Do you use Zoom? Sure you do. When the pandemic hit North America and Europe in March 2020, seemingly everyone who had to start working, going to school or even socializing from home started using the videoconferencing service.
Boy were there growing pains though. Zoom went from 10 million daily users in December 2019 to 300 million daily users in April 2020. Its security and privacy practices came under sharp scrutiny — and experts didn’t like what they found.
Zoom’s end-to-end encryption wasn’t quite end-to-end. Other Zoom meeting attendees could see a lot about you. Pranksters and bored teenagers could — and sometimes still — “Zoom bomb” public meetings with shocking or rude content.
Zoom’s privacy policies also seemed to give the company the right to do whatever it wanted with users’ personal data.
Most of those flaws have been fixed or otherwise mitigated since the spring of 2020, but newer issues crop up occasionally. We’ve got a running list of what’s gone wrong with Zoom, what’s been fixed and what’s still an open issue — after we give you a few tips on how to make Zoom safer to use.
With all these issues, people have been looking for alternatives to Zoom, so check out our Skype vs Zoom face-off to see how an old video app has adapted for video conferencing. We’ve also compared Zoom vs Google Hangouts as well, and even have a rundown of the best free Zoom backgrounds.
How to make Zoom safer to use
Unless you’re discussing state secrets or personal health information, Zoom should be fine to use. It’s easy to set up, easy to use and lets up to 100 people join a meeting for free. It just works.
For school classes, after-work get-togethers, or even workplace meetings that stick to routine business, there’s not much risk in using Zoom. Kids will probably continue to flock to it, as they can even use Snapchat filters on Zoom.
Here’s what you can do to make Zoom safer:
— Set up Zoom’s two-factor authentication to protect your account.
— Join Zoom meetings through your web browser instead of via the Zoom desktop software. The web browser version gets security enhancements faster and “sits in a sandbox” to limit security problems, notes antivirus company Kaspersky (opens in new tab).
When you click a link to join a meeting, your browser will open a new tab and prompt you to use or install the Zoom desktop software. But there’s a smaller link to “join from your browser.” Click that instead.
— Ask that Zoom meeting participants sign in with a password if you are hosting a meeting. That will make Zoom-bombing much less likely.
Everything that’s gone wrong with Zoom lately
We’ve put the most recent Zoom issues up top and separated older problems into those that are unresolved, those that have been fixed and those that don’t fit into either category.
August. 15, 2022: Zoom patches a security flaw on macOS
Security researcher Patrick Wardle discovered a serious weakness in Zoom that could allow a hacker to take control of macOS, letting them edit, add or even delete files at will.
Fortunately, Zoom acted quickly to patch the flaw, so Mac users need to update Zoom right away to make sure they’re protected against the exploit.
July. 28, 2022: Zoom goes down for thousands of users
Zoom suffered an outage that affected thousands of users based on reports from Downdetector. According to the company’s status dashboard, its telephony feature faced degraded performance that made it difficult for users to make calls using Zoom Phone.
The issue has since been fixed and everything appears to be working as normal at Zoom now.
May. 25, 2022: Tricking users into downgrading their Zoom client
A security researcher from Google’s Project Zero discovered a security flaw in which the Zoom Client for Meetings and Zoom Rooms for Conference Room software fail to properly check the installation version during the update process. As Zoom’s server and its client server use different XML parsing libraries, a hacker could send a specific message to force the target client to download an older version of Zoom to launch attacks using vulnerabilities that have since been patched.
This security flaw was patched with the release of Zoom version 5.10.0 which also fixes a number of other vulnerabilities. Updating to the latest version of the videoconferencing software will protect you from any attacks exploiting this flaw.
Feb. 10, 2022: Mac microphones not turning off
Following reports from multiple Mac users who said their microphones stayed on even after Zoom meetings had ended, Zoom pushed out a patch that was supposed to fix the problem. It didn’t quite work.
Another patch a month later finally did turn the microphones off. Make sure your Zoom desktop client on Mac is updated to version 5.9.3. You may have to install the update “manually” by downloading it directly from the Zoom website (opens in new tab).
Dec. 7, 2021: Zoom enables automatic updates
Zoom’s client software for Windows and Mac personal use now lets you enable automatic updates (opens in new tab), which means you’ll get all the latest crucial security fixes as soon as they come.
Even better, the new feature lets you choose a “fast” or “slow” lane for less urgent updates, meaning that you can choose whether to get all the latest features and risk a little instability, or to proceed at a steady pace with maximum reliability.
Automatic updates will probably be enabled by default soon for all new and existing users. If you’d like to turn off (or turn on) the feature, go to Zoom > Settings > General and look for “Zoom Updates.”
Dec. 7, 2021: Zoom class-action-lawsuit settlement
As a result of a settlement in a class-action lawsuit relating to some of the privacy and security issues detailed earlier on this page, anyone who used Zoom between March 30, 2016 and July 30, 2021 is entitled to a cash payout.
It might not be a lot of money per person. Paying Zoom subscribers “are entitled to receive either 15% of the total you paid to Zoom” during the eligibility period “or $25, whichever is greater.” Free Zoom users can get $15. The amounts may be reduced if more people file claims than Zoom can pay out from the $85 million allocated.
To file a claim, read the fine print at ZoomMeetingClassAction.com (opens in new tab) and then go to the Submit a Claim (opens in new tab) page. Tom’s Guide cannot guarantee that you will get anything.
Nov. 18, 2021: Zoom fixes three serious flaws in conferencing software
Zoom has patched three serious flaws in some of its enterprise video-conferencing software, the worst of which could have let an attacker penetrate a company’s internal server system.
The following enterprise Zoom applications are vulnerable and must be updated, per a report from Positive Technologies (opens in new tab): Meeting Connector Controller up to version 4.6.348.20201217; Meeting Connector MMR up to version 4.6.348.20201217; Recording Connector up to version 3.8.42.20200905; Virtual Room Connector up to version 4.4.6620.20201110; and Virtual Room Connector Load Balancer prior to version 2.5.5495.20210326.
Regarding consumer software, Zoom has fixed a security flaw in Zoom Client for Meetings for Windows, which needs to be updated to version 5.5.4. That’s according to the Zoom Security Bulletin (opens in new tab) page.
Oct. 19, 2021: Zoom requires users to be no more than 9 months behind in software updates
Zoom announced that beginning Nov. 1, 2021, “customers will be required to update their Zoom software (opens in new tab) to ensure it is no more than nine months behind the current version at any given time.” If you don’t update your software, you won’t be able to join Zoom meetings.
Anyone running software older than that will be prompted to update their software. This affects all Zoom software running on all supported platforms except for Zoom Room Controller software, at least for now.
Sept. 30, 2021: Zoom security flaws patched
Zoom disclosed several security issues (opens in new tab) that had been fixed in later versions of Zoom’s desktop clients and plug-ins for Microsoft Outlook for both Windows and macOS.
The flaws ranged in severity from low to high, with some allowing remote code execution — i.e., hacking over the internet — on user machines. All were patched by at least Zoom Client for Meetings 5.4.0 and Zoom Plug-In for Microsoft Outlook for Mac 5.0.25611.0521.
Sept. 13, 2021: Encrypted Zoom Phone calls
Zoom announced that it planned to roll out end-to-end encryption (opens in new tab) to Zoom Phone (opens in new tab), its paid cloud calling service for Pro, Business or Enterprise accounts. The end-to-end encryption will be an option for one-to-one Zoom Phone calls.
Aug. 13, 2021: Zoom fixes hacking flaw
Zoom announced via its Zoom Security Bulletin (opens in new tab) that the remote-hacking flaw demonstrated at the Pwn2Own competition in April had been fixed.
All users, whether on Windows, Mac or Linux, should update their Zoom Client for Meetings software to version 5.6.3 or later.
July 31, 2021: Zoom settles class-action lawsuit
Zoom reached a tentative settlement in a federal class-action lawsuit that alleged the company skimped on security, misled users and shared user personal data with third parties without notification or consent.
According to the agreement, which has yet to be approved by a judge, Zoom will pay $85 million to be distributed to anyone who had a Zoom consumer account between March 2016 and now. (Enterprise and government Zoom account holders are not part of this litigation.)
Paying Zoom users are eligible to receive 15% of their subscription fees or $25, whichever is greater; non-paying users are eligible to receive $15. Known class members will be notified by email or regular mail that they can file a claim, and others will be able to use the website www.zoommeetingsclassaction.com when it goes live.
Zoom does not admit wrongdoing as part of the settlement.
June 4, 2021: New Zoom privacy policy
Zoom has released a “simpler, clearer (opens in new tab)” privacy policy that reflects the fact that the online meeting service has “shifted from a primarily enterprise-focused product to one that is also used broadly by individuals” during the COVID-19 pandemic.
The updated privacy policy includes more details about who can “see, save and share” Zoom meeting content, and the kinds of data that Zoom collects from users’ devices.
You can read the full updated Zoom privacy “statement” here (opens in new tab).
May 1, 2021: Zoom introduces privacy notifications
In a blog post, Zoom announced that it had added privacy notifications (opens in new tab) to the latest version of its desktop client software.
“Users will see new in-product notifications designed to make it easier to understand who can see, save, and share their content and information when they join meetings and experiences hosted on Zoom,” says the post.
The notifications appear in the in-meeting chat window as a button labeled “Who can see your messages?” Click your mouse on that, and a notification bubble will pop up with the answer.
“Users will find similar information when they use other meeting features,” says the blog post, “such as transcription, polls, and Q&A.”
It added that future updates would include notifications when a meeting host or participant uses a Zoom transcription or scheduling app during a meeting.
April 8, 2021: Zoom flaw lets hacker hijacks PCs and Macs
Two researchers demonstrated at the Pwn2Own contest that they could remotely take over Windows PCs and Macs by using at least one previously unknown vulnerability in the Zoom desktop application.
Fortunately, the only people who fully understand how this exploit works are the two researchers and Zoom itself, which is working on a fix. The chances of this attack being used “in the wild” are low, but if you’re concerned, use the Zoom browser interface instead during meetings until this is fixed.
March 19, 2021: Flaw lets other Zoom users see way too much
Zoom lets meeting participants share all of their computer screens, part of their screens, or just specific application windows with other people in the same meeting.
Two German researchers discovered that for a brief moment, the entire screen may be visible even when the Zoom user sharing the screen intends only part of the screen to be. Any participants recording the meeting would be able to freeze frames during playback and view potentially sensitive information.
Zoom said it was working to fix the issue, but at the time of this writing, the flaw was still present in the latest version of the Zoom desktop client software for at least Windows and Linux.
Feb. 23, 2021: Zoom’s Keybase encrypted chat fixes a serious flaw
Keybase, an encrypted social-media verification system and chat app bought by Zoom in May 2020, had a serious flaw (opens in new tab) that preserved images in online directories even after the user had deleted them.
The flaw was reported to Zoom in early January 2021, and a Keybase software update to fix the flaw was released later that month.
Feb. 8, 2021: Study says trying to stop Zoom-bombing often won’t work
A new study conducted by researchers at Boston University and Binghamton University found that efforts to stop “Zoom bombing,” such as requiring passwords or making attendees stew in “waiting rooms,” often won’t work.
That’s because many attacks are carried out by “insiders” who are already authorized to be in the meetings.
“Our findings indicate that the vast majority of calls for Zoom bombing are not made by attackers stumbling upon meeting invitations or brute-forcing their meeting ID, but rather by insiders who have legitimate access to these meetings, particularly students in high school and college classes,” states the paper, entitled “A First Look at Zoombombing (opens in new tab).”
The “only effective defense” against such insider attacks, the paper argues, is to create “unique join links for each participant.”
Jan. 29, 2021: City works to outlaw Zoom-bombing
Plagued by an epidemic of Zoom-bombing during city-assembly meetings, the city of Juneau, Alaska is exploring ways to outlaw the practice.
“We’ve had a few at the assembly level, we’ve had a few at the school-board level, we’ve had a few in some committee board time meetings,” city attorney Rob Palmer said, according to the website of radio station KTOO (opens in new tab).
Police in Alaska’s capital have had a hard time tracking down the Zoom bombers. The city hopes that by making the practice illegal, it can compel Zoom to turn over information identifying the digital miscreants.
Dec. 21, 2020: Zoom executive accused of being Chinese spy
In a bombshell announcement, the U.S. Department of Justice (opens in new tab) said it had issued an arrest warrant for former Zoom executive Jin Xinjiang, aka Julien Jin, who until recently had served as the liaison between Zoom and the Chinese government.
The U.S. accused Jin of using his position to disrupt and terminate Zoom meetings among U.S.-based Zoom users commemorating the anniversary of the 1989 Tiananmen Square massacre and to provide information to the Chinese government about Zoom users and Zoom meetings. Jin is thought to be residing in China.
Jin allegedly had help from unnamed co-conspirators who created fake email accounts and Zoom accounts in the names of known Chinese dissidents “to fabricate evidence that the hosts of and participants in the meetings to commemorate the Tiananmen Square massacre were supporting terrorist organizations, inciting violence or distributing child pornography.”
The Dept. of Justice said the Chinese government used information provided by Jin to retaliate against Zoom users in China or the Chinese-resident families of Zoom users outside China.
The DoJ announcement and arrest warrant (opens in new tab) refer only to an unnamed “Company-1” as Jin’s employer, but in a blog post, Zoom admitted that it was the company (opens in new tab) and that it had been conducting its own investigation after it received a subpoena from the U.S. government in June 2020.
The post further explained that Jin had been hired by Zoom in October 2019 as part of an agreement with the Chinese government, which in September 2019 had “turned off our service in China without warning.”
The price of getting Zoom turned back on in China was to hire “an in-house contact for law enforcement requests” — i.e., Jin — and to move data on Chinese users to servers in China. Zoom service was restored in China in November 2019, and the Dept. of Justice’s arrest warrant for Jin was issued a year later.
“We learned during the course of our investigation that this former employee violated Zoom’s policies by, among other things, attempting to circumvent certain internal access controls,” Zoom said. “We have terminated this individual’s employment.”
Zoom admitted that Jin “shared or directed the sharing of a limited amount of individual user data with Chinese authorities,” and that the information of “fewer than ten … non-China-based users” had also been provided to China.
Dec. 7, 2020: Zoom phishing scams
The Better Business Bureau (opens in new tab) is warning Zoom users that scammers are trying to steal their usernames and passwords via phishing emails and text messages, reports Threatpost (opens in new tab).
The messages tell you that “your Zoom account has been suspended” or that “you missed a meeting,” and offer a helpful link to log back in. But don’t fall for the bait — the login page is really a trap to capture your Zoom user credentials, with which the crooks can use or even steal your Zoom account.
Nov. 16, 2020: Zoom finally busts Zoom-bombing
One of the biggest problems with Zoom has been “Zoom bombing,” in which uninvited participants crash a Zoom meeting and disrupt it. Over the weekend, Zoom released two new features to combat this.
One, “Suspend Participant Activities,” lets the meeting host pause the meeting, kick out disruptive participants, and then resume the meeting. The other, “Report by Participants,” extends to meeting participants the ability to report disruptive participants, a remedy that previously had been given only to meeting hosts.
Nov. 10, 2020: FTC says Zoom lied about security
The Federal Trade Commission announced that Zoom “misled users” and “engaged in a series of deceptive and unfair practices” regarding its own security. The FTC cited the fake end-to-end encryption uncovered in March and software that Zoom installed on Macs without authorization in 2018 and 2019.
Zoom must agree to yearly internal security reviews and external security reviews every other year and must implement a vulnerability-management program. Another stipulation was that Zoom offer customers multi-factor authentication, which it has already implemented.
Nov. 6, 2020: Zoom keystroke snooping
Researchers in Texas and Oklahoma discovered that it’s possible to tell what someone is typing during a Zoom call just by watching their shoulders and arms.
Using a computer, the research team was able to figure out people’s passwords up to 75% of the time, depending on camera resolution and whether the subject was wearing a sleeved shirt or had long hair.
Any kind of video-conferencing platform could be used for this, the researchers said, as could YouTube videos or streaming platforms like Twitch.
Oct. 27, 2020: End-to-end encryption goes live
Zoom’s end-to-end-encryption feature finally went live, except on iOS where it had to wait for Apple’s approval. We’ve got instructions on how to enable Zoom’s end-to-end encryption.
Oct. 15, 2020: End-to-end encryption is coming soon
After a long period of time with no Zoom news, the company announced that the end-to-end encryption it had been working on for many months would soon be available for beta testing.
Users will have to wait for a Zoom client software update in the third week of October. Meeting hosts will be deciding whether to make a Zoom meeting end-to-end encrypted. Those meetings will not work (for now) for users trying to join via the web-browser interface or over the telephone.
July 31, 2020: Security flaw would have allowed anyone to join a public meeting
If you recall that the Zoom web interface was out of commission for a few days back in April 2020, now we know why: The company was fixing a very serious security flaw that could have let anyone join a private Zoom meeting.
British security researcher Tom Anthony (opens in new tab) detailed on his blog this week how he found that he could make endless random guesses on the 6-digit PINs Zoom assigns to private meetings. That’s a million possibilities to go through, which might be tough for a human, but isn’t hard for a decently powered PC running multiple threads.
Anthony found he could break into Zoom meetings in about half an hour, give or take. That’s long before many meetings are over.
The flaw is fixed now, so you don’t need to worry about that particular avenue of Zoom bombing.
STATUS: Fixed.
July 10, 2020: Remote takeover flaw
An unnamed security researcher found a critical flaw in the Zoom meetings client software for Windows that would let a hacker remotely take over any PC running Windows 7 or earlier. Zoom fixed the flaw with a software update soon after the flaw became public knowledge.
STATUS: Fixed.
June 17, 2020: Zoom caves to critics, will offer end-to-end encryption to everyone
Backing down after sustained criticism from privacy advocates, Zoom announced in a blog posting June 17 (opens in new tab) that its upcoming end-to-end encryption (E2E) wouldn’t just be for paid users any more. The millions of people who use Zoom for free for school, socializing and work would get end-to-end encryption too.
“We have identified a path forward that balances the legitimate right of all users to privacy and the safety of users on our platform,” CEO Eric S. Yuan wrote. “This will enable us to offer E2EE as an advanced add-on feature for all of our users around the globe — free and paid — while maintaining the ability to prevent and fight abuse on our platform.”
But if you’re a free user who wants E2E, you’ll first have to verify your identity to Zoom via a one-time-password or similar service. This will make it harder to “zoom bomb” meetings.
The E2E encryption will remain an optional feature, Yuan reminded, because when it’s activated, no one can join a meeting over the phone or with certain office teleconferencing equipment. It’ll be up to meeting hosts whether to activate E2E.
June 12, 2020: Censorship
Zoom’s in hot water in the U.S. over free speech and censorship after, bowing to Chinese government demands, it temporarily suspended the accounts of three Chinese dissidents who were hosting open meetings commemorating the June 4 anniversary of the Tiananmen Square massacre.
The company apologized for the actions in a blog post June 11 (opens in new tab) and said it would develop a way to block meeting participants from certain locations (i.e., China) without shutting down meetings entirely.
That wasn’t enough to satisfy more than a dozen U.S. congressmen and senators from both parties, who wrote letters to Chinese-born Zoom CEO Eric S. Yuan demanding to know how cozy his company was with the Beijing government.
June 4, 2020: Cisco Talos reveals two serious Zoom flaws
Talos (opens in new tab), an information-security research firm owned by Cisco, revealed June 3 that it had found two serious flaws in Zoom client applications, both of which have now been patched.
The first flaw (opens in new tab) would have let an attacker use a specially created animated GIF placed in a Zoom meeting chat to hack Zoom client software on other people’s machines to force the installation of malware, or, as Talos put it, “achieve arbitrary code execution.”
The second flaw (opens in new tab) also involves the chat function in Zoom meeting client software, with similarly serious potential consequences. The problem was that Zoom did not validate the contents of shared compressed files such as .zip files.
An attacker could have sent malware in the form of a compressed file to a user via Zoom meeting chat, and the user’s Zoom client would have saved and opened the malware within the Zoom application’s directory.
Even worse, if the user were to save the Zoom compressed file elsewhere on the PC, such as on the desktop, then the attacked could send an altered version of the first file with the same name.
Zoom would open the second version (but not the first) automatically, permitting the malware to “plant binaries at almost arbitrary paths and … potentially overwrite important files and lead to arbitrary code execution.”
STATUS: Fixed.
Monday, June 1, 2020: End-to-end encryption may be limited to paid users
Zoom’s upcoming end-to-end encryption is mainly for paid users, as Zoom itself stated back on May 7. But Alex Stamos, a well-known information-security expert who is consulting Zoom on security matters, told Reuters (opens in new tab) last week that schools and other non-profit enterprises might be able to also get the end-to-end encryption for their accounts.
“The CEO is looking at different arguments,” Stamos told Reuters. “The current plan is paid customers plus enterprise accounts where the company knows who they are.”
May 27, 2020: Security update
All administrators of Zoom Rooms need to update their software (opens in new tab) by May 30, Zoom said in a blog posting May 26.
The update to Zoom 5.0 will provide “greater security and privacy host controls,” Zoom said, but also “meet the minimum requirements of version 5.0 or greater for GCM encryption, which will be enabled and required for all meetings on May 30.”
More information about updating Zoom Rooms is here (opens in new tab). The 5.0 updates for Zoom client software were pushed out to Windows, Mac, Android, iOS, Chrome OS, Amazon Fire and Linux users at the end of April.
May 21, 2020: Corrupted Zoom installers
Two more instances of corrupted Zoom installers were found by Trend Micro researchers.
The first opens up a backdoor on a PC; the second spies on the PC’s owner with screenshots, keylogging and webcam hijacking and drafts the PC into the Devil Shadow botnet.
Both installers do install the Zoom software client, so victims may be none the wiser. As always, get your Zoom software straight from the Zoom website at Zoom.us, or join a Zoom meeting straight from your web browser.
May 18, 2020: Outages after a backend update
Zoom suffered an unexplained outage Sunday, May 17, rendering it unavailable to thousands of users in the U.S. and U.K. The outage, which began Sunday morning U.K. time, lasted several hours and affected online church services in both countries. Even the British government’s daily coronavirus briefing (opens in new tab) was affected, knocking out the ability of journalists to ask questions over Zoom.
Some users reported on Twitter that logging out of Zoom accounts, then logging back in, seemed to solve the issue.
Zoom’s status page noted that a backend update had taken place earlier Sunday morning, but there didn’t seem to be any linkage between that update and the outage that began a few hours later.
The Zoom status page (opens in new tab) said at the time that the outages “appear to be limited to a subset of users” and that Zoom was “working to identify the root cause and scope of this issue.” A few hours later, the problem was declared “resolved” without further details.
May 12, 2020: Domain impersonation
Cybercriminals may have registered hundreds of new Zoom-related website addresses in the past few weeks, according to researchers at Israeli security firm Check Point (opens in new tab).
Many of these sites are being used in phishing attacks to grab victims’ Zoom usernames and passwords, and similar scams are leveraging rival video-conferencing platforms such as Google Meet and Microsoft Teams.
Over the weekend, online vandals hijacked the graduation ceremony at Oklahoma City University (opens in new tab), replacing the Zoom video feed with racist language and symbols. It wasn’t immediately clear whether this was a result of regular Zoom-bombing or if the attackers used less well-known methods to disrupt the video feed.
May 8, 2020: Zoom bans free users from tech-support calls
Zoom announced May 7 (opens in new tab) that due to its technical-support staff being overwhelmed with calls, it would be able to give personal technical assistance only to “owners and administrators” of paid accounts.
In other words, any user, owner or administrator of a free Zoom account, and end users of paid accounts, won’t be entitled to human help. Instead, they’ll have to rely on the FAQs and how-to’s list on the Zoom online resources (opens in new tab) page.
For now, this provision applies only to May and June 2020. If the coronavirus lockdown last longer than that, Zoom may have to hire more tech-support staffers.
May 7, 2020: Zoom promises to beef up security in agreement with N.Y. attorney general
New York State Attorney General Letitia James’ office reached an agreement with Zoom (opens in new tab) May 7 following an investigation into Zoom’s security and privacy practices.
There isn’t a lot of new stuff in the agreement. Most of the NYAG’s complaints with Zoom involved issues discussed in this story you’re reading. Most of the stipulations Zoom agreed to are things the company is already doing, including making passwords mandatory and using better encryption.
In the long term, Zoom has to conduct regular code reviews and conduct yearly penetration-testing exercises, in which paid hackers try to break through the company’s defenses.
Only two new things will directly affect consumers. Zoom has to beef up password security by preventing automated password-stuffing attacks (such as by adding CAPTCHAs to login pages) and must automatically reset compromised passwords.
It also has to update its Acceptable Use policies to ban “abusive conduct include hatred against others based on race, religion, ethnicity, national origin, gender, or sexual orientation.”
Frankly, these are longstanding standard policies at many other online companies, so we’re a little surprised that they weren’t already Zoom policies.
May 7, 2020: Zoom buys encryption startup
Zoom is buying the small New York City startup Keybase in a bid to quickly implement true end-to-end encryption for Zoom meetings, Zoom CEO Eric S. Yuan announced (opens in new tab). The purchase price or other terms of the deal were not disclosed.
Keybase makes user-friendly software to easily and securely encrypt messaging and social media posts.
In March, Zoom had to admit that its touted “end-to-end” encryption was not the real thing because Zoom’s own servers are always able to access the contents of meetings. Once Keybase’s technology is incorporated, that will no longer always be the case.
May 6, 2020: Meeting passwords and waiting rooms enabled by default
Meeting passwords and waiting rooms will be required by default for all Zoom meetings, free or paid, beginning May 9, Zoom announced. Only hosts will be able to share their screens by default, but like the other settings, that can be changed.
May 5: Zoom CEO Yuan addresses security, nationality issues
In a company blog post (opens in new tab), Zoom CEO Eric S. Yuan said the massive increase in Zoom usage since the beginning of the coronavirus lockdown had been “challenging,” but also provided “opportunities for us to drive meaningful change and improvement.”
Yuan admitted that “we failed to set pre-configured security features for our new customers, especially for schools,” referring to meeting passwords and waiting rooms. “Instead, we assumed they would understand our platform like our business customers understand our platform and customize these features themselves.”
That resulted in “uninvited, offensive, and sometimes even truly evil people disrupting meetings,” Yuan wrote. (Such a person disrupted a Zoom meeting on sexual violence (opens in new tab) in the Bay Area last week.)
Yuan also addressed rumors about his own, and Zoom’s, ties to China. He said he had lived in the U.S. since 1997 and had become a U.S. citizen in 2007, and that Zoom is a fully American company.
“Similar to many multinational technology companies, Zoom has operations and employees in China. … operated by subsidiaries of the U.S. parent company,” Yuan wrote. “Our operations in China are materially similar to our U.S. peers who also operate and have employees there.”
“We have 1 (one) co-located data center in China [that is] run by a leading Australian company and is geofenced,” Yuan added. “It exists primarily to satisfy our Fortune 500 customers that have operations or customers in China and want to use our platform to connect with them.”
May 4, 2020: Eavesdropping on Zoom meetings
A reporter for London’s Financial Times resigned after he was caught crashing internal Zoom meetings at rival London newspapers.
Mark Di Stefano announced his resignation on Twitter (opens in new tab) after The Independent (opens in new tab) documented how Di Stefano had last week joined an Independent staff meeting regarding pay cuts and furloughs, first under his own name, then anonymously.
Shortly thereafter, the Financial Times ran a story by Di Stefano about The Independent making cutbacks. Di Stefano cited his sources as “people on the call,” The Independent said.
The Independent also found that Di Stefano’s cellphone had earlier been used to access a Zoom meeting at the Evening Standard, another London newspaper. That meeting was followed by a Financial Times piece about Evening Standard furloughs and pay cuts.
May 1, 2020: Security flaws in other videoconferencing software
Zoom isn’t the only video-conferencing platform to have questionable privacy policies, Consumer Reports (opens in new tab) said in a blog post: Cisco Webex, Microsoft’s Teams and Skype, and Google’s Duo, Meet and Hangouts do too.
“All three companies can collect data while you’re in a videoconference, combine it with information from data brokers and other sources to build consumer profiles, and potentially tap into the videos for purposes like training facial recognition systems,” Consumer Reports said.
Consumer Reports said you should know that everything in a video meeting may be recorded, either by the host or another participant.
It also recommended dialing into video-conference meetings over the phone, not creating accounts with the services if possible, and using “burner” email addresses otherwise.
April 30, 2020: Zoom caught fibbing again
Zoom stock shares dipped nearly 9% Thursday (opens in new tab), April 30, the day the company joined the NASDAQ 100 stock index.
After prodding from reporters at The Verge (opens in new tab), Zoom admitted that it did not in fact have a recent peak of 300 million daily users, as stated in a blog post last week.
Rather, Zoom had a peak of 300 million daily “participants.” If you attend more than one Zoom meeting per day, then you’re counted as a separate “participant” each time.
“We unintentionally referred to these participants as ‘users’ and ‘people,'” Zoom said in a statement to The Verge. “This was a genuine oversight on our part.”
So how many daily users does Zoom now have? The company hasn’t said.
April 30, 2020: More malware-embedded Zoom installers
Researchers at Trend Micro spotted another Zoom installer file that had been corrupted with malware.
In this case, it’s spyware that can turn on the webcam, take screenshots and log keystrkes, as well as collecting diagnostic data about the system it’s running on. It also installs a fully working version of the Zoom desktop client.
“Since the system downloaded a legitimate Zoom application version (4.6), it won’t make the users suspicious,” the Trend Micro team noted in a blog post. “However, the system has already been compromised at this point.”
You don’t need to install any software on your desktop to run Zoom. But if you must, then get that software only from the official website at https://zoom.us/download (opens in new tab).
April 29, 2020: Zoom a target for foreign hackers
Zoom is a prime target for foreign spies, especially Chinese intelligence operatives, the Department of Homeland Security has warned U.S. government agencies and law-enforcement agencies, according to ABC News (opens in new tab).
“Zoom’s sudden immense growth and use across both public and private sector entities in combination with its highly publicized cybersecurity issues creates a vulnerable, target-rich environment,” the DHS intelligence analysis purportedly says. “Any organization currently using — or considering using — Zoom should evaluate the risk of its use.”
Foreign spies would be interested in any internet-based communications medium that saw such a steep increase in growth. But the DHS report singled out China as a likely meddler in Zoom security because Zoom has a substantial number of staffers in that country.
“China’s access to Zoom servers makes Beijing uniquely positioned to target U.S. public and private sector users,” ABC News quoted the DHS report as stating.
However, Zoom in the past week has given paid meeting hosts the option of avoiding Zoom servers in specific regions, including China and North America. Unpaid Zoom hosts will by default use only servers in their home regions.
A Zoom spokesperson told ABC News that the DHS report was “heavily misinformed” and included “blatant inaccuracies.”
April 28, 2020: Zoom safer to use than Apple’s FaceTime?
A new report from Mozilla, the non-profit maker of the Firefox web browser, says that Zoom’s privacy and security policies and practices are better than those of Apple FaceTime.
Zoom scores 5/5 on encryption, password strength, updates, bug reporting and privacy, the report says, matching Skype, Signal, Bluejeans and Google’s trio of Duo, Hangouts and Meet.
FaceTime got only 4.5/5 because the Apple video-call service doesn’t require the user to log into the app independently.
April 28, 2020: Zoom phishing scam preys on work-from-home fears
A new Zoom phishing scam is sure to get the attention of anyone working from home during the coronavirus lockdown.
It seems to come from your employer’s HR department, and invites you to join a Zoom meeting starting in a few minutes to discuss possible termination of your employment.
If you click on the link in the email to join the meeting, you’re taken to a very real-looking Zoom login page. It’s fake. If you enter your credentials, then the crooks can take over your Zoom account.
April 27, 2020: Zoom 5.0 has been released
Zoom has finally updated its meeting-client software to version 5.0, announced last week. Here’s our guide on how to update to Zoom 5.0.
The update is not yet available for iOS, as Apple has to vet the software before the new version of the app can be pushed out. We also couldn’t see in the Google Play app store as of Monday afternoon Eastern time (April 27), but odds are it will appear soon.
April 24, 2020: Zoom announces it will join the NASDAQ 100 Index
Zoom company stock rose again Friday (opens in new tab) after the NASDAQ stock exchange announced that Zoom would join the NASDAQ 100 index (opens in new tab) Thursday, April 30.
No other company may have benefited more from the stay-at-home orders during the coronavirus crisis. It’s hard to imagine that Zoom would be joining the NASDAQ 100 if its daily traffic had not soared from 10 million users in December 2019 to 300 million in mid-April.
April 23, 2020: Zoom’s stock surges
Despite all the bad news about Zoom, the company’s stock price surged (opens in new tab) on Thursday, gaining 9% after the announcement that the number of daily users had risen to 300 million (opens in new tab).
To put that in perspective, daily usage peaked at 200 million people per day in March, the company said on April 1 (opens in new tab). In December 2019, Zoom usage peaked at 10 million daily users.
April 22, 2020: Zoom 5.0 announced
In a somewhat misleading press announcement/blog post (opens in new tab), Zoom trumpeted the arrival of version 5.0 of its desktop software for Windows, Mac and Linux.
The new version will include many of the security fixes we’ve recently seen for the Zoom web interface, including the abilities to kick out Zoom bombers from meetings, make sure meeting data doesn’t go through China, and put everyone waiting for a meeting in a “waiting room.” It also adds a security icon to the host screen and better encryption to Zoom meetings.
We checked the Zoom changelogs (opens in new tab) and discovered that the update won’t be available until Sunday, April 26.
April 22, 2020: Information scraping with fake Zoom client software
Cisco Talos researchers said Zoom’s meeting chat function made it too easy for outsiders to find all Zoom users in an particular organization.
If you had a valid Zoom account, Cisco Talos explained in a blog post (opens in new tab), you could pretend that you worked at any organization and get the full names and chat IDs of every registered Zoom user whose email address used that organization’s email domain.
You would not have to verify that you worked there, and you wouldn’t even need to be in a Zoom meeting to get the information.
That information “could be leveraged to disclose further contact information including the user’s email address, phone number and any other information that is present in their vCard,” or digital business card, Cisco Talos wrote.
“This vulnerability could be exploited by a spear-phishing attack against known individuals with an organization in order to dump the email addresses of all the Zoom users within the organization,” the Cisco Talos post said. “Users who have recently had to install new software in order to set-up remote working may be particularly susceptible to socially-engineered emails that purport to instruct users to install a new or updated trojan horse ‘Zoom client’.”
Fortunately, Zoom has fixed this issue, which lay entirely on the server side.
STATUS: Fixed.
April 21, 2020: New updates
In a blog post (opens in new tab) April 20, Zoom said the option of excluding certain countries from call routing was now live. This will let Zoom meeting administrators avoid having meeting data routed through Zoom servers in China, the U.S., or seven other regions and countries.
New updates to the Zoom platform (opens in new tab) for the web interface rolled out April 19 include masking some participant personal information, such as email addresses or phone numbers, during meetings. Another change is that users who share the same email domain will no longer be able to search for each other by name.
April 20, 2020: Dropbox created its own bug bounty program for Zoom
The New York Times (opens in new tab) reported that Dropbox executives were so concerned about security flaws in Zoom that in 2018 Dropbox created its own secret bug-bounty program for Zoom flaws.
In other words, Dropbox would pay hackers for security vulnerabilities they found in Zoom. (Dropbox staffers used Zoom regularly, and Dropbox was an investor in Zoom.) The Times reported that Dropbox would confirm the flaws, then pass them along to Zoom so that Zoom could fix them.
April 17, 2020: Finding Zoom meeting recordings online is easy (part 2)
Zoom-meeting video recordings saved on Zoom’s cloud servers can be easily discovered and often viewed, a security researcher told Cnet (opens in new tab).
Phil Guimond (opens in new tab) noticed that online recordings of Zoom meetings have a predictable URL structure and are thus easy to find. (The Washington Post reported last week on a similar issue with Zoom recordings that had been uploaded by users to third-party cloud servers. In those cases, the file names of meeting recordings followed a predictable pattern.)
Until Zoom pushed out a series of updates (opens in new tab) this past Tuesday, Zoom meeting recordings were not required to be password-protected.
Guimond built a simple tool that automatically searches for Zoom meeting recordings and tries to open them.
If a meeting has a password, his tool tries to brute-force access by running through millions of possible passwords. If a meeting recording is viewable, so is the Zoom meeting ID, and the attacker might be able to access future recurring meetings.
To defeat Guimond’s automated tool, Zoom added a Captcha challenge, which forces the would-be meeting-recording watcher to prove they’re a human. But, Guimond said, the URL pattern is still the same, and attackers could still try to open each generated result manually.
STATUS: Mitigated with additional obstacles against attack, but not really fixed.
April 16, 2020: Zoom revamps its bug bounty program
Zoom announced it was hiring Luta Security (opens in new tab), a consulting firm headed by Katie Moussouris, to revamp Zoom’s “bug bounty” program, which pays hackers to find software flaws.
Moussouris set up the first bug-bounty programs at Microsoft and the Pentagon. In her own blog post (opens in new tab), she announced that Zoom was bringing in other well-regarded information-security firms and researchers to improve its security.
In its weekly webinar, according to ZDNet (opens in new tab), Zoom also said it would also let meeting hosts report abusive users, and newly hired security consultant Alex Stamos said Zoom would be switching to a more robust encryption standard after Zoom’s existing encryption was found to be lacking.
In other news, a congressman has complained that a congressional briefing held over Zoom on April 3 was “zoom-bombed” (opens in new tab) at least three times.
April 15, 2020: Bank official warns against the dangers of remote meetings
The head of Standard Chartered, a London-based multinational bank, has warned employees to not use Zoom or Google Hangouts for remote meetings, citing security concerns, according to Reuters (opens in new tab).
Standard Chartered primarily uses the rival Blue Jeans video-conferencing platform, according to two bank staffers who spoke anonymously.
Last year, Standard Chartered agreed to pay British and American regulators $1.1 billion (opens in new tab) after admitting the bank violated trade sanctions on Iran.
April 15, 2020: Zoom zero-day exploits on sale for $500,000
Hackers are apparently offering to sell two “zero-day” exploits in Zoom to the highest bidder, Vice (opens in new tab) reports.
Zero-days are hacks that take advantage of vulnerabilities the software maker doesn’t know about, and which users have little or no defense against.
Sources who told Vice about the zero-days said one exploit is for Windows and lets a remote attacker get full control of a target’s computer. The catch is that the attacker and the target have to be on the same Zoom call. Its asking price is $500,000.
“I think it’s just kids who hope to make a bang,” one unnamed source told Vice.
The other zero-day is said to be for macOS and to be less serious.
STATUS: Apparently unfixed.
April 14, 2020: Paid users can choose their data region
Zoom announced (opens in new tab) April 13 that users of paid Zoom accounts would be able to choose through which region of the world their data would be routed: Australia, Canada, China, Europe, India, Japan/Hong Kong, Latin America or the United States.
This is a reaction to the discovery earlier in April that many Zoom meetings hosted by and involving U.S. residents had been routed through servers based in China, a country that retains the right to see anything happening on a domestically located server without a warrant.
Users of Zoom’s free service will have their data handled only by servers in their regions.
STATUS: This option is now available for paid Zoom users who use the web interface rather than the desktop software. The Zoom desktop software for Windows, Mac and Linux will be getting this April 26.
Open/unresolved issues
More than 500,000 Zoom accounts up for grabs
Usernames and passwords for more than 500,000 Zoom accounts are being sold or given away in criminal marketplaces.
These accounts were not compromised as the result of a Zoom data breach, but instead through credential stuffing. That’s when criminals try to unlock accounts by re-using credentials from accounts compromised in previous data breaches. It works only if an account holder uses the same password for more than one account.
STATUS: Unknown, but this isn’t Zoom’s fault.
2,300 sets of Zoom login credentials found online
Researchers from IngSights discovered a set of 2,300 Zoom login credentials being shared in a criminal online forum.
“Aside from personal accounts, there were many corporate accounts belonging to banks, consultancy companies, educational facilities, healthcare providers, and software vendors, amongst others,” IntSight’s Etay Maor (opens in new tab) wrote in a blog post April 10.
“While some of the accounts ‘only’ included an email and password, others included meeting IDs, names and host keys,” Maor wrote.
Maor told Threatpost (opens in new tab) it didn’t seem like the credentials came from a Zoom data breach, given their relatively small number. He theorized that they came from “small lists and databases kept by other companies/agencies.”
It’s also possible that some of the credentials were the result of “credential stuffing.” That’s the (largely) automated process by which criminals try to log into websites by cycling through likely email addresses and likely passwords, and then harvest whatever yields a positive result.
STATUS: Unknown. This likely isn’t a Zoom issue per se.
Zoom ‘zero-day’ exploits
Information-security researchers know of several Zoom “zero-day” exploits (opens in new tab), according to Vice. Zero-days are exploits for software vulnerabilities that the software maker doesn’t know about and hasn’t fixed, and hence has “zero days” to prepare before the exploits appear.
However, one Vice source implied that other video-conferencing solutions also had security flaws. Another source said that Zoom zero-days weren’t selling for much money due to lack of demand.
STATUS: Unresolved until some of these flaws come to light.
Zoom compromised accounts traded online
Criminals are trading compromised Zoom accounts on the “dark web,” Yahoo News (opens in new tab) reported.
This information apparently came from Israeli cybersecurity firm Sixgill, which specializes in monitoring underground online-criminal activity. We weren’t able to find any mention of the findings on the Sixgill website (opens in new tab).
Sixgill told Yahoo it had spotted 352 compromised Zoom accounts that included meeting IDs, email addresses, passwords and host keys. Some of the accounts belonged to schools, and one each to a small business and a large healthcare provider, but most were personal.
STATUS: Not really a bug, but definitely worth worrying about. If you have a Zoom account, make sure its password isn’t the same as the password for any other account you have.
Zoom installer bundled with malware
Researchers at Trend Micro (opens in new tab) discovered a version of the Zoom installer that has been bundled with cryptocurrency-mining malware, i.e. a coin-miner.
The Zoom installer will put Zoom version 4.4.0.0 on your Windows PC, but it comes with a coin-miner that Trend Micro has given the catchy name Trojan.Win32.MOOZ.THCCABO. (By the way, the latest Zoom client software for Windows is up to version 4.6.9, and you should get it only from here (opens in new tab).)
The coin-miner will ramp up your PC’s central processor unit, and its graphics card if there is one, to solve mathematical problems in order to generate new units of cryptocurrency. You’ll notice this if you fans suddenly speed up or if Windows Task Manager (hit Ctrl + Shift + Esc) shows unexpectedly heavy CPU/GPU use.
To avoid getting hit with this malware, make sure you’re running one of the best antivirus programs, and don’t click on any links in emails, social media posts or pop-up messages that promise to install Zoom on your machine.
STATUS: Open, but this isn’t Zoom’s problem to fix. It can’t stop other people from copying and redistributing its installation software.
Zoom encryption not what it claims to be
Not only does Zoom mislead users about its “end-to-end encryption” (see further down), but its seems to be flat-out, um, not telling the truth about the quality of its encryption algorithm.
Zoom says it use AES-256 encryption to encode video and audio data traveling between Zoom servers and Zoom clients (i.e., you and me). But researchers at the Citizen Lab (opens in new tab) at the University of Toronto, in a report posted April 3, found that Zoom actually uses the somewhat weaker AES-128 algorithm.
Even worse, Zoom uses an in-house implementation of encryption algorithm that preserves patterns from the original file. It’s as if someone drew a red circle on a gray wall, and then a censor painted over the red circle with a while circle. You’re not seeing the original message, but the shape is still there.
“We discourage the use of Zoom at this time for use cases that require strong privacy and confidentiality,” the Citizen Lab report says, such as “governments worried about espionage, businesses concerned about cybercrime and industrial espionage, healthcare providers handling sensitive patient information” and “activists, lawyers, and journalists working on sensitive topics.”
STATUS: Unresolved. In a blog post April 3, Zoom CEO Eric S. Yuan (opens in new tab) acknowledged the encryption issue but said only that “we recognize that we can do better with our encryption design” and “we expect to have more to share on this front in the coming days.”
In Zoom’s announcement of the upcoming April 26 desktop-software update, Zoom said it would be upgrading the encryption implementation (opens in new tab) to a better format for all users by May 30.
Zoom software can be easily corrupted
Good software has built-in anti-tampering mechanisms to make sure that applications don’t run code that’s been altered by a third party.
Zoom has such anti-tampering mechanisms in place, which is good. But those anti-tampering mechanisms themselves are not protected from tampering, said a British computer student who calls himself “Lloyd (opens in new tab)” in a blog post April 3.
Needless to say, that’s bad. Lloyd showed how Zoom’s anti-tampering mechanism can easily be disabled, or even replaced with a malicious version that hijacks the application.
If you’re reading this with a working knowledge of how Windows software works, this is a pretty damning passage: “This DLL can be trivially unloaded, rendering the anti-tampering mechanism null and void. The DLL is not pinned, meaning an attacker from a 3rd party process could simply inject a remote thread.”
In other words, malware already present on a computer could use Zoom’s own anti-tampering mechanism to tamper with Zoom. Criminals could also create fully working versions of Zoom that have been altered to perform malicious acts.
STATUS: Unresolved.
Zoom bombing
Anyone can “bomb” a public Zoom meeting if they know the meeting number, and then use the file-share photo to post shocking images, or make annoying sounds in the audio. The FBI even warned about it (opens in new tab) a few days ago.
The host of the Zoom meeting can mute or even kick out troublemakers, but they can come right back with new user IDs. The best way to avoid Zoom bombing is to not share Zoom meeting numbers with anyone but the intended participants. You can also require participants to use a password to log into the meeting.
On April 3, the U.S. Attorney’s Office for the Eastern District of Michigan said that “anyone who hacks into a teleconference can be charged with state or federal crimes.” It’s not clear whether that applies only to eastern Michigan.
STATUS: There are easy ways to avoid Zoom bombing, which we go through here.
Leaks of email addresses and profile photos
Zoom automatically puts everyone sharing the same email domain into a “company” folder where they can see each other’s information.
Exceptions are made for people using large webmail clients such as Gmail, Yahoo, Hotmail or Outlook.com, but not apparently for smaller webmail providers that Zoom might not know about.
Several Dutch Zoom users who use ISP-provided email addresses suddenly found that they were in the same “company” with dozens of strangers — and could see their email addresses, user names and user photos.
STATUS: Unresolved, but an April 19 Zoom software update (opens in new tab) for Zoom web-interface users makes sure users on the same email domain can no longer automatically search for each other by name. The Zoom desktop client software will get similar fixes April 26.
Sharing of personal data with advertisers
Several privacy experts, some working for Consumer Reports, pored over Zoom’s privacy policy and found that it apparently gave Zoom the right to use Zoom users’ personal data and to share it with third-party marketers.
Following a Consumer Reports (opens in new tab) blog post, Zoom quickly rewrote its privacy policy, stripping out the most disturbing passages and asserting that “we do not sell your personal data.”
STATUS: Unknown. We don’t know the details of Zoom’s business dealings with third-party advertisers.
You can ‘war drive’ to find open Zoom meetings
You can find open Zoom meetings (opens in new tab) by rapidly cycling through possible Zoom meeting IDs, a security researcher told independent security blogger Brian Krebs.
The researcher got past Zoom’s meeting-scan blocker by running queries through Tor, which randomized his IP address. It’s a variation on “war driving” by randomly dialing telephone numbers to find open modems in the dial-up days.
The researcher told Krebs that he could find about 100 open Zoom meetings every hour with the tool, and that “having a password enabled on the [Zoom] meeting is the only thing that defeats it.”
STATUS: Unknown.
Zoom meeting chats don’t stay private
Two Twitter (opens in new tab) users (opens in new tab) pointed out that if you’re in a Zoom meeting and use a private window in the meeting’s chat app to communicate privately with another person in the meeting, that conversation will be visible in the end-of-meeting transcript the host receives.
STATUS: Unknown.
Resolved/fixed issues
Zoom flaw allowed account hijacking
A Kurdish security researcher (opens in new tab) said Zoom paid him a bug bounty — a reward for finding a serious flaw — for finding how to hijack a Zoom account if the account holder’s email address was known or guessed.
The researcher, who calls himself “s3c” but whose real name may be Yusuf Abdulla, said if he tried to log into Zoom with a Facebook account, Zoom would ask for the email address associated with that Facebook account. Then Zoom would open a new webpage notifying him that a confirmation email message had been sent to that email address.
The URL of the notification webpage would have a unique identification tag in the address bar. As an example that’s much shorter than the real thing, let’s say it’s “zoom.com/signup/123456XYZ”.
When s3c received and opened the confirmation email message sent by Zoom, he clicked on the confirmation button in the body of the message. This took him to yet another webpage that confirmed his email address was now associated with a new account. So far, so good.
But then s3c noticed that the unique identification tag in the Zoom confirmation webpage’s URL was identical to the first ID tag. Let’s use the example “zoom.com/confirmation/123456XYZ”.
The matching ID tags, one used before confirmation and the other after confirmation, meant that s3c could have avoided receiving the confirmation email, and clicking on the confirmation button, altogether.
In fact, he could have entered ANY email address — yours, mine or [email protected] — into the original signup form. Then he could have copied the ID tag from the resulting Zoom notification page and pasted the ID tag into an already existing Zoom account-confirmation page.
Boom, he’d have access to any Zoom account created using the targeted email address.
“Even if you already linked your account with a Facebook account Zoom automatically unlink it and link it with the attacker Facebook account,” s3c wrote in his imperfect English.
And because Zoom lets anyone using a company email address view all other users signed up with the same email domain, e.g. “company.com”, s3c could have leveraged this method to steal ALL of a given company’s Zoom accounts.
“So if an attacker create an account with email address [email protected] and verify it with this bug,” s3c wrote, “the attacker can view all emails that created with *@companyname.com in Zoom app in Company contacts so that means the attacker can hack all accounts of the company.”
Zoom is fortunate that s3c is one of the good guys and didn’t disclose this flaw publicly before Zoom could fix it. But it’s such a simple flaw that it’s hard to imagine no one else noticed it before.
STATUS: Fixed, thank God.
Zoom removes meeting IDs from screens
Zoom has released updates for its Windows, macOS and Linux desktop client software so that meeting IDs will not display onscreen during meetings. British Prime Minister Boris Johnson accidentally displayed a Zoom meeting ID in a tweet, and the Belgian cabinet made a similar mistake.
‘Potential security vulnerability’ with Zoom file sharing
In an “ask me anything” webinar in early April, Zoom CEO Eric S. Yuan (opens in new tab) said that Zoom had discovered “a potential security vulnerability with file sharing, so we disabled that feature.”
Until this week, participants in a Zoom meeting could share files with each other using the meeting’s chat function.
STATUS: Fixed.
Zoom cryptographic keys issued by Chinese servers
Those AES128 encryption keys are issued to Zoom clients by Zoom servers, which is all well and good, except that the Citizen Lab (opens in new tab) found several Zoom servers in China issuing keys to Zoom users even when all participants in a meeting were in North America.
Since Zoom servers can decrypt Zoom meetings, and Chinese authorities can compel operators of Chinese servers to hand over data, the implication is that the Chinese government might be able to see your Zoom meetings.
That’s got to be bad news for the British government, which has held at least one Cabinet meeting over Zoom.
STATUS: Apparently fixed. In a blog post April 3, Zoom CEO Eric S. Yuan (opens in new tab) responded to the Citizen Lab report by saying that “it is possible certain meetings were allowed to connect to systems in China, where they should not have been able to connect. We have since corrected this.”
Security flaw with Zoom meeting waiting rooms
Zoom advises meeting hosts to set up “waiting rooms” to avoid “Zoom bombing.” A waiting room essentially keeps participants on hold until a host lets them in, either all at once or one at a time.
The Citizen Lab said it found a serious security issue with Zoom waiting rooms (opens in new tab), and advised hosts and participants to not use them for now. The Citizen Lab is not disclosing the details yet, but has told Zoom of the flaw.
“We advise Zoom users who desire confidentiality to not use Zoom Waiting Rooms,” the Citizen Lab said in its report. “Instead, we encourage users to use Zoom’s password feature.”
STATUS: Fixed. In a follow-up to their initial report (opens in new tab). the Citizen Lab researchers disclosed that uninvited attendees to a meeting could nonetheless get the meeting’s encryption key from the waiting room.
“On April 7, Zoom reported to us that they had implemented a server-side fix for the issue,” the researchers said.
Windows password stealing
Zoom meetings have side chats in which participants can sent text-based messages and post web links.
But according to Twitter user @_g0dmode (opens in new tab) and Anglo-American cybersecurity training firm Hacker House (opens in new tab), Zoom until the end of March made no distinction between regular web addresses and a different kind of remote networking link called a Universal Naming Convention (UNC) path. That left Zoom chats vulnerable to attack.
If a malicious Zoom bomber slipped a UNC path to a remote server that he controlled into a Zoom meeting chat, an unwitting participant could click on it.
The participant’s Windows computer would then try to reach out to the hacker’s remote server specified in the path and automatically try to log into it using the user’s Windows username and password.
The hacker could capture the password “hash” and decrypt it, giving him access to the Zoom user’s Windows account.
STATUS: Yuan’s blog post says Zoom has now fixed this problem.
Windows malware injection
Mohamed A. Baset (opens in new tab) of security firm Seekurity said on Twitter that the same filepath flaw also would let a hacker insert a UNC path to a remote executable file into a Zoom meeting chatroom.
If a Zoom user running Windows clicked on it, a video posted by Baset showed, the user’s computer would try to load and run the software. The victim would be prompted to authorize the software to run, which will stop some hacking attempts but not all.
STATUS: If the UNC filepath issue is fixed, then this should be as well.
iOS profile sharing
Until late March, Zoom sent iOS user profiles to Facebook (opens in new tab) as part of the “log in with Facebook” feature in the iPhone and iPad Zoom apps. After Vice News exposed the practice, Zoom said it hadn’t been aware of the profile-sharing and updated the iOS apps to fix this.
STATUS: Fixed.
Malware-like behavior on Macs
We learned last summer that Zoom used hacker-like methods to bypass normal macOS security precautions. We thought that problem had been fixed then, along with the security flaw it created.
But a series of tweets March 30 from security researcher Felix Seele, who noticed that Zoom installed itself on his Mac without the usual user authorizations, revealed that there was still an issue.
Ever wondered how the @zoom_us macOS installer does it’s job without you ever clicking install? Turns out they (ab)use preinstallation scripts, manually unpack the app using a bundled 7zip and install it to /Applications if the current user is in the admin group (no root needed). pic.twitter.com/qgQ1XdU11MMarch 30, 2020
“They (ab)use preinstallation scripts, manually unpack the app using a bundled 7zip and install it to /Applications if the current user is in the admin group (no root needed),” Seele wrote.
“The application is installed without the user giving his final consent and a highly misleading prompt is used to gain root privileges. The same tricks that are being used by macOS malware.” (Seele elaborated in a more user-friendly blog post here (opens in new tab).)
Zoom founder and CEO Eric S. Yuan (opens in new tab) tweeted a friendly response.
“To join a meeting from a Mac is not easy, that is why this method is used by Zoom and others,” Yuan wrote. “Your point is well taken and we will continue to improve.”
UPDATE: In a new tweet April 2, Seele said Zoom had released a new version of the Zoom client for macOS that “completely removes the questionable ‘preinstall’-technique and the faked password prompt.”
“I must say that I am impressed. That was a swift and comprehensive reaction. Good work, @zoom_us!” Seele added.
Zoom just released an update for the macOS installer which completely removes the questionable “preinstall”-technique and the faked password prompt.I must say that I am impressed. That was a swift and comprehensive reaction. Good work, @zoom_us! pic.twitter.com/vau556TyAaApril 2, 2020
STATUS: Fixed.
A backdoor for Mac malware
Other people could use Zoom’s dodgy Mac installation methods, renowned Mac hacker Patrick Wardle (opens in new tab) said in a blog post March 30.
Wardle demonstrated how a local attacker — such as a malicious human or already-installed malware — could use Zoom’s formerly magical powers of unauthorized installation to “escalate privileges” and gain total control over the machine without knowing the administrator password.
Wardle also showed that a malicious script installed into the Zoom Mac client could give any piece of malware Zoom’s webcam and microphone privileges, which do not prompt the user for authorization and could turn any Mac with Zoom installed into a potential spying device.
“This affords malware the ability to record all Zoom meetings, or simply spawn Zoom in the background to access the mic and webcam at arbitrary times,” Wardle wrote.
STATUS: Yuan’s blog post says Zoom has fixed these flaws.
Other issues
Zoom pledges to fix flaws
In a blog post April 1, Zoom CEO and founder Eric S. Yuan (opens in new tab) acknowledged Zoom’s growing pains and pledged that regular development of the Zoom platform would be put on hold while the company worked to fix security and privacy issues.
“We recognize that we have fallen short of the community’s — and our own — privacy and security expectations,” Yuan wrote, explaining that Zoom had been developed for large businesses with in-house IT staffers who could set up and run the software.
“We now have a much broader set of users who are utilizing our product in a myriad of unexpected ways, presenting us with challenges we did not anticipate when the platform was conceived,” he said. “These new, mostly consumer use cases have helped us uncover unforeseen issues with our platform. Dedicated journalists and security researchers have also helped to identify pre-existing ones.”
To deal with these issues, Yuan wrote, Zoom would be “enacting a feature freeze, effectively immediately, and shifting all our engineering resources to focus on our biggest trust, safety, and privacy issues.”
Among other things, Zoom would also be “conducting a comprehensive review with third-party experts and representative users to understand and ensure the security of all of our new consumer use cases.”
Zoom now requires passwords by default for most Zoom meetings, although meetings hosts can turn that feature off. Passwords are the easiest way to stop Zoom bombing.
And on April 8, former Facebook and Yahoo chief security officer Alex Stamos (opens in new tab) said he would be working with Zoom to improve its security and privacy. Stamos is now an adjunct professor at Stanford and is highly regarded within the information-security community.
Phony end-to-end encryption
Zoom claims its meetings use “end-to-end encryption” if every participant calls in from a computer or a Zoom mobile app instead of over the phone. But under pressure from The Intercept (opens in new tab), a Zoom representative admitted that Zoom’s definitions of “end-to-end” and “endpoint” are not the same as everyone else’s.
“When we use the phrase ‘End to End’,” a Zoom spokeperson told The Intercept, “it is in reference to the connection being encrypted from Zoom end point to Zoom end point.”
Sound good, but the spokesperson clarified that he counted a Zoom server as an endpoint.
Every other company considers an endpoint to be a user device — a desktop, laptop, smartphone or tablet — but not a server. And every other company takes “end-to-end encryption” to mean that servers that relay messages from one endpoint to another can’t decrypt the messages.
When you send an Apple Message from your iPhone to another iPhone user, Apple’s servers help the message get from one place to another, but they can’t read the content.
Not so with Zoom. It can see whatever is going on in its meetings, and sometimes it may have to in order to make sure everything works properly. Just don’t believe the implication that it can’t.
UPDATE: In a blog post April 1, Zoom Chief Product Officer Oded Gal (opens in new tab) wrote that “we want to start by apologizing for the confusion we have caused by incorrectly suggesting that Zoom meetings were capable of using end-to-end encryption. “
“We recognize that there is a discrepancy between the commonly accepted definition of end-to-end encryption and how we were using it,” he wrote.
Gal assured users that all data sent and received by Zoom client applications (but not regular phone lines, business conferencing systems or, presumably, browser interfaces) is indeed encrypted and that Zoom servers or staffers “do not decrypt it at any point before it reaches the receiving clients.”
However, Gal added, “Zoom currently maintains the key management system for these systems in the cloud” but has “implemented robust and validated internal controls to prevent unauthorized access to any content that users share during meetings.”
The implication is that Zoom doesn’t decrypt user transmissions by choice. But because it holds the encryption keys, Zoom could if it had to, such as if it were presented with a warrant or a U.S. National Security Letter (essentially a secret warrant).
For those worried about government snooping, Gal wrote that “Zoom has never built a mechanism to decrypt live meetings for lawful intercept purposes, nor do we have means to insert our employees or others into meetings without being reflected in the participant list.”
He added that companies and other enterprises would soon be able to handle their own encryption process.
“A solution will be available later this year to allow organizations to leverage Zoom’s cloud infrastructure but host the key management system within their environment.”
STATUS: This is an issue of misleading advertising rather than an actual software flaw. We hope Zoom stops using the term “end-to-end encryption” incorrectly, but just keep in mind that you won’t be getting the real thing with Zoom until it fully implements the technology it’s buying with Keybase.
Zoom meeting recordings can be found online
Privacy researcher Patrick Jackson noticed that Zoom meeting recordings saved to the host’s computer generally get a certain type of file name.
So he searched unprotected cloud servers to see if anyone had uploaded Zoom recordings and found more than 15,000 unprotected examples, according to The Washington Post (opens in new tab). Jackson also found some recorded Zoom meetings on YouTube and Vimeo.
This isn’t really Zoom’s fault. It’s up to the host to decide whether to record a meeting, and Zoom gives paying customers the option to store recordings on Zoom’s own servers. It’s also up to the host to decide to change the recording’s file name.
If you host a Zoom meeting and decide to record it, then make sure you change the default file name after you’re done.
STATUS: This is not really Zoom’s problem, to be honest.
