Polycom Trio 8800 major "spy" bug - picking up audio from another meeting room

[Anonymous]

Hello, 

We use the Polycom Trio 8800 (SfB Server 2015) in our meeting rooms and I have been made aware of a "spy" bug where one room is playing the audio of an active conference in another meeting room. This has happened twice in the past 8 moths, so it's rare, and someone recorded a video of the lastest incident. I guess this is also a security concern given the latest one was playing the audio of a confidential conference (so I can't post it).

All the Trio are using the latest firmware and have separate Skype accounts. The video recording of the latest incident shows the "spy" phone home screen with presence "green - available" and not connected to the conference. Essentially the phone is sitting there idling away like how you would find it when you walk into the room before a meeting, except it is playing the audio conference in another room. The phone was rebooted to end the "spying" game. Any insight on how to prevent this is appreciated. Thanks.

[SteffenBaierUK]

Hello @Xudonym ,

welcome to the Poly Community.

Both the communities Must Read First and the FAQ reference the basic minimum information a new or follow up post should contain.

This ensures the questions having to be asked are limited and any new or follow up post contains the right amount of details to ensure any voluntary participant within the community does not spend additional time chasing basic information.

As a reminder the basic information asked for:

• Provide the exact Software Version of your Phone
• Provide the Phone Model
• Provide the Call Platform (aka openSIP,Teams, Skype for Business Online, Skype for Business on Premise, Lync)
• Provide details if UC / SIP or ObiEdition
• Additional Poly Infrastructure (RPRM,PDMS or BToE)
• If applicable provide a backup of the phone in question

UC Software 4.0.0 or later via the Web Interface Utilities > Phone Backup & Restore > Phone Backup > Phone Backup. Please rename into .TXT or Zip the file to attach.
Since UC Software 5.9.0 simply provide this via the Web Interface Diagnostics > Download Support Information Package

• If possible provide a Log and either attach them or use the Code Tag.Consult the Troubleshooting Section found within the FAQ if applicable
• If possible provide the MAC Address or Serial of the device
• Provide details for example if the issue is a day 1 issue or only happened after an upgrade or any other relevant details
• For questions around Support please check here

Whilst providing some of these details may not directly impact any possible answer the community can provide, it does enable Poly to have an overview of the current software used. In addition, providing all details at the same time allow us to check logs or look up potential support partners if an issue needs to come into support. It also enables us to verify the entitlement for using features.

Are you sure someone has not enabled Bluetooth and is using the phone as a Speaker? Older Versions would not always alert a customer via the UI.

Please ensure to provide some feedback if this reply has helped you so other users can profit from your experience.

Best Regards

Steffen Baier

[Anonymous]

Hi Steffen,

Thanks for responding. I'm 99% sure that the Trio 8800 wasn't paired over BlueTooth to a mobile and acting as a speaker+mic. In that situation the user would not hear or speak because audio would be going to the Trio only. Even when paired just for speaker, the audio would only come out on the Trio and not source device. Also, the Trio 8800 screen would show the call info, however, during the incident the phone was showing the normal home screen with no indicator that it was connected to a call or BT. I have tested pairing an Android mobile to the Trio 8800 over BT and the screen was showing the call info and audio was only on the Trio and not on the mobile.

Our fleet for Trio 8800 phones are connecto to SfB 2015 on-premises and running software version 5.9.0.11398.

Thanks.

[SteffenBaierUK]

Hello @Xudonym ,

I reached out via email so we can check this and involve our security department if required. Could you kindly lookout for this and respond?

Please ensure to provide some feedback if this reply has helped you so other users can profit from your experience.

Best Regards

Steffen Baier

[SteffenBaierUK]

Hello @Xudonym ,

I contacted you again via Email and am looking forward to your response.

Best regards

Steffen Baier

[Anonymous]

Wondering if there was any luck around getting to the bottom of this issue as we are experiencing a similar issue. 

On our end we have Trio 8800's in 4 of our meeting rooms and a user in 'Meeting Room A' was conducting a Skype for Business call and the Trio in 'Meeting Room B' was picking up the audio from said call, even though it was: -

     1) not involved or connected to the meeting and

     2) just in it's idle state sitting on the table waiting for a connection.

In our situation, the user in 'Meeting Room A' was using the Trio as a Speaker/Mic connected to a laptop via USB while the laptop conducted the Skype meeting. The user was not using bluetooth at all

We have also seen a similar problem where our Polycom Group Station 310's audio was being output on random Trio's in other meeting rooms.

Same as your situation, this particular call was a confidential one that other people should not have been able to hear, and the issue is sporadic and quite rare in occurance.

[SteffenBaierUK]

Hello @Varko ,

Welcome to the Poly Community.

As you can see by the lack of feedback from @Xudonym I also additionally reached out via Email but never received a response.

I suggest getting this into support but the Trio would not connect to a GroupSeries.

In order to raise a support ticket, you need to work with your Poly reseller as they may need to do this for you.

End Customers are usually unable to open a ticket directly with Poly support.

If this is some sort of an Internet discounter providing your MAC address or your Poly devices serial will enable us to look up who would be able to support you. This may not be who you purchased the Poly device from.

If the unit is no longer within the warranty please be prepared to Pay Per Incident / PPI. This is all outlined in detail here

Please ensure to provide some feedback if this reply has helped you so other users can profit from your experience.

Best Regards

Steffen Baier