Don’t Call Us We’ll Call You: McAfee ATR Finds Vulnerability in Agora Video SDK

McAfee Advanced Threat Research discovered that versions of the Agora Video SDK prior to 3.1 transmitted call-setup parameters (App ID, channel name, token) in cleartext, allowing a network attacker to identify in-progress calls and join them unnoticed; the finding was assigned CVE-2020-25605, affected popular apps that used hardcoded App IDs and disabled encryption, and was mitigated when Agora released SDK version 3.2.1 which encrypts the initial call setup.