Name: Zoom bug gave hackers access to any private meeting
Brand: techradar.com
SKU: techradar-com-28
Availability: OnlineOnly

critic

Zoom bug gave hackers access to any private meeting

preview

TechRadar is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. .Audio player loading…A simple vulnerability found in the web client of platform could have allowed hackers to listen in on any private meeting of their choosing.Identified by Tom Anthony, VP Product at SEO firm SearchPilot, the Zoom vulnerability stemmed from the absence of rate limiting on private meeting log in attempts.As Anthony explains in a recent , Zoom meetings used to be protected by a 6-digit numeric password, making for a maximum of one million different permutations. This might sound like a considerable number but, using a simple Python program, a hacker could easily trial all possible and brute force their way into any meeting in minutes.Meetings set to take place at regular intervals were particularly vulnerable to attack, since the password remains the same for each batch-scheduled meeting.Zoom has experienced a sharp uptick in user numbers in recent months and currently serves over 300 million daily meeting participants.Having rocketed into public consciousness as a result of coronavirus lockdown measures and the rise of remote working, Zoom has faced significant scrutiny where security is concerned.Since March, researchers have uncovered a litany of vulnerabilities in the service - from the opportunity for credential theft to app hijacking, malicious code injection and more - forcing the company to suspend product development for a period to focus on eliminating security bugs.After verifying the brute force exploit using a crude program running on an AWS machine, Anthony disclosed the vulnerability on April 1, which led to the suspension of the Zoom web client on April 2 - an outage that lasted one week.During this time, Zoom implemented policy that required web client users to log into an account before joining a meeting. The company also made default passwords longer and included non-numeric characters, drastically increasing the number of possible password permutations.“We have since improved rate limiting and relaunched the web client on April 9. With these fixes, the issue was fully resolved, and no user action was required. We are not aware of any instances of this exploit being used in the wild,” Zoom explained in a statement.As Anthony notes, however, it is plausible an attacker might have infiltrated a Zoom meeting by this vector without alerting the other participants, hidden behind a generic user ID such as “iPhone” or “Home PC”.ViaSign up to theTechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!Thank you for signing up to TechRadar. You will receive a verification email shortly.There was a problem. Please refresh the page and try again.MOST POPULARMOST SHARED1234512345Other versions of this page are available with specific content for the following regions:

TechRadar is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. .Audio player loading…A simple vulnerability found in the web client of platform could have allowed hackers to listen in on any private meeting of their choosing.Identified by Tom Anthony, VP Product at SEO firm SearchPilot, the Zoom vulnerability stemmed from the absence of rate limiting on private meeting log in attempts.As Anthony explains in a recent , Zoom meetings used to be protected by a 6-digit numeric password, making for a maximum of one million different...

public

Joel Khalili

techradar.com

Credible

Speculation

Anecdotal Evidence

Generalization

Stacking the Deck

Appeal to Authority

Straw Man

Slippery Slope

Emotional Appeal

Red Herring

False Dilemma

Illogical

Moral Equivalency

Ad Hominem

Correlation w/o Causation

Semantics

Begging the Question

Faulty Analogy

Non Sequitur

Bandwagon

Dogmatism

Failing Occam's Razor

Biased

Pure Opinion

Hit Piece

Racial Bias

National Bias

Religious Bias

Financial Incentive

Political Agenda

Gender Bias

Misused Image/Video

Study Misinterpreted

Mistake

Misused Term

Science Misrepresented

Factual Error

Satire

Surface Level

Lack of Reliable Sources

Sensational

Not Credible

Investigative

Balanced

Well Sourced

Great Context

sports

entertainment

U.S.

international

business

technology

science

culture

politics

media

health

Zoom bug gave hackers access to any private meeting

No article scores yet.

CRITIC REVIEWS

PUBLIC REVIEWS