Zoom のセキュリティ問題: (これまでの) 問題のすべては次のとおりです

Zoom を使用していますか?あなたはおそらくそうです。新型コロナウイルスのパンデミックが続く中、自宅で仕事や学業をしなければならなかった人は、会議や授業、さらには社交の集まりにビデオ会議プラットフォームを使用しています。

Zoom が普及し、他のプラットフォームが普及しなかったのには、十分な理由があります。 ズームはセットアップが簡単、使いやすく、最大 100 人が無料で会議に参加でき、今では ライブ キャプションを生成します。動作します。

しかし、Zoom の使いやすさは、トラブルメーカーが Zoom ミーティングを開く「爆撃」を容易にしました。情報セキュリティの専門家によると、ズームのセキュリティには多くの穴があったが、そのほとんどは過去数年間で修正されてきた.

ロックダウンが始まった後、ズームは 二要素認証を追加しました セキュリティ オプションとして、アカウントの乗っ取りを防ぐ強力な武器をユーザーに提供します。 Zoom の 2FA を設定する方法はこちらです。

また、 Zoom のプライバシー ポリシーは、2020 年の初めに Zoom にユーザーの個人データを使ってやりたいことを何でもする権利を与えていたように見え、暗号化ポリシーはかなり誤解を招くものでした。

これは Zoom に対する反発を引き起こしました。パンデミックの初期。 2020 年 4 月、ニューヨーク市の公立学校は Zoom ミーティングを禁止するように動きました、および 他の学校システムも同様でしたが、ニューヨークは 1 か月後に Zoom の禁止を解除しました。

これらすべての問題により、人々は Zoom の代替手段を探しています。://www.tomsguide.com/news/skype-vs-zoom”>Skype 対 Zoom の対決で、古いビデオ アプリがビデオ会議にどのように適応しているかを確認します。 ズームと Google ハングアウトも比較しました。

ほとんどの場合、ズームは依然として安全に使用できます

ズームは安全に使用できませんか?いいえ。州や企業の秘密について話し合ったり、患者に個人の健康情報を開示したりしない限り、Zoom は問題ありません。

学校のクラス、仕事後の集まり、または日常業務に固執する職場のミーティングでさえ、ズームを使用することに大きなリスクはありません。 ズームでSnapchatフィルターを使用できるため、子供たちはおそらくそれに群がり続けるでしょう.

Zoom セキュリティのヒント

Zoom を使用するのではなく、Web ブラウザから Zoom ミーティングに参加するデスクトップ ソフトウェア。 Web ブラウザ バージョンは、セキュリティ強化が迅速に行われます。

「Web バージョンはブラウザのサンドボックスにあり、インストールされたアプリが持つ権限を持たないため、潜在的に引き起こされる可能性のある害の量が制限されます」情報セキュリティ会社 Kaspersky.

ミーティングに参加するためのリンクをクリックすると、ブラウザは新しいタブを開き、Zoom デスクトップを使用またはインストールするように求めます。ソフトウェア。ただし、細かいところに「ブラウザから参加する」リンクがあります。代わりにクリックしてください。

Zoom ミーティングを主催している場合は、ミーティング参加者にパスワードを使ってサインインするように依頼してください。これにより、Zoom ボム攻撃の可能性がはるかに低くなります。

Zoom アカウントの 2 要素認証を設定します。もう一度、方法はこちらです.

Zoom は巨大な「攻撃対象領域」を作成し、ハッカーは可能な限りあらゆる方法で攻撃しようとします。彼らはすでに Zoom 関連の偽のドメインを多数登録しており、Zoom をテーマにしたマルウェアを開発しています。 p>

良い点は、Zoom の多くの欠陥が見つかってすぐに修正されれば、Zoom はその点でより優れた (安全な) ものになるということです。

「ズームはまもなく、最も安全な会議ツールになるでしょう」と、2020 年 4 月に技術ジャーナリストのキム ゼッターが Twitter に書きました。”

最近のZoomの不具合

私たち自身 (およびあなた) の正気を保つために、最新の Zoom の問題をトップに上げ、古い問題を未解決の問題、修正済みの問題、および

6 月 4 日: 新しい Zoom プライバシー ポリシー

Zoom は「より簡単に、より明確な」プライバシー ポリシーは、COVID-19 のパンデミックの間、オンライン会議サービスが「主に企業向けの製品から、個人にも広く使用される製品に移行した」という事実を反映しています。

更新されたプライバシー ポリシーには、Zoom ミーティング コンテンツを「表示、保存、共有」できるユーザー、および Zoom がユーザーのデバイスから収集するデータの種類に関する詳細が含まれています。

完全に更新されたズームを読むことができます。プライバシーに関する「声明」はこちら。

5 月 1 日: Zoom はプライバシー通知を導入します

ブログ投稿で、Zoom は プライバシー通知を最新バージョンのデスクトップ クライアント ソフトウェアに送信します。

「ユーザーは、Zoom でホストされている会議や体験に参加するときに、誰がコンテンツや情報を表示、保存、共有できるかを理解しやすくするように設計された新しい製品内通知を表示します」と投稿は述べています。

通知は、ミーティング中のチャット ウィンドウに「あなたのメッセージを誰が見ることができますか?」というラベルの付いたボタンとして表示されます。その上でマウスをクリックすると、通知バブルに答えがポップアップ表示されます。

「ユーザーは、他の会議機能を使用すると、同様の情報を見つけることができます」とブログ投稿は述べています。「文字起こし、投票、Q&A など」。

今後の更新には、会議の主催者または参加者が会議中に Zoom の文字起こしアプリまたはスケジュール アプリを使用したときの通知が含まれることが追加されました。

4 月 8 日木曜日: Zoom の欠陥により、ハッカーは PC と Mac を乗っ取ることができます

2 人の研究者が Pwn2Own コンテストで Zoom デスクトップ アプリケーションのこれまで知られていなかった脆弱性を少なくとも 1 つ利用して、Windows PC と Mac をリモートで乗っ取る。

幸いなことに、このエクスプロイトの仕組みを完全に理解しているのは、2 人の研究者と、修正に取り組んでいる Zoom 自身だけです。この攻撃が「実際に」使用される可能性は低いですが、心配な場合は、これが修正されるまで、会議中は代わりに Zoom ブラウザ インターフェースを使用してください。

3 月 19 日金曜日: 欠陥により、他の Zoom ユーザーが見すぎてしまう

Zoom により、会議の参加者はすべてのコンピューター画面を共有できます。 、画面の一部、または同じ会議に参加している他のユーザーとの特定のアプリケーション ウィンドウだけです。

ドイツの 2 人の研究者が、短期間、画面全体が表示される可能性があります 画面を共有している Zoom ユーザーが画面の一部のみを表示することを意図している場合でも。会議を記録している参加者は、再生中にフレームをフリーズして、潜在的に機密情報を表示することができます.

Zoomは、この問題の修正に取り組んでいると述べていますが、この記事の執筆時点では、まだ欠陥が存在していました.少なくとも Windows および Linux 用の Zoom デスクトップ クライアント ソフトウェアの最新バージョン。

2 月 23 日火曜日: Zoom の Keybase 暗号化チャットが重大な欠陥を修正

2020 年 5 月に Zoom が買収した暗号化されたソーシャル メディア検証システムおよびチャット アプリである Keybase には、重大な欠陥

この欠陥は 2021 年 1 月初めに Zoom に報告され、その月の後半に欠陥を修正するキーベース ソフトウェア アップデートがリリースされました。

>

2 月 8 日月曜日: 調査によると、ズーム爆撃を止めようとしてもうまくいかないことが多い

次の場所で研究者が実施した新しい調査ボストン大学とビンガムトン大学は、パスワードを要求したり、出席者を「待合室」で煮詰めたりするなど、「Zoom 爆撃」を阻止しようとしてもうまくいかないことが多いことに気付きました。

これは、多くの攻撃が、すでに会議への参加を許可されている「内部関係者」によって実行されているためです。

「私たちの調査結果は、Zoom 爆撃の呼びかけの大部分が意図的でないことを示しています。攻撃者が会議の招待状につまずいたり、自分の会議 ID を強引に押し付けたりして作成したものではなく、これらの会議に合法的にアクセスできる内部関係者、特に高校や大学のクラスの学生によって作成されたものであると、「Zoombombingの初見.”

このようなインサイダー攻撃に対する「唯一の効果的な防御」は、「参加者ごとに固有の参加リンク」を作成することだと論文は主張している.

1 月 29 日金曜日: 市はズーム爆撃を非合法化するために取り組んでいる

市議会会議中にズーム爆弾が蔓延し、アラスカ州ジュノー市

「私たちは、この慣習を非合法化する方法を模索しています。議会レベルではほとんどなく、学級委員会レベルでもいくつかの会議があり、委員会の理事会時間の会議でもいくつかの会議がありました」と、市の弁護士ロブ・パルマーは語った、とラジオ局のウェブサイト KTOO.

アラスカの首都の警察ズーム爆撃機を追跡するのに苦労しました。市は、この慣行を違法にすることで、ズームにデジタル犯罪者を特定する情報を引き渡すよう強制できることを望んでいる.

12月21日月曜日: Zoomの幹部が中国のスパイであると非難された

爆撃の発表では、米国司法省は、ズームと中国政府の間の連絡係を最近まで務めていた元ズームの幹部ジン・シンジアン、別名ジュリアン・ジンの逮捕状を発行したと述べた.

米国は告発した.ジンは、1989 年の天安門広場での虐殺の記念日を記念して、米国を拠点とする Zoom ユーザー間の Zoom ミーティングを混乱させ、終了させ、Zoom ユーザーと Zoom ミーティングについて中国政府に情報を提供するために、彼の立場を利用した.ジンは中国に住んでいると考えられている.

ジンは、匿名の共謀者の助けを借りて、既知の中国の反体制派の名前で偽の電子メール アカウントと Zoom アカウントを作成したとされています。天安門広場での虐殺を記念した会議では、テロ組織を支援したり、暴力を扇動したり、児童ポルノを配布したりしていた」

司法省は、中国政府がジン氏から提供された情報を使用して、中国のズームユーザーに報復したと述べた.または中国に居住する中国以外のズーム ユーザーの家族。

司法省の発表と 逮捕状は無名の”会社”のみを指す-1″はジンの雇用主ですが、ブログ投稿では ズームは、それが会社であることを認めた、その後、独自の調査を行っていたことを認めた

この投稿はさらに、ジンが中国政府との合意の一環として 2019 年 10 月にズームに雇われたことを説明しました。警告なしに中国でのサービスを停止します。”

中国で Zoom を再びオンにする代償は、「法執行機関の要請に対応する社内連絡先」 (つまり、ジン) を雇い、データを転送することでした。中国のユーザーが中国のサーバーにアクセスします。 2019 年 11 月に中国で Zoom サービスが復旧し、1 年後に司法省によるジンの逮捕状が発行されました。

「調査の過程で、この元従業員が Zoom のポリシーに違反したことが判明しました。 、とりわけ、特定の内部アクセス制御を回避しようとしている」とズームは述べた. 「この個人の雇用を終了しました。」

ズームは、ジンが「限られた量の個人ユーザー データを中国当局と共有または共有した」ことを認め、「10 件未満の… 中国に拠点を置かないユーザー」も中国に提供されていました。

12 月 7 日月曜日: ズーム フィッシング詐欺

Better Business Bureau は、詐欺師が試みている Zoom ユーザーに警告していますフィッシング メールやテキスト メッセージを介してユーザー名とパスワードを盗むために、Threatpost.

メッセージは、「あなたの Zoom アカウントが停止されました」または「ミーティング」を開き、再度ログインするための役立つリンクを提供します。しかし、その餌に騙されないようにしましょう。ログインページは、実際には、あなたの Zoom ユーザーの資格情報を取得するための罠であり、詐欺師があなたの Zoom のアカウントを使用したり、盗んだりすることができます。

11 月 16 日月曜日: ズームがついにズーム爆撃を打ち破る

Zoom の最大の問題は、招待されていない参加者が Zoom ミーティングをクラッシュさせて混乱させる「Zoom ボミング」です。週末、ズームは 2 つの新機能をリリースしました これに対抗するためです。

1 つ目の「参加者のアクティビティの一時停止」では、会議の主催者が会議を一時停止し、混乱を招く参加者を追い出してから、会議を再開できます。もう 1 つの「参加者による報告」は、混乱を招いた参加者を報告する機能をミーティング参加者に拡張するもので、以前はミーティングの主催者にのみ与えられていた救済策です。

11 月 10 日火曜日: FTC は Zoom がセキュリティについて嘘をついたと言った

連邦取引委員会は、Zoom は、自身のセキュリティに関して「ユーザーを誤解させ」、「欺 de de的で不公平な一連の慣行に関与」します。 FTC は、3 月に明らかになった偽のエンドツーエンドの暗号化と 2018 年と 2019 年に Zoom が許可なく Mac にインストールしたソフトウェア。

Zoom は、2 年ごとに毎年行われる内部セキュリティ レビューと外部セキュリティ レビューに同意し、脆弱性を実装する必要があります-管理プログラム。もう 1 つの条件は、Zoom は顧客に多要素認証を提供することであり、既に実装されています。

11 月 6 日金曜日: ズーム キーストローク スヌーピング

テキサスとオクラホマの研究者は、Zoom 通話中に誰かが何を入力しているかは、肩と腕を見るだけでわかります。

研究チームは、コンピューターを使用して、カメラの解像度と、被験者が袖の付いたシャツを着ているか、髪が長いかにもよりますが、最大 75% の確率でユーザーのパスワードを特定することができました。

>

YouTube 動画や Twitch などのストリーミング プラットフォームと同様、あらゆる種類のビデオ会議プラットフォームを使用できると研究者は述べています。

10 月 10 日火曜日. 27

Zoom のエンドツーエンドの暗号化機能がついに公開されましたが、iOS では Apple の承認を待たなければなりませんでした。 Zoomのエンドツーエンドの暗号化を有効にする方法についての説明があります.

10月15日水曜日

長い間Zoomのニュースがなかった後、同社はエンドツーエンドの暗号化がベータテストが間もなく利用可能になる。

ユーザーは 10 月の第 3 週に Zoom クライアント ソフトウェアの更新を待つ必要があります。ミーティングの主催者は、Zoomミーティングをエンドツーエンドで暗号化するかどうかを決定します。 Web ブラウザ インターフェースまたは電話で参加しようとするユーザーに対しては、これらの会議は (今のところ) 機能しません。

7 月 31 日金曜日

Zoom の Web インターフェイスが 2020 年 4 月に数日間停止していたことを思い出していただければ、その理由がわかります。同社は、誰でも非公開の Zoom ミーティングに参加できる非常に深刻なセキュリティ上の欠陥を修正していました。

英国のセキュリティ研究者 Tom Anthony は、今週の彼のブログで、彼がどのように成功したかを詳しく説明しています。 Zoom がプライベート ミーティングに割り当てる 6 桁の PIN を無限にランダムに推測します。人間にとっては難しいかもしれませんが、複数のスレッドを実行する適切なパワーの PC にとっては難しくありません。

Anthony は、約 30 分で Zoom ミーティングに侵入できることを発見しました。 、 ギブオアテイク。多くのミーティングが終わるのはずっと先のことです.

この欠陥は現在修正されているので、ズーム爆撃の特定の手段について心配する必要はありません.

ステータス: 修正済み。

7 月 10 日金曜日

匿名のセキュリティ研究者が Windows 用 Zoom ミーティング クライアント ソフトウェアの重大な欠陥により、ハッカーが Windows 7 以前を実行している PC をリモートから乗っ取ることができます。 Zoom は、欠陥が公に知られるとすぐに、ソフトウェア アップデートで欠陥を修正しました。

ステータス: 修正されました。

6月17日水曜日: 批評家に洞窟をズームし、全員にエンドツーエンドの暗号化を提供します

プライバシー擁護派からの継続的な批判を受けて撤退し、ズームは6 月 17 日のブログ投稿エンドツーエンド暗号化 (E2E) は、もはや有料ユーザーだけのものではありません。学校、社交、仕事のために Zoom を無料で使用している何百万人もの人々も、エンドツーエンドの暗号化を受けることになります。

「私たちは、すべてのユーザーのプライバシーと私たちのプラットフォーム上のユーザーの安全です」とCEOのEric S. Yuanは書いています。 「これにより、当社のプラットフォームでの不正使用を防止し、これに対抗する機能を維持しながら、世界中のすべてのユーザーに高度なアドオン機能として E2EE を無料および有料で提供できるようになります。」

ただし、E2E を希望する無料ユーザーの場合は、最初にワンタイム パスワードまたは同様のサービスを介して Zoom に対して身元を確認する必要があります。これにより、会議の「ズームボム」が難しくなります。

E2E 暗号化はオプション機能のままであると Yuan 氏は思い出しました。これがアクティブになると、誰も電話や特定のオフィスの電話会議機器を使用して会議に参加できなくなるからです。 E2E を有効にするかどうかは、主催者との会議次第です。

6 月 12 日金曜日

米国では言論の自由をめぐって Zoom が熱くなっています。その後の検閲は、中国政府の要求に屈し、ホストしていた3人の中国人反体制派のアカウントを一時的に停止した。天安門広場大虐殺の 6 月 4 日を記念した公開会議。

同社は 6 月 11 日のブログ投稿で、会議を完全にシャットダウンすることなく、特定の場所 (つまり中国) からの会議参加者をブロックする方法を開発すると述べました。

これでは、中国生まれのズームCEOであるエリック・S・ユアンに、彼の会社が北京とどれほど居心地が良いかを知りたいと要求する手紙を書いた、両党の12人以上の米国下院議員と上院議員を満足させるには十分ではありませんでした。

6 月 4 日木曜日: Cisco Talos が 2 つの重大な Zoom の欠陥を明らかに

Talos は、シスコが所有する情報セキュリティ調査会社で、6 月 3 日に次のことが判明したことを明らかにしました。 Zoom クライアント アプリケーションには 2 つの重大な欠陥があり、どちらもパッチが適用されています。

最初の欠陥は、攻撃者が特別に作成されたアニメーション GIF を Zoom ミーティング チャットに使用して、他の人のマシン上の Zoom クライアント ソフトウェアをハッキングし、マルウェアを強制的にインストールすることを可能にします。

2番目の欠陥も、Zoomミーティングクライアントソフトウェアのチャット機能に関係しており、同様に深刻な結果をもたらす可能性があります。問題は、Zoom が.zip ファイルなどの共有圧縮ファイルの内容を検証しなかったことです。

攻撃者は、Zoom ミーティング チャットを介してユーザーに圧縮ファイルの形式でマルウェアを送信し、ユーザーの Zoom クライアントはそのマルウェアを Zoom アプリケーションのディレクトリに保存して開いた可能性があります。

さらに悪いことに、ユーザーが Zoom 圧縮ファイルを PC の他の場所 (デスクトップなど) に保存した場合、攻撃者は最初のファイルの変更されたバージョンを同じ名前で送信する可能性があります。

Zoom は (最初のバージョンではなく) 2 番目のバージョンを自動的に開き、マルウェアが「ほぼ任意のパスにバイナリを植え付け、… 重要なファイルを上書きして、任意のコードを実行する可能性がある」ことを許可します。 p>

ステータス: 修正済み。

6月1日月曜日

ズームの今後のエンドツーエンドの暗号化は、ズーム自体が5月に述べたように、主に有料ユーザー向けです7. しかし、セキュリティ問題について Zoom に相談している有名な情報セキュリティの専門家である Alex Stamos は、Reuters 先週、学校やその他の非営利団体企業は、アカウントのエンド ツー エンドの暗号化も利用できる場合があります。

「CEOはさまざまな議論を検討している」とスタモス氏はロイターに語った。 「現在のプランは、有料の顧客に加えて、会社が誰であるかを知っている企業アカウントです。」

5月27日水曜日

Zoomのすべての管理者ルームには ソフトウェアを更新する

Zoom 5.0 へのアップデートにより、「セキュリティとプライバシーのホスト制御が強化される」だけでなく、「バージョン 5.0 または5 月 30 日のすべての会議で有効になり、必須となる GCM 暗号化の方が優れています。”

Zoom Rooms の更新について詳しくは、こちら。 Zoom クライアント ソフトウェアの 5.0 アップデートは、4 月末に Windows、Mac、Android、iOS、Chrome OS、Amazon Fire、および Linux ユーザーにプッシュされました。

5月21日木曜日

破損した Zoom インストーラーは、トレンドマイクロの研究者によって発見されました。

最初は PC でバックドアを開きます。 2 番目のスパイは PC の所有者をスクリーンショット、キーロギング、ウェブカメラの乗っ取りでスパイし、PC を Devil Shadow ボットネットに送り込みます。

どちらのインストーラーも Zoom ソフトウェア クライアントをインストールするため、被害者の方が賢明ではない可能性があります。いつものように、Zoom ソフトウェアを Zoom.us の Zoom Web サイトから直接入手するか、Web ブラウザから直接 Zoom ミーティングに参加してください。

5 月 18 日月曜日

h2>

Zoom は、原因不明の停止に見舞われました。 a> 5 月 17 日日曜日、米国と英国の何千ものユーザーが利用できなくなりました 英国時間の日曜日の朝に始まった停止は数時間続き、両国のオンライン教会サービスに影響を与えました。イギリス政府の 毎日のコロナウイルスブリーフィング が影響を受け、ジャーナリストが Zoom を介して質問する能力が失われました。

一部のユーザーは、Zoom アカウントからログアウトしてから再度ログインすると、問題が解決したように見えると Twitter で報告しました。

Zoom のステータス ページには、日曜日の朝早くにバックエンドの更新が行われたことが記載されていましたが、その更新と数時間後に始まった停止との間に何の関連性もないようでした。

The Zoom status page said at the time that the outages”appear to be limited to a subset of users”and that Zoom was”working to identify the root cause and scope of this issue.”A few hours later, the problem was declared”resolved”without further details.

Tuesday, May 12

Cybercriminals may have registered hundreds of new Zoom-related website addresses in the past few weeks, according to researchers at Israeli security firm Check Point.

Many of these sites are being used in phishing attacks to grab victims’Zoom usernames and passwords, and similar scams are leveraging rival video-conferencing platforms such as Google Meet and Microsoft Teams.

Over the weekend, online vandals hijacked the graduation ceremony at Oklahoma City University, replacing the Zoom video feed with racist language and symbols. It wasn’t immediately clear whether this was a result of regular Zoom-bombing or if the attackers used less well-known methods to disrupt the video feed.

Friday, May 8

Zoom bans free users from tech-support calls

Zoom announced May 7 that due to its technical-support staff being overwhelmed with calls, it would be able to give personal technical assistance only to”owners and administrators”of paid accounts.

In other words, any user, owner or administrator of a free Zoom account, and end users of paid accounts, won’t be entitled to human help. Instead, they’ll have to rely on the FAQs and how-to’s list on the Zoom online resources page.

For now, this provision applies only to May and June 2020. If the coronavirus lockdown last longer than that, Zoom may have to hire more tech-support staffers.

Zoom promises to beef up security in agreement with N.Y. attorney general

New York State Attorney General Letitia James’office reached an agreement with Zoom May 7 following an investigation into Zoom’s security and privacy practices.

There isn’t a lot of new stuff in the agreement. Most of the NYAG’s complaints with Zoom involved issues discussed in this story you’re reading. Most of the stipulations Zoom agreed to are things the company is already doing, including making passwords mandatory and using better encryption.

In the long term, Zoom has to conduct regular code reviews and conduct yearly penetration-testing exercises, in which paid hackers try to break through the company’s defenses.

Only two new things will directly affect consumers. Zoom has to beef up password security by preventing automated password-stuffing attacks (such as by adding CAPTCHAs to login pages) and must automatically reset compromised passwords.

It also has to update its Acceptable Use policies to ban”abusive conduct include hatred against others based on race, religion, ethnicity, national origin, gender, or sexual orientation.”

Frankly, these are longstanding standard policies at many other online companies, so we’re a little surprised that they weren’t already Zoom policies.

Thursday, May 7

Zoom is buying the small New York City startup Keybase in a bid to quickly implement true end-to-end encryption for Zoom meetings, Zoom CEO Eric S. Yuan announced. The purchase price or other terms of the deal were not disclosed.

Keybase makes user-friendly software to easily and securely encrypt messaging and social media posts.

In March, Zoom had to admit that its touted”end-to-end”encryption was not the real thing because Zoom’s own servers are always able to access the contents of meetings. Once Keybase’s technology is incorporated, that will no longer always be the case.

Wednesday, May 6

Meeting passwords and waiting rooms will be required by default for all Zoom meetings, free or paid, beginning May 9, Zoom announced. Only hosts will be able to share their screens by default, but like the other settings, that can be changed.

Tuesday, May 5: Zoom CEO Yuan addresses security, nationality issues

In a company blog post, Zoom CEO Eric S. Yuan said the massive increase in Zoom usage since the beginning of the coronavirus lockdown had been”challenging,”but also provided”opportunities for us to drive meaningful change and improvement.”

Yuan admitted that”we failed to set pre-configured security features for our new customers, especially for schools,”referring to meeting passwords and waiting rooms.”Instead, we assumed they would understand our platform like our business customers understand our platform and customize these features themselves.”

That resulted in”uninvited, offensive, and sometimes even truly evil people disrupting meetings,”Yuan wrote. (Such a person disrupted a Zoom meeting on sexual violence in the Bay Area last week.)

Yuan also addressed rumors about his own, and Zoom’s, ties to China. He said he had lived in the U.S. since 1997 and had become a U.S. citizen in 2007, and that Zoom is a fully American company.

“Similar to many multinational technology companies, Zoom has operations and employees in China…. operated by subsidiaries of the U.S. parent company,”Yuan wrote.”Our operations in China are materially similar to our U.S. peers who also operate and have employees there.”

“We have 1 (one) co-located data center in China [that is] run by a leading Australian company and is geofenced,”Yuan added.”It exists primarily to satisfy our Fortune 500 customers that have operations or customers in China and want to use our platform to connect with them.”

Monday, May 4

A reporter for London’s Financial Times resigned after he was caught crashing internal Zoom meetings at rival London newspapers.

Mark Di Stefano announced his resignation on Twitter after The Independent documented how Di Stefano had last week joined an Independent staff meeting regarding pay cuts and furloughs, first under his own name, then anonymously.

Shortly thereafter, the Financial Times ran a story by Di Stefano about The Independent making cutbacks. Di Stefano cited his sources as”people on the call,”The Independent said.

The Independent also found that Di Stefano’s cellphone had earlier been used to access a Zoom meeting at the Evening Standard, another London newspaper. That meeting was followed by a Financial Times piece about Evening Standard furloughs and pay cuts.

Friday, May 1

Zoom isn’t the only video-conferencing platform to have questionable privacy policies, Consumer Reports said in a blog post: Cisco Webex, Microsoft’s Teams and Skype, and Google’s Duo, Meet and Hangouts do too.

“All three companies can collect data while you’re in a videoconference, combine it with information from data brokers and other sources to build consumer profiles, and potentially tap into the videos for purposes like training facial recognition systems,”Consumer Reports said.

Consumer Reports said you should know that everything in a video meeting may be recorded, either by the host or another participant.

It also recommended dialing into video-conference meetings over the phone, not creating accounts with the services if possible, and using”burner”email addresses otherwise.

Thursday, April 30

Zoom caught fibbing again

Zoom stock shares dipped nearly 9% Thursday, April 30, the day the company joined the NASDAQ 100 stock index.

After prodding from reporters at The Verge, Zoom admitted that it did not in fact have a recent peak of 300 million daily users, as stated in a blog post last week.

Rather, Zoom had a peak of 300 million daily”participants.”If you attend more than one Zoom meeting per day, then you’re counted as a separate”participant”each time.

“We unintentionally referred to these participants as’users’and’people,'”Zoom said in a statement to The Verge.”This was a genuine oversight on our part.”

So how many daily users does Zoom now have? The company hasn’t said.

More malware-embedded Zoom installers

Researchers at Trend Micro spotted another Zoom installer file that had been corrupted with malware.

In this case, it’s spyware that can turn on the webcam, take screenshots and log keystrkes, as well as collecting diagnostic data about the system it’s running on. It also installs a fully working version of the Zoom desktop client.

“Since the system downloaded a legitimate Zoom application version (4.6), it won’t make the users suspicious,”the Trend Micro team noted in a blog post.”However, the system has already been compromised at this point.”

You don’t need to install any software on your desktop to run Zoom. But if you must, then get that software only from the official website at https://zoom.us/download.

Wednesday, April 29

Zoom a target for foreign hackers

Zoom is a prime target for foreign spies, especially Chinese intelligence operatives, the Department of Homeland Security has warned U.S. government agencies and law-enforcement agencies, according to ABC News.

“Zoom’s sudden immense growth and use across both public and private sector entities in combination with its highly publicized cybersecurity issues creates a vulnerable, target-rich environment,”the DHS intelligence analysis purportedly says.”Any organization currently using–or considering using–Zoom should evaluate the risk of its use.”

Foreign spies would be interested in any internet-based communications medium that saw such a steep increase in growth. But the DHS report singled out China as a likely meddler in Zoom security because Zoom has a substantial number of staffers in that country.

“China’s access to Zoom servers makes Beijing uniquely positioned to target U.S. public and private sector users,”ABC News quoted the DHS report as stating.

However, Zoom in the past week has given paid meeting hosts the option of avoiding Zoom servers in specific regions, including China and North America. Unpaid Zoom hosts will by default use only servers in their home regions.

A Zoom spokesperson told ABC News that the DHS report was”heavily misinformed”and included”blatant inaccuracies.”

Tuesday, April 28

Zoom safer to use than Apple’s FaceTime?

A new report from Mozilla, the non-profit maker of the Firefox web browser, says that Zoom’s privacy and security policies and practices are better than those of Apple FaceTime.

Zoom scores 5/5 on encryption, password strength, updates, bug reporting and privacy, the report says, matching Skype, Signal, Bluejeans and Google’s trio of Duo, Hangouts and Meet.

FaceTime got only 4.5/5 because the Apple video-call service doesn’t require the user to log into the app independently.

Zoom phishing scam preys on work-from-home fears

A new Zoom phishing scam is sure to get the attention of anyone working from home during the coronavirus lockdown.

It seems to come from your employer’s HR department, and invites you to join a Zoom meeting starting in a few minutes to discuss possible termination of your employment.

If you click on the link in the email to join the meeting, you’re taken to a very real-looking Zoom login page. It’s fake. If you enter your credentials, then the crooks can take over your Zoom account.

Monday, April 27

Zoom 5.0 has been released

Zoom has finally updated its meeting-client software to version 5.0, announced last week. Here’s our guide on how to update to Zoom 5.0.

The update is not yet available for iOS, as Apple has to vet the software before the new version of the app can be pushed out. We also couldn’t see in the Google Play app store as of Monday afternoon Eastern time (April 27), but odds are it will appear soon.

Friday, April 24

Zoom company stock rose again Friday after the NASDAQ stock exchange announced that Zoom would join the NASDAQ 100 index Thursday, April 30.

No other company may have benefited more from the stay-at-home orders during the coronavirus crisis. It’s hard to imagine that Zoom would be joining the NASDAQ 100 if its daily traffic had not soared from 10 million users in December 2019 to 300 million in mid-April.

Thursday, April 23

Despite all the bad news about Zoom, the company’s stock price surged on Thursday, gaining 9% after the announcement that the number of daily users had risen to 300 million.

To put that in perspective, daily usage peaked at 200 million people per day in March, the company said on April 1. In December 2019, Zoom usage peaked at 10 million daily users.

Wednesday, April 22

In a somewhat misleading press announcement/blog post, Zoom trumpeted the arrival of version 5.0 of its desktop software for Windows, Mac and Linux.

The new version will include many of the security fixes we’ve recently seen for the Zoom web interface, including the abilities to kick out Zoom bombers from meetings,  make sure meeting data doesn’t go through China, and put everyone waiting for a meeting in a”waiting room.”It also adds a security icon to the host screen and better encryption to Zoom meetings.

We checked the Zoom changelogs and discovered that the update won’t be available until Sunday, April 26. 

Information scraping with fake Zoom client software

Cisco Talos researchers said Zoom’s meeting chat function made it too easy for outsiders to find all Zoom users in an particular organization.

If you had a valid Zoom account, Cisco Talos explained in a blog post, you could pretend that you worked at any organization and get the full names and chat IDs of every registered Zoom user whose email address used that organization’s email domain.

You would not have to verify that you worked there, and you wouldn’t even need to be in a Zoom meeting to get the information.

That information”could be leveraged to disclose further contact information including the user’s email address, phone number and any other information that is present in their vCard,”or digital business card, Cisco Talos wrote.

“This vulnerability could be exploited by a spear-phishing attack against known individuals with an organization in order to dump the email addresses of all the Zoom users within the organization,”the Cisco Talos post said.”Users who have recently had to install new software in order to set-up remote working may be particularly susceptible to socially-engineered emails that purport to instruct users to install a new or updated trojan horse’Zoom client’.”

Fortunately, Zoom has fixed this issue, which lay entirely on the server side.

STATUS: Fixed.

Tuesday, April 21

In a blog post April 20, Zoom said the option of excluding certain countries from call routing was now live. This will let Zoom meeting administrators avoid having meeting data routed through Zoom servers in China, the U.S., or seven other regions and countries.

New updates to the Zoom platform for the web interface rolled out April 19 include masking some participant personal information, such as email addresses or phone numbers, during meetings. Another change is that users who share the same email domain will no longer be able to search for each other by name.

Monday, April 20

The New York Times reported that Dropbox executives were so concerned about security flaws in Zoom that in 2018 Dropbox created its own secret bug-bounty program for Zoom flaws.

In other words, Dropbox would pay hackers for security vulnerabilities they found in Zoom. (Dropbox staffers used Zoom regularly, and Dropbox was an investor in Zoom.) The Times reported that Dropbox would confirm the flaws, then pass them along to Zoom so that Zoom could fix them.

Friday, April 17

Zoom meeting recordings are easy to find online, part 2

Zoom-meeting video recordings saved on Zoom’s cloud servers can be easily discovered and often viewed, a security researcher told Cnet.

Phil Guimond noticed that online recordings of Zoom meetings have a predictable URL structure and are thus easy to find. (The Washington Post reported last week on a similar issue with Zoom recordings that had been uploaded by users to third-party cloud servers. In those cases, the file names of meeting recordings followed a predictable pattern.) 

Until Zoom pushed out a series of updates this past Tuesday, Zoom meeting recordings were not required to be password-protected.

Guimond built a simple tool that automatically searches for Zoom meeting recordings and tries to open them.

If a meeting has a password, his tool tries to brute-force access by running through millions of possible passwords. If a meeting recording is viewable, so is the Zoom meeting ID, and the attacker might be able to access future recurring meetings.

To defeat Guimond’s automated tool, Zoom added a Captcha challenge, which forces the would-be meeting-recording watcher to prove they’re a human. But, Guimond said, the URL pattern is still the same, and attackers could still try to open each generated result manually.

STATUS: Mitigated with additional obstacles against attack, but not really fixed.

Thursday, April 16

Zoom announced it was hiring Luta Security, a consulting firm headed by Katie Moussouris, to revamp Zoom’s”bug bounty”program, which pays hackers to find software flaws.

Moussouris set up the first bug-bounty programs at Microsoft and the Pentagon. In her own blog post, she announced that Zoom was bringing in other well-regarded information-security firms and researchers to improve its security.

In its weekly webinar, according to ZDNet, Zoom also said it would also let meeting hosts report abusive users, and newly hired security consultant Alex Stamos said Zoom would be switching to a more robust encryption standard after Zoom’s existing encryption was found to be lacking.

In other news, a congressman has complained that a congressional briefing held over Zoom on April 3 was”zoom-bombed” at least three times.

Wednesday, April 15

The head of Standard Chartered, a London-based multinational bank, has warned employees to nut use Zoom or Google Hangouts for remote meetings, citing security concerns, according to Reuters.

Standard Chartered primarily uses the rival Blue Jeans video-conferencing platform, according to two bank staffers who spoke anonymously.

Last year, Standard Chartered agreed to pay British and American regulators $1.1 billion after admitting the bank violated trade sanctions on Iran.

Zoom zero-day exploits on sale for $500,000

Hackers are apparently offering to sell two”zero-day”exploits in Zoom to the highest bidder, Vice reports.

Zero-days are hacks that take advantage of vulnerabilities the software maker doesn’t know about, and which users have little or no defense against.

Sources who told Vice about the zero-days said one exploit is for Windows and lets a remote attacker get full control of a target’s computer. The catch is that the attacker and the target have to be on the same Zoom call. Its asking price is $500,000.

“I think it’s just kids who hope to make a bang,”one unnamed source told Vice.

The other zero-day is said to be for macOS and to be less serious.

STATUS: Apparently unfixed.

Tuesday, April 14

Zoom announced April 13 that users of paid Zoom accounts would be able to choose through which region of the world their data would be routed: Australia, Canada, China, Europe, India, Japan/Hong Kong, Latin America or the United States.

This is a reaction to the discovery earlier in April that many Zoom meetings hosted by and involving U.S. residents had been routed through servers based in China, a country that retains the right to see anything happening on a domestically l ocated server without a warrant.

Users of Zoom’s free service will have their data handled only by servers in their regions.

STATUS: This option is now available for paid Zoom users who use the web interface rather than the desktop software. The Zoom desktop software for Windows, Mac and Linux will be getting this April 26.

Open/unresolved issues

More than 500,000 Zoom accounts up for grabs

Usernames and passwords for more than 500,000 Zoom accounts are being sold or given away in criminal marketplaces.

These accounts were not compromised as the result of a Zoom data breach, but instead through credential stuffing. That’s when criminals try to unlock accounts by re-using credentials from accounts compromised in previous data breaches. It works only if an account holder uses the same password for more than one account.

STATUS: Unknown, but this isn’t Zoom’s fault.

2,300 sets of Zoom login credentials found online

Researchers from IngSights discovered a set of 2,300 Zoom login credentials being shared in a criminal online forum.

“Aside from personal accounts, there were many corporate accounts belonging to banks, consultancy companies, educational facilities, healthcare providers, and software vendors, amongst others,”IntSight’s Etay Maor wrote in a blog post April 10. 

“While some of the accounts’only’included an email and password, others included meeting IDs, names and host keys,”Maor wrote.

Maor told Threatpost it didn’t seem like the credentials came from a Zoom data breach, given their relatively small number. He theorized that they came from”small lists and databases kept by other companies/agencies.”

It’s also possible that some of the credentials were the result of”credential stuffing.”That’s the (largely) automated process by which criminals try to log into websites by cycling through likely email addresses and likely passwords, and then harvest whatever yields a positive result.

STATUS: Unknown. This likely isn’t a Zoom issue per se.

Zoom’zero-day’exploits

Information-security researchers know of several Zoom”zero-day”exploits, according to Vice. Zero-days are exploits for software vulnerabilities that the software maker doesn’t know about and hasn’t fixed, and hence has”zero days”to prepare before the exploits appear.

However, one Vice source implied that other video-conferencing solutions also had security flaws. Another source said that Zoom zero-days weren’t selling for much money due to lack of demand.

STATUS: Unresolved until some of these flaws come to light.

Zoom compromised accounts traded online

Criminals are trading compromised Zoom accounts on the”dark web,”Yahoo News reported.

This information apparently came from Israeli cybersecurity firm Sixgill, which specializes in monitoring underground online-criminal activity. We weren’t able to find any mention of the findings on the Sixgill website.

Sixgill told Yahoo it had spotted 352 compromised Zoom accounts that included meeting IDs, email addresses, passwords and host keys. Some of the accounts belonged to schools, and one each to a small business and a large healthcare provider, but most were personal.

STATUS: Not really a bug, but definitely worth worrying about. If you have a Zoom account, make sure its password isn’t the same as the password for any other account you have.

Zoom installer bundled with malware

Researchers at Trend Micro discovered a ver sion of the Zoom installer that has been bundled with cryptocurrency-mining malware, i.e. a coin-miner.

The Zoom installer will put Zoom version 4.4.0.0 on your Windows PC, but it comes with a coin-miner that Trend Micro has given the catchy name Trojan.Win32.MOOZ.THCCABO. (By the way, the latest Zoom client software for Windows is up to version 4.6.9, and you should get it only from here.)

The coin-miner will ramp up your PC’s central processor unit, and its graphics card if there is one, to solve mathematical problems in order to generate new units of cryptocurrency. You’ll notice this if you fans suddenly speed up or if Windows Task Manager (hit Ctrl + Shift + Esc) shows unexpectedly heavy CPU/GPU use.

To avoid getting hit with this malware, make sure you’re running one of the best antivirus programs, and don’t click on any links in emails, social media posts or pop-up messages that promise to install Zoom on your machine.

STATUS: Open, but this isn’t Zoom’s problem to fix. It can’t stop other people from copying and redistributing its installation software.

Zoom encryption not what it claims to be

Not only does Zoom mislead users about its”end-to-end encryption”(see further down), but its seems to be flat-out, um, not telling the truth about the quality of its encryption algorithm.

Zoom says it use AES-256 encryption to encode video and audio data traveling between Zoom servers and Zoom clients (i.e., you and me). But researchers at the Citizen Lab at the University of Toronto, in a report posted April 3, found that Zoom actually uses the somewhat weaker AES-128 algorithm.

Even worse, Zoom uses an in-house implementation of encryption algorithm that preserves patterns from the original file. It’s as if someone drew a red circle on a gray wall, and then a censor painted over the red circle with a while circle. You’re not seeing the original message, but the shape is still there.

“We discourage the use of Zoom at this time for use cases that require strong privacy and confidentiality,”the Citizen Lab report says, such as”governments worried about espionage, businesses concerned about cybercrime and industrial espionage, healthcare providers handling sensitive patient information”and”activists, lawyers, and journalists working on sensitive topics.”

STATUS: Unresolved. In a blog post April 3, Zoom CEO Eric S. Yuan acknowledged the encryption issue but said only that”we recognize that we can do better with our encryption design”and”we expect to have more to share on this front in the coming days.”

In Zoom’s announcement of the upcoming April 26 desktop-software update, Zoom said it would be upgrading the encryption implementation to a better format for all users by May 30.

Zoom software can be easily co rrupted

Good software has built-in anti-tampering mechanisms to make sure that applications don’t run code that’s been altered by a third party.

Zoom has such anti-tampering mechanisms in place, which is good. But those anti-tampering mechanisms themselves are not protected from tampering, said a British computer student who calls himself”Lloyd“in a blog post April 3. 

Needless to say, that’s bad. Lloyd showed how Zoom’s anti-tampering mechanism can easily be disabled, or even replaced with a malicious version that hijacks the application.

If you’re reading this with a working knowledge of how Windows software works, this is a pretty damning passage:”This DLL can be trivially unloaded, rendering the anti-tampering mechanism null and void. The DLL is not pinned, meaning an attacker from a 3rd party process could simply inject a remote thread.”

In other words, malware already present on a computer could use Zoom’s own anti-tampering mechanism to tamper with Zoom. Criminals could also create fully working versions of Zoom that have been altered to perform malicious acts.

STATUS: Unresolved.

Zoom bombing

Anyone can”bomb”a public Zoom meeting if they know the meeting number, and then use the file-share photo to post shocking images, or make annoying sounds in the audio. The FBI even warned about it a few days ago.

The host of the Zoom meeting can mute or even kick out troublemakers, but they can come right back with new user IDs. The best way to avoid Zoom bombing is to not share Zoom meeting numbers with anyone but the intended participants. You can also require participants to use a password to log into the meeting.

On April 3, the U.S. Attorney’s Office for the Eastern District of Michigan said that”anyone who hacks into a teleconference can be charged with state or federal crimes.”It’s not clear whether that applies only to eastern Michigan.

STATUS: There are easy ways to avoid Zoom bombing, which we go through here.

Leaks of email addresses and profile photos

Zoom automatically puts everyone sharing the same email domain into a”company”folder where they can see each other’s information.

Exceptions are made for people using large webmail clients such as Gmail, Yahoo, Hotmail or Outlook.com, but not apparently for smaller webmail providers that Zoom might not know about.

Several Dutch Zoom users who use ISP-provided email addresses suddenly found that they were in the same”company”with dozens of strangers–and could see their email addresses, user names and user photos.

STATUS: Unresolved, but an April 19 Zoom software update for Zoom web-interface users makes sure users on the same email domain can no longer automatically search for each other by name. The Zoom desktop client software will get similar fixes April 26.

Sharing of personal data with advertisers

Several privacy experts, some working for Consumer Reports, pored over Zoom’s privacy policy and found that it apparently gave Zoom the right to use Zoom users’personal data and to share it with third-party marketers.

Following a Consumer Reports blog post, Zoom quickly rewrote its privacy policy, stripping out the most disturbing passages and asserting that”we do not sell your personal data.”

STATUS: Unknown. We don’t know the details of Zoom’s business dealings with third-party advertisers.

You can’war drive’to find open Zoom meetings

You can find open Zoom meetings by rapidly cycling through possible Zoom meeting IDs, a security researcher told independent security blogger Brian Krebs.

The researcher got past Zoom’s meeting-scan blocker by running queries through Tor, which randomized his IP address. It’s a variation on”war driving”by randomly dialing telephone numbers to find open modems in the dial-up days.

The researcher told Krebs that he could find about 100 open Zoom meetings every hour with the tool, and that”having a password enabled on the [Zoom] meeting is the only thing that defeats it.”

STATUS: Unknown.

Zoom meeting chats don’t stay private

Two Twitter users pointed out that if you’re in a Zoom meeting and use a private window in the meeting’s chat app to communicate privately with another person in the meeting, that conversation will be visible in the end-of-meetin g transcript the host receives.

STATUS: Unknown.

Resolved/fixed issues

Zoom flaw allowed account hijacking

A Kurdish security researcher said Zoom paid him a bug bounty–a reward for finding a serious flaw–for finding how to hijack a Zoom account if the account holder’s email address was known or guessed.

The researcher, who calls himself”s3c”but whose real name may be Yusuf Abdulla, said if he tried to log into Zoom with a Facebook account, Zoom would ask for the email address associated with that Facebook account. Then Zoom would open a new webpage notifying him that a confirmation email message had been sent to that email address.

The URL of the notification webpage would have a unique identification tag in the address bar. As an example that’s much shorter than the real thing, let’s say it’s”zoom.com/signup/123456XYZ”.

When s3c received and opened the confirmation email message sent by Zoom, he clicked on the confirmation button in the body of the message. This took him to yet another webpage that confirmed his email address was now associated with a new account. So far, so good.

But then s3c noticed that the unique identification tag in the Zoom confirmation webpage’s URL was identical to the first ID tag. Let’s use the example”zoom.com/confirmation/123456XYZ”.

The matching ID tags, one used before confirmation and the other after confirmation, meant that s3c could have avoided receiving the confirmation email, and clicking on the confirmation button, altogether.

In fact, he could have entered ANY email address–yours, mine or [email protected]–into the original signup form. Then he could have copied the ID tag from the resulting Zoom notification page and pasted the ID tag into an already existing Zoom account-confirmation page.

Boom, he’d have access to any Zoom account created using the targeted email address.

“Even if you already linked your account with a Facebook account Zoom automatically unlink it and link it with the attacker Facebook account,”s3c wrote in his imperfect English.

And because Zoom lets anyone using a company email address view all other users signed up with the same email domain, e.g.”company.com”, s3c could have leveraged this method to steal ALL of a given company’s Zoom accounts.

“So if an attacker create an account with email address [email protected] and verify it with this bug,”s3c wrote,”the attacker can view all emails that created with *@companyname.com in Zoom app in Company contacts so that means the attacker can hack all accounts of the company.”

Zoom is fortunate that s3c is one of the good guys and didn’t disclose this flaw publicly before Zoom could fix it. But it’s such a simple flaw that it’s hard to imagine no one else noticed it before.

STATUS: Fixed, thank God.

Zoom removes meeting IDs from screens

Zoom has released updates for its Windows, macOS and Linux desktop client software so that meeting IDs will not display onscreen during meetings. British Prime Minister Boris Johnson accidentally displayed a Zoom meeting ID in a tweet, and the Belgian cabinet made a similar mistake.

‘Potential security vulnerability’with Zoom file sharing

In an”ask me anything”webinar in early April, Zoom CEO Eric S. Yuan said that Zoom had discovered”a potential security vulnerability with file sharing, so we disabled that feature.”

Until this week, participants in a Zoom meeting could share files with each other using the meeting’s chat function.

STATUS: Fixed.

Zoom cryptographic keys issued by Chines e servers

Those AES128 encryption keys are issued to Zoom clients by Zoom servers, which is all well and good, except that the Citizen Lab found several Zoom servers in China issuing keys to Zoom users even when all participants in a meeting were in North America.

Since Zoom servers can decrypt Zoom meetings, and Chinese authorities can compel operators of Chinese servers to hand over data, the implication is that the Chinese government might be able to see your Zoom meetings.

That’s got to be bad news for the British government, which has held at least one Cabinet meeting over Zoom.

STATUS: Apparently fixed. In a blog post April 3, Zoom CEO Eric S. Yuan responded to the Citizen Lab report by saying that”it is possible certain meetings were allowed to connect to systems in China, where they should not have been able to connect. We have since corrected this.”

Security flaw with Zoom meeting waiting rooms

Zoom advises meeting hosts to set up”waiting rooms”to avoid”Zoom bombing.”A waiting room essentially keeps participants on hold until a host lets them in, either all at once or one at a time.

The Citizen Lab said it found a serious security issue with Zoom waiting rooms, and advised hosts and participants to not use them for now. The Citizen Lab is not disclosing the details yet, but has told Zoom of the flaw.

“We advise Zoom users who desire confidentiality to not use Zoom Waiting Rooms,”the Citizen Lab said in its report.”Instead, we encourage users to use Zoom’s password feature.”

STATUS: Fixed. In a follow-up to their initial report. the Citizen Lab researchers disclosed that uninvited attendees to a meeting could nonetheless get the meeting’s encryption key from the waiting room.

“On April 7, Zoom reported to us that they had implemented a server-side fix for the issue,”the researchers said.

Windows password stealing

Zoom meetings have side chats in which participants can sent text-based messages and post web links.

But according to Twitter user @_g0dmode and Anglo-American cybersecurity training firm Hacker House, Zoom until the end of March made no distinction between regular web addresses and a different kind of remote networking link called a Universal Naming Convention (UNC) path. That left Zoom chats vulnerable to attack.

If a malicious Zoom bomber slipped a UNC path to a remote server that he controlled into a Zoom meeting chat, an unwitting participant could click on it.

The participant’s Windows computer would then try to reach out to the hacker’s remote server specified in the path and automatically try to log into it using the user’s Windows username and password.

The hacker could capture the password”hash”and decrypt it, giving him access to the Zoom user’s Windows account.

STATUS: Yuan’s blog post says Zoom has now fixed this problem.

Windows malware injection

Mohamed A. Baset of security firm Seekurity said on Twitter that the same filepath flaw also would let a hacker insert a UNC path to a remote executable file into a Zoom meeting chatroom.

If a Zoom user running Windows clicked on it, a video posted by Baset showed, the user’s computer would try to load and run the software. The victim would be prompted to authorize the software to run, which will stop some hacking attempts but not all.

STATUS: If the UNC filepath issue is fixed, then this should be as well.

iOS profile sharing

Until late March, Zoom sent iOS user profiles to Facebook as part of the”log in with Facebook”feature in the iPhone and iPad Zoom apps. After Vice News exposed the practice, Zoom said it hadn’t been aware of the profile-sharing and updated the iOS apps to fix this.

STATUS: Fixed.

Malware-like behavior on Macs

We learned last summer that Zoom used hacker-like methods to bypass normal macOS security precautions. We thought that problem had been fixed then, along with the security flaw it created.

But a series of tweets March 30 from security researcher Felix Seele, who noticed that Zoom installed itself on his Mac without the usual user authorizations, revealed that there was still an issue.

“They (ab)use preinstallation scripts, manually unpack the app using a bundled 7zip and install it to/Applications if the current user is in the admin group (no root needed),”Seele wrote.

“The application is installed without the user giving his final consent and a highly misleading prompt is used to gain root privileges. The same tricks that are being used by macOS malware.”(Seele elaborated in a more user-friendly blog post here.)

Zoom founder and CEO Eric S. Yuan tweeted a friendly response.

“To join a meeting from a Mac is not easy, that is why this method is used by Zoom and others,”Yuan wrote.”Your point is well taken and we will continue to improve.”

UPDATE: In a new tweet April 2, Seele said Zoom had released a new version of the Zoom client for macOS that”completely removes the questionable’preinstall’-technique and the faked password prompt.”

“I must say that I am impressed. That was a swift and comprehensive reaction. Good work, @zoom_us!”Seele added.

STATUS: Fixed.

A backdoor for Mac malware

Other people could use Zoom’s dodgy Mac installation methods, renowned Mac hacker Patrick Wardle said in a blog post March 30.

Wardle demonstrated how a local attacker–such as a malicious human or already-installed malware–could use Zoom’s formerly magical powers of unauthorized installation to”escalate privileges”and gain total control over the machine without knowing the administrator password.

Wardle also showed that a malicious script installed into the Zoom Mac client could give any piece of malware Zoom’s webcam and microphone privileges, which do not prompt the user for authorization and could turn any Mac with Zoom installed into a potential spying device.

“This affords malware the ability to record all Zoom meetings, or simply spawn Zoom in the background to access the mic and webcam at arbitrary times,”Wardle wrote.

STATUS: Yuan’s blog post says Zoom has fixed these flaws.

Other issues

Zoom pledges to fix flaws

In a blog post April 1, Zoom CEO and founder Eric S. Yuan acknowledged Zoom’s growing pains and pledged that regular development of the Zoom platform would be put on hold while the com pany worked to fix security and privacy issues.

“We recognize that we have fallen short of the community’s–and our own–privacy and security expectations,”Yuan wrote, explaining that Zoom had been developed for large businesses with in-house IT staffers who could set up and run the software.

“We now have a much broader set of users who are utilizing our product in a myriad of unexpected ways, presenting us with challenges we did not anticipate when the platform was conceived,”he said.”These new, mostly consumer use cases have helped us uncover unforeseen issues with our platform. Dedicated journalists and security researchers have also helped to identify pre-existing ones.”

To deal with these issues, Yuan wrote, Zoom would be”enacting a feature freeze, effectively immediately, and shifting all our engineering resources to focus on our biggest trust, safety, and privacy issues.”

Among other things, Zoom would also be”conducting a comprehensive review with third-party experts and representative users to understand and ensure the security of all of our new consumer use cases.”

Zoom now requires passwords by default for most Zoom meetings, although meetings hosts can turn that feature off. Passwords are the easiest way to stop Zoom bombing.

And on April 8, former Facebook and Yahoo chief security officer Alex Stamos said he would be working with Zoom to improve its security and privacy. Stamos is now an adjunct professor at Stanford and is highly regarded within the information-security community.

Phony end-to-end encryption

Zoom claims its meetings use”end-to-end encryption”if every participant calls in from a computer or a Zoom mobile app instead of over the phone. But under pressure from The Intercept, a Zoom representative admitted that Zoom’s definitions of”end-to-end”and”endpoint”are not the same as everyone else’s.

“When we use the phrase’End to End’,”a Zoom spokeperson told The Intercept,”it is in reference to the connection being encrypted from Zoom end point to Zoom end point.”

Sound good, but the spokesperson clarified that he counted a Zoom server as an endpoint.

Every other company considers an endpoint to be a user device–a desktop, laptop, smartphone or tablet–but not a server. And every other company takes”end-to-end encryption”to mean that servers that relay messages from one endpoint to another can’t decrypt the messages.

When you send an Apple Message from your iPhone to another iPhone user, Apple’s servers help the message get from one place to another, but they can’t read the content.

Not so with Zoom. It can see whatever is going on in its meetings, and sometimes it  may have to in order to make sure everything works properly. Just don’t believe the implication that it can’t.

UPDATE: In a blog post April 1, Zoom Chief Product Officer Oded Gal wrote that”we want to start by apologizing for the confusion we have caused by incorrectly suggesting that Zoom meetings were capable of using end-to-end encryption.”

“We recognize that there is a discrepancy between the commonly accepted definition of end-to-end encryption and how we were using it,”he wrote.

Gal assured users that all data sent and received by Zoom client applications (but not regular phone lines, business conferencing systems or, presumably, browser interfaces) is indeed encrypted and that Zoom servers or staffers”do not decrypt it at any point before it reaches the receiving clients.”

However, Gal added,”Zoom currently maintains the key management system for these systems in the cloud”but has”implemented robust and validated internal controls to prevent unauthorized access to any content that users share during meetings.”

The implication is that Zoom doesn’t decrypt user transmissions by choice. But because it holds the encryption keys, Zoom could if it had to, such as if it were presented with a warrant or a U.S. National Security Letter (essentially a secret warrant).

For those worried about government snooping, Gal wrote that”Zoom has never built a mechanism to decrypt live meetings for lawful intercept purposes, nor do we have means to insert our employees or others into meetings without being reflected in the participant list.”

He added that companies and other enterprises would soon be able to handle their own encryption process.

“A solution will be available later this year to allow organizations to leverage Zoom’s cloud infrastructure but host the key management system within their environment.”

STATUS: This is an issue of misleading advertising rather than an actual software flaw. We hope Zoom stops using the term”end-to-end encryption”incorrectly, but just keep in mind that you won’t be getting the real thing with Zoom until it fully implements the technology it’s buying with Keybase.

Zoom meeting recordings can be found online

Privacy researcher Patrick Jackson noticed that Zoom meeting recordings saved to the host’s computer generally get a certain type of file name.

So he searched unprotected cloud servers to see if anyone had uploaded Zoom recordings and found more than 15,000 unprotected examples, according to The Washington Post. Jackson also found some recorded Zoom meetings on YouTube and Vimeo.

This isn’t really Zoom’s fault. It’s up to the host to decide whether to record a meeting, and Zoom gives paying customers the option to store recordings on Zoom’s own servers. It’s also up to the host to decide to change the recording’s file name.

If you host a Zoom meeting and decide to record it, then make sure you change the default file name after you’re done.

STATUS: This is not really Zoom’s problem, to be honest.