Zoom vows to spend next 90 days thinking hard about its security and privacy after rough week, meeting ID war-dialing tool emerges

Passwords-by-default feature may be faulty. But hey, who else just went from 10 to 200 million daily users?

Video-conferencing app maker Zoom has promised to do better at security after a bruising week in which it was found to be unpleasantly leaky in several ways.

The pledge came in a memo to customers from CEO Eric S. Yuan, in which he said: “Over the next 90 days, we are committed to dedicating the resources needed to better identify, address, and fix issues proactively. We are also committed to being transparent throughout this process. We want to do what it takes to maintain your trust.”

The company said it has, amid the coronavirus pandemic forcing people around the world to work from home, seen its daily user numbers soar from 10 million in December to now 200 million. And with that increase, it's experienced a shed load of scrutiny from the media and information security types. In response to the shortcomings uncovered, Zoom has promised to:

  • Enact a feature freeze, effectively immediately, and shifting all our engineering resources to focus on our biggest trust, safety, and privacy issues.
  • Conduct a comprehensive review with third-party experts and representative users to understand and ensure the security of all of our new consumer use cases.
  • Prepare a transparency report that details information related to requests for data, records, or content.
  • Enhance our current bug bounty program.
  • Launch a CISO council in partnership with leading CISOs from across the industry to facilitate an ongoing dialogue regarding security and privacy best practices.
  • Engage in a series of simultaneous white box penetration tests to further identify and address issues.
  • Host a weekly webinar on Wednesdays at 10am PT to provide privacy and security updates to our community.

The developer has already fixed a Mac installer that behaved badly and other security flaws. It also removed the creepy attention-tracking feature that alerted meeting hosts if a participant clicked away from the app for too long.

However, the engineers now focused on security clearly have their work cut out. Last year, Check Point documented how it was easy to brute-force guess Zoom meeting ID numbers, which could be used to gatecrash non-password-protected conferences. In response, Zoom made creating a password a default setting, thwarting ID brute-forcing.

Unfortunately, miscreants keep Zoombombing virtual meetings, pasting in porno and other nonsense. So much so, Zoom published advice on how to keep uninvited morons out of private conferences. This week, the biz admitted to infosec journo Brian Krebs that this password-protected-by-default feature may not be working as intended, leaving people's meetings exposed.

In short, follow the advice to set a password, and don't publicly share those credentials, and do set limits on individual participants.


Tech won't save you from lockdown disaster: How to manage family and free time while working from home


Meanwhile, Krebs has been in touch with someone who has automated that meeting ID brute-forcing process. That someone is Trent Lo, a security professional and co-founder of Kansas City security meetup SecKC.

“Lo and fellow SecKC members recently created zWarDial, which borrows part of its name from the old phone-based war dialing programs that called random or sequential numbers in a given telephone number prefix to search for computer modems,” Krebs explained. And zWarDial found about 100 open meetings each hour.

Which shouldn’t be possible, because Zoom is supposed to apply a password by default, indicating perhaps there’s a scenario in which passwords aren't created by default. Or perhaps Zoom has so many meetings now, some are bound to have their passwords switched off by hosts to make life easier.

At least Zoom has a share price that’s above its early 2020 level, something not many listed companies can boast right now. It's standing at $121.93 apiece versus $68.72 on January 1. A Chinese company called Zoom Technologies also enjoyed a surge in investment after buyers mistook its $ZOOM ticker symbol for Zoom's $ZM. America's financial watchdog, the SEC, suspended trading of the Chinese company’s stock to stop that silliness. ®

Similar topics

Other stories you might like

  • Will this be one of the world's first RISC-V laptops?
    A sneak peek at a notebook that could be revealed this year

    Pic As Apple and Qualcomm push for more Arm adoption in the notebook space, we have come across a photo of what could become one of the world's first laptops to use the open-source RISC-V instruction set architecture.

    In an interview with The Register, Calista Redmond, CEO of RISC-V International, signaled we will see a RISC-V laptop revealed sometime this year as the ISA's governing body works to garner more financial and development support from large companies.

    It turns out Philipp Tomsich, chair of RISC-V International's software committee, dangled a photo of what could likely be the laptop in question earlier this month in front of RISC-V Week attendees in Paris.

    Continue reading
  • Did ID.me hoodwink Americans with IRS facial-recognition tech, senators ask
    Biz tells us: Won't someone please think of the ... fraud we've stopped

    Democrat senators want the FTC to investigate "evidence of deceptive statements" made by ID.me regarding the facial-recognition technology it controversially built for Uncle Sam.

    ID.me made headlines this year when the IRS said US taxpayers would have to enroll in the startup's facial-recognition system to access their tax records in the future. After a public backlash, the IRS reconsidered its plans, and said taxpayers could choose non-biometric methods to verify their identity with the agency online.

    Just before the IRS controversy, ID.me said it uses one-to-one face comparisons. "Our one-to-one face match is comparable to taking a selfie to unlock a smartphone. ID.me does not use one-to-many facial recognition, which is more complex and problematic. Further, privacy is core to our mission and we do not sell the personal information of our users," it said in January.

    Continue reading
  • Meet Wizard Spider, the multimillion-dollar gang behind Conti, Ryuk malware
    Russia-linked crime-as-a-service crew is rich, professional – and investing in R&D

    Analysis Wizard Spider, the Russia-linked crew behind high-profile malware Conti, Ryuk and Trickbot, has grown over the past five years into a multimillion-dollar organization that has built a corporate-like operating model, a year-long study has found.

    In a technical report this week, the folks at Prodaft, which has been tracking the cybercrime gang since 2021, outlined its own findings on Wizard Spider, supplemented by info that leaked about the Conti operation in February after the crooks publicly sided with Russia during the illegal invasion of Ukraine.

    What Prodaft found was a gang sitting on assets worth hundreds of millions of dollars funneled from multiple sophisticated malware variants. Wizard Spider, we're told, runs as a business with a complex network of subgroups and teams that target specific types of software, and has associations with other well-known miscreants, including those behind REvil and Qbot (also known as Qakbot or Pinkslipbot).

    Continue reading

Biting the hand that feeds IT © 1998–2022