Hackers could eavesdrop on scores of Zoom Meetings by generating and verifying Zoom Meeting IDs; Zoom rolls out a series of security changes to fix flaws
Check Point Research identified a major security flaw in Zoom, the popular video conferencing service used by over 60% of the Fortune 500. Check Point’s researchers were able to prove that hackers could easily generate and verify Zoom Meeting IDs to target victims, enabling a hacker to eavesdrop on Zoom meetings, giving them intrusive access to all audio, video and documents shared throughout the duration of the meeting.
Guessing Zoom Meeting IDs
Zoom meeting IDs are access points for Zoom meeting participants. Typically, these ID numbers comprise of 9, 10 and 11-digit numbers that typically look like https://zoom.us/j/93XXX9XXX5.
Researchers at Check Point learned that a hacker could pre-generate a long list of Zoom Meeting ID numbers, use automation techniques to quickly verify if a respective Zoom Meeting ID was valid or not, and then gain entry into Zoom meetings that were not password protected. Researchers found that around 4% of their randomly-generated meeting IDs led to a genuine Zoom meeting ID.
Eavesdropping in 3 easy steps
In summary, a hacker could eavesdrop into a Zoom meeting by following 3-easy steps:
- Generate a list of Zoom Meeting IDs
- Quickly validate the existence of each Zoom Meeting ID
- Connect to the meeting
Responsible disclosure
Check Point first contacted Zoom on July 22, 2019 and shared these findings as part of its standard responsible disclosure process. Check Point subsequently worked with Zoom to issue out a series of fixes and new functionality to fully patch the security flaws Check Point discovered.
Zoom’s security changes
As a result of Check Point’s disclosure, Zoom introduced the following security features and functionalities into its technology:
- Default Passwords:Password are added by default to all future scheduled meetings.
- Password Additions by User:Users can add a password to already-scheduled future meetings and received instructions by email on how to do so.
- Account and Group Level Password Enforcement: Password settings are enforceable at the account level and group level by the account admin.
- Meeting ID Validation:Zoom will no longer automatically indicate if a meeting ID is valid or invalid. For each attempt, the page will load and attempt to join the meeting. Thus, a bad actor will not be able to quickly narrow the pool of meetings to attempt to join.
- Device blocker.Repeated attempts to scan for meeting IDs will cause a device to be blocked for a period of time.
Zoom by the numbers
- 74,000+ customers (The Motley Fool, Jan 8, 2020)
- 60% of the Fortune 500 use Zoom (Zoom, 2019)
- Over 96% of the top 200 US universities use Zoom (Zoom, 2019)
- Zoom grew customers 67% over the past year (The Motley Fool, Jan 8, 2020)
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.