Zoom vows to spend next 90 days thinking hard about its security and privacy after rough week, meeting ID war-dialing tool emerges

Video-conferencing app maker Zoom has promised to do better at security after a bruising week in which it was found to be unpleasantly leaky in several ways.

The pledge came in a memo to customers from CEO Eric S. Yuan, in which he said: “Over the next 90 days, we are committed to dedicating the resources needed to better identify, address, and fix issues proactively. We are also committed to being transparent throughout this process. We want to do what it takes to maintain your trust.”

The company said it has, amid the coronavirus pandemic forcing people around the world to work from home, seen its daily user numbers soar from 10 million in December to now 200 million. And with that increase, it’s experienced a shed load of scrutiny from the media and information security types. In response to the shortcomings uncovered, Zoom has promised to:

• Enact a feature freeze, effectively immediately, and shifting all our engineering resources to focus on our biggest trust, safety, and privacy issues.
• Conduct a comprehensive review with third-party experts and representative users to understand and ensure the security of all of our new consumer use cases.
• Prepare a transparency report that details information related to requests for data, records, or content.
• Enhance our current bug bounty program.
• Launch a CISO council in partnership with leading CISOs from across the industry to facilitate an ongoing dialogue regarding security and privacy best practices.
• Engage in a series of simultaneous white box penetration tests to further identify and address issues.
• Host a weekly webinar on Wednesdays at 10am PT to provide privacy and security updates to our community.

The developer has already fixed a Mac installer that behaved badly and other security flaws. It also removed the creepy attention-tracking feature that alerted meeting hosts if a participant clicked away from the app for too long.

However, the engineers now focused on security clearly have their work cut out. Last year, Check Point documented how it was easy to brute-force guess Zoom meeting ID numbers, which could be used to gatecrash non-password-protected conferences. In response, Zoom made creating a password a default setting, thwarting ID brute-forcing.

Unfortunately, miscreants keep Zoombombing virtual meetings, pasting in porno and other nonsense. So much so, Zoom published advice on how to keep uninvited morons out of private conferences. This week, the biz admitted to infosec journo Brian Krebs that this password-protected-by-default feature may not be working as intended, leaving people’s meetings exposed.

In short, follow the advice to set a password, and don’t publicly share those credentials, and do set limits on individual participants.

Meanwhile, Krebs has been in touch with someone who has automated that meeting ID brute-forcing process. That someone is Trent Lo, a security professional and co-founder of Kansas City security meetup SecKC.

“Lo and fellow SecKC members recently created zWarDial, which borrows part of its name from the old phone-based war dialing programs that called random or sequential numbers in a given telephone number prefix to search for computer modems,” Krebs explained. And zWarDial found about 100 open meetings each hour.

Which shouldn’t be possible, because Zoom is supposed to apply a password by default, indicating perhaps there’s a scenario in which passwords aren’t created by default. Or perhaps Zoom has so many meetings now, some are bound to have their passwords switched off by hosts to make life easier.

At least Zoom has a share price that’s above its early 2020 level, something not many listed companies can boast right now. It’s standing at $121.93 apiece versus $68.72 on January 1. A Chinese company called Zoom Technologies also enjoyed a surge in investment after buyers mistook its $ZOOM ticker symbol for Zoom’s $ZM. America’s financial watchdog, the SEC, suspended trading of the Chinese company’s stock to stop that silliness. ®

Sponsored: Webcast: Build the next generation of your business in the public cloud

READ MORE HERE