Meeting Owl 3, hands on: Upgrade to 360-degree conference camera is clouded by security issues

Owl Labs, the company behind the Meeting Owl — a wi-fi enabled combination of 360-degree conference camera, microphone array and speakers — has released the third generation of its flagship product in the shape of the Meeting Owl 3.

With hybrid working now firmly established in many companies, technology that helps remote workers collaborate productively with office-based colleagues has become increasingly sought-after. According to Owl Labs, its products are used by over 100,000 organisations worldwide, including 84 in the Fortune 100.

As with previous models, participants see a 360-degree panoramic view of the Meeting Owl-equipped room, plus up to three panels that dynamically zoom in on attendees who are speaking or moving. Key hardware upgrades in the Meeting Owl 3 include a USB-C rather than Micro-USB connection to a host PC, and an optional HDMI-connected Expansion Mic to extend the audio range. New user-experience capabilities are also available via upgraded OIS (Owl Intelligence System) software.  

The Meeting Owl 3 is available now in the US at $999, while the Expansion Mic costs $249. Launching today in the UK and Europe, the Meeting Owl 3 costs £1,049 / €1,149, with the Expansion Mic priced at £249 / €275.

Unfortunately, as described below, recent revelations about security issues within the Owl Labs ecosystem have taken some of the shine off the launch of the Meeting Owl 3. But first, let's examine the new product.

Design & Features

The Meeting Owl 3 has a near-identical look and feel to the second-generation Meeting Owl Pro. It's a slightly tapering grey 111m-diameter cylinder topped by a 360-degree 1080p camera, containing 8 omni-directional beam-forming mics and three speakers, with controls and connections at the bottom. Around the base there are microphone mute and volume up/down buttons, plus an option button that toggles the Presenter Enhance feature, while power and PC connections are tucked away on the underside. The 1.2kg device stands 273mm tall and owes its strigiform appearance to a pair of LEDs at the top, separated by a ‘beak' housing the company branding (‘Owl Labs' on the new model, compared to ‘Owl' on its predecessor).

There are two changes to the Meeting Owl 3 hardware. One is a Micro-HDMI port in the base, just below the volume up/down controls. This is for attaching the optional puck-shaped Expansion Mic, which extends the audio pickup range from 5.5m (18ft) to 8m (26ft) for better coverage in larger meeting rooms. You also get a mute button on the Expansion Mic. The other difference is a USB-C port on the underside of the Meeting Owl 3, next to the power input, which replaces the legacy Micro-USB port on the Pro model.

Owl Labs says that upgraded OIS (Owl Intelligence System) software delivers improved facial recognition (5x increase in accuracy when detecting masked faces and 58% better accuracy when identifying faces that are farther away), plus faster detection (4x faster to automatically focus on in-room participants, zooming in within 3 seconds after they speak or move). There's no change in the underlying Qualcomm Snapdragon 605-based compute platform or the 360° camera's 1080p resolution.

You can also use Owl Connect to pair two Meeting Owl devices (3 or Pro) to extend video range up to 8.5m (28ft) and audio range up to 13.5m (44ft) if required. And if you set up and register devices via the Meeting Owl app, you can manage devices remotely via Owl Labs' web-based Nest portal. The OIS firmware upgrade introduced with the Meeting Owl 3 will be available for the previous Pro model.

Meeting Owl 3 specifications vs Meeting Owl Pro

Owl Labs has a couple of other elements to its portfolio, in the shape of Whiteboard Owl, a $599 dedicated whiteboard camera, and Meeting HQ, an all-in-one meeting room solution costing $1,459 plus a $20/month software subscription.   

User experience

Setting up the Meeting Owl 3 is straightforward enough: connect it up to power and a host PC via the supplied USB-C cable, download the companion app — which is available for iOS and Android devices, as well as iPads, Macs and Windows PCs — and follow the subsequent instructions. The app communicates with the Meeting Owl via Bluetooth LE and allows you to set a passcode to restrict access to configuration options. You can then attach the device to the local Wi-Fi network to receive software updates, inspect and configure other system settings, and pair with another Meeting Owl via Owl Connect. You can also sign up for Meeting Analytics by entering your email and receiving a link that gives access to the web-based Nest portal.

Once you've started a meeting (Meeting Owl 3 “works with Zoom, Microsoft Teams, Skype for Business, Slack, Webex and virtually all web-based video conferencing platforms”) and selected the device's camera and speaker, the default display shows a panoramic view in a strip at the top and up to three panels that focus in on participants who are speaking.

You have plenty of control – via the companion app – over the implementation and display of the Meeting Owl 3's functionality. You can lock the camera onto a particular person or area of the room, use Presenter Enhance to have it follow the main speaker, toggle the panoramic view on and off, and select an ‘Ignore Zone' that the device should avoid. You can also adjust the alignment of the panoramic view, vertically flip the camera view if the Owl is ceiling-mounted, and adjust advanced audio settings (for noise reduction and hearing two speakers who are talking at the same time).

If you have a Whiteboard Owl, you can switch to and from its video feed by flipping the supplied magnetic tags on your whiteboard. A key feature highlighted by Owl Labs at this product's launch was the ability to download and access high-resolution images of the whiteboard content created during the meeting via a portal and a meeting-specific passphrase. However, as noted below, this whiteboard content portal was recently found to be accessible by hackers.

The Nest portal provides visibility and control over Meeting Owls in your organisation, allowing admins to determine who can see details of the devices on the network. Available information includes the device's name, status, serial number, software version and location, plus meeting analytics (number of meetings, average number of people in meetings), team members, billing information and integration between Meeting HQ and Zoom. You can also opt to disable (anonymised) data sharing that, Owl Labs says, helps to “improve your experience with Owl devices”. Going forward, Owl Labs plans to introduce an enterprise-class Fleet Management suite that gives IT managers even finer control over their populations of Owls.

Security issues 

On June 2, a report from Ars Technica drew attention to a security assessment by Swiss-German consultancy Modzero, which described “several critical security issues in the Owl Labs Meeting Owl product universe”.

According to the Modzero researchers, “Meeting Owl devices can be turned into rogue wireless network gateways to a local corporate network via Bluetooth, by arbitrary users. The device can be abused as a backdoor to the Meeting Owl Pro owners' local network…Modzero also discovered issues in the communication and authentication of the backend infrastructure. This includes the traditional HTTP(S)-based API communication as well as the Message Queuing Telemetry Transport (MQTT) services, hosted by Amazon Web Services (AWS).” 

In total, Modzero identified five CVEs (Common Vulnerabilities and Exposures), one of which  — CVE-2022-31460 — was added to the CISA's Known Exploited Vulnerabilities Catalog. Among the potential exploits demonstrated by Modzero was the ability for attackers to capture passphrases giving access to images captured during Whiteboard Owl sessions.

The report summary concluded that “While the operational features of this product line are interesting, Modzero does not recommend using these products until effective measures are applied. The network and Bluetooth features cannot be turned off completely. Even a standalone usage, where the Meeting Owl is only acting as a USB camera, is not suggested. Attackers within the proximity range of Bluetooth can activate the network communication and access critical IPC [Inter-Process Communication] channels.”

On Friday 3 June, Owl Labs issued a statement stressing that “we take security very seriously” and that “all of the high-priority security issues identified have been resolved with these updates being pushed in a new global software release today, 6.3.22 and Monday, 6.6.2022.” This was followed by an update on Monday 6 June highlighting a second software release, offering further reassurance that “all high-security issues have been addressed”, and stating that the company was in the process of implementing “a few additional updates”. These were covered off in a third release on 23 June.

Owl Labs isn't the first, and certainly won't be the last, IoT vendor to discover security holes in its devices. However, the popularity of the company's products — particularly the Meeting Owl — and the profile of its customer base, which includes many educational and government organisations, should have prompted it to double down on security. Despite noting that “We have a dedicated team that is focused on security alongside external vendors that we work with on our critical security projects, including third-party penetration tests”, it took an external consultancy to uncover and publicise vulnerabilities in the Meeting Owl Pro and Whiteboard Owl.

As far as the Meeting Owl 3 is concerned, Owl Labs told ZDNet that: “Following the security concerns raised by Ars Technica about the Meeting Owl Pro, we can confirm that all high-security issues have now been resolved, and will not impact the use of, or security of the Meeting Owl 3. There is no risk of unauthorised network access. User security is of utmost importance and we are committed to ongoing testing to ensure all of our products are as secure as possible.”

Speaking to ZDNet, Owl Labs CEO Frank Weishaupt added: “We do frequent software releases, and these were holes that were opened and unfortunately not closed…Our commitment to our customers is that security is a high priority for us. We're going to start doing twice-annual pen tests and release the results, giving comfort around new software releases. We're also giving IT administrators the ability to control what releases they accept, so if they want them to be in the market a little bit longer, or be pen-tested, before they release them to their fleet of Owls, they can do that as well.” 

Weishaupt also noted that the ability to capture and access Whiteboard Owl sessions had been “taken offline”, but would be reinstated once the architecture had been made secure.

Conclusions

Trust is a precious commodity for a tech company, and Owl Labs may have a job on its hands rebuilding customer confidence following these security revelations, although the company has clearly taken them seriously and acted swiftly.

We agree with Modzero about the operational features of Owl Labs' products, which are indeed ‘interesting'. The upgrades and options introduced with the Meeting Owl 3 all enhance the meeting experience, and hopefully the remedial security measures that the company has now applied will prove to be effective going forward. For the moment, though, we will refrain from giving the Meeting Owl 3, which is very much an evolutionary upgrade, a formal review rating.

Alternatives to consider

The Meeting Owl's combination of 360-degree camera, omnidirectional mics and speakers, and intelligent software is unusual but not unique. Chinese company Kandao offers several similar products, including the Android-based Meeting Pro, which can function as a standalone solution.

RECENT AND RELATED CONTENT 

Owl Labs' Whiteboard Owl brings physical whiteboards into hybrid meetings 

Meet the Meeting Owl Pro, and Owl Labs' Smart Meeting Room ecosystem 

Meeting Owl review: Putting remote workers in the video conferencing picture 

The 5 best telepresence robots: Super-charge remote work 

The best webcams: Top choices for remote-work video calls 

Read more reviews