Missives from the 6th Floor

Cisco VoIP phones can exhibit a similar behavior with a SOAP call. You can basically tell the phone to start multicasting whatever the mic pics up. The only indicator that behavior is occuring is the small LED on the phone that lights up. The big LCD display doesn't change at all.

One of my engineers used to call India this way. Since he didn't have a conference calling card and he didn't want to stay at the office in the evenings, he'd VPN in and issue SOAP calls to his phone to setup a three way call between him and the engineer in India. If you were in the office, you could hear the speakerphone but since the conversations were work related he didn't particularly care.

To make matters even more fun, most people don't change their default passcode which is only six digits since voicemails appear as wav files in their inbox. It's just easier to to doubleclick on a wav file and listen. With only six digit passcodes and no real auditing on SOAP calls, brute forcing someone's passcode is pretty easy.