks Credentials to Attackers

A series of significant security vulnerabilities have been discovered in the Thinkware Dashcam, specifically...

New Apache Traffic Server Flaws Allow Malformed Request Exploits

The Apache Software Foundation has disclosed several vulnerabilities affecting its Traffic Server software.These vulnerabilities...

Commvault Webserver Flaw Allows Attackers to Gain Full Control

Commvault has revealed a major vulnerability in its software that could allow malicious actors...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

WinDbg Vulnerability Allows Attackers to Execute Remote Code

Microsoft recently disclosed a critical vulnerability impacting its debugging tool, WinDbg, and associated .NET...

Thinkware Dashcam Vulnerability Leaks Credentials to Attackers

A series of significant security vulnerabilities have been discovered in the Thinkware Dashcam, specifically...

New Apache Traffic Server Flaws Allow Malformed Request Exploits

The Apache Software Foundation has disclosed several vulnerabilities affecting its Traffic Server software.These vulnerabilities...