2

After the reports of the huge security flaws in Cisco's Webex browser plugins, I've uninstalled all of their browser plugins and would rather run it directly from the command line.

I've figured out that the following seems to work for me but it's really brittle:

"$HOME/Library/Application Support/WebEx Folder/T31_TC/Training Center.app/Contents/MacOS/Training Center"

The big question is how the browser plugins injects the name of the conference or how my authentication information into the WebEx application.

  • It doesn't seem to be through environmental variables at least.
  • I can't get dtruss to work with it to see what files it is opening.

Anyone figured this out? Thanks much if so.

EDIT:

Aha. I see the following file that seems to hold a bunch of params.

"$HOME/Library/Application Support/WebEx Folder/T31_TC/webexparameters.txt"

I see the following entries there:

  • Plaintext password (not really _secret). More Cisco security prowess:
    [NAME]-=-oneclickoption-=-[VALUE]-=-4%_secret-=-
  • The conference name in many, many places. One is:
    [NAME]-=-szsiteurl-=-[VALUE]-=-https://companyname.webex.com/conferencename/k2-=-
  • Plaintext email address in many places.

Anyone else gotten farther than I?

  • 2
    Honestly, if I was forced to use WebEx I'd fire up a virtual machine and run it in there. – py4on Feb 17 '17 at 19:13
  • Yeah not a bad idea @py4on. – Gray Feb 17 '17 at 21:07
  • Obviously for full effect you need to treat that VM as disposable and not store anything of value on it. – py4on Feb 17 '17 at 21:09
  • @Gray The article you linked to shows a screen shot for installing WebEx extension in Chrome, which alternatively offers to 'Run a temporary application to join this meeting'. I haven't had a chance to try it. The VM option is a no-brainer though. – 1.61803 Nov 16 '17 at 0:08

You must log in to answer this question.

Browse other questions tagged .