A critical flaw in the videoconferencing software of the Quebec Liberal Party (PLQ) – a Canadian federalist provincial political party – allowed a hacker to spy on and listen to the party's strategy discussions at its facilities and even access video conferences.
But fortunately, the unknown white hat hacker who discovered the flaw alerted PLQ staff to the security problem, showing them some videos of discussions held at the party headquarters as proof.
But what if the hacker had bad intentions?
He could have secretly spied on the party's video calls and could have handed over the sensitive information, along with the software flaw, to the main opposition party for financial gain.
It appears that the hacker spied on video conference meetings between PLQ's Quebec and Montreal branches.
According to the hacker, PLQ's software not only contained a security vulnerability, but they were also using the factory's default password, Le Journal de Montreal reports.
“It was just too easy. It was like they had their credit card PIN stuck,” he told local media sources.
“They’re not careful […] If it falls into someone else’s hands, who knows what could happen.”
The hacker, who wishes to remain anonymous, said he accessed the party's video during PLQ meetings, logged in multiple times, and listened to PLQ discussions about different circumstances at their facilities.
The hacker told the Canadian journalist about some of the topics discussed in the meetings.
He also showed the video feed from the PLQ cameras, and provided screenshots to substantiate his statements.
Party officials confirmed the data breach and took the hacker's bug report seriously, although they said no national-level issues were ever discussed in these meetings.
“We take this information very seriously,” said Maxime Roy, communications director. “We already have a team of experts working to understand what happened and connect the computer breach to the videoconferencing system as soon as possible.”
As they stated after a thorough investigation of the issue, PLQ employees fixed the error and changed the software's default password.
