sb-au logo
Story image

Zoom meetings infiltrated by hackers - Check Point

Check Point Research identified a major security flaw in Zoom, the video conferencing service used by over 60% of the Fortune 500. 

Check Point’s researchers were able to prove that hackers could easily generate and verify Zoom Meeting IDs to target victims, enabling a hacker to eavesdrop on Zoom meetings, giving them intrusive access to all audio, video and documents shared throughout the duration of the meeting.

Guessing Zoom meeting IDs

Zoom meeting IDs are access points for Zoom meeting participants. Typically, these ID numbers comprise of 9, 10 and 11-digit numbers.

Researchers at Check Point learned that a hacker could pre-generate a long list of Zoom Meeting ID numbers, use automation techniques to quickly verify if a respective Zoom Meeting ID was valid or not, and then gain entry into Zoom meetings that were not password protected. 

Researchers found that around 4% of their randomly-generated meeting IDs led to a genuine Zoom meeting ID.

Eavesdropping in three easy steps

In summary, a hacker could eavesdrop into a Zoom meeting by following three easy steps:

  1. Generate a list of Zoom Meeting IDs
  2. Quickly validate the existence of each Zoom Meeting ID
  3. Connect to the meeting.

Check Point first contacted Zoom on July 22, 2019 and shared these findings as part of its standard responsible disclosure process.

Check Point subsequently worked with Zoom to issue out a series of fixes and new functionality to fully patch the security flaws Check Point discovered.

Zoom’s security changes 

As a result of Check Point’s disclosure, Zoom introduced the following security features and functionalities into its technology:

  1. Default passwords: Passwords are added by default to all future scheduled meetings.
     
  2. Password additions by user: Users can add a password to already-scheduled future meetings.
     
  3. Account and group level password enforcement: Password settings are enforceable at the account level and group level by the account admin.
     
  4. Meeting ID validation: Zoom will no longer automatically indicate if a meeting ID is valid or invalid. For each attempt, the page will load and attempt to join the meeting. Thus, a bad actor will not be able to quickly narrow the pool of meetings to attempt to join.
     
  5. Device blocker: Repeated attempts to scan for meeting IDs will cause a device to be blocked for a period of time.
Story image
Akamai named leader for DDoS mitigation solutions in The Forrester Wave
“As opposed to other 'all in one' solutions that can be vulnerable to platform outages, our distinct, purpose-built DDoS solutions are architected to ensure multiple levels of resilience."More
Story image
Dicker Data scores One Identity distribution agreement for Australia
Dicker Data has entered into a distribution agreement with One Identity, a Quest Software company specialising in identity-centric security. The agreement was effective as of 1 March 2021.More
Story image
Sophos announces collaboration with Qualcomm for PC security
This unification enables a connected, interactive computing environment that combines smartphone and PC technology to deliver security capabilities and opportunities, the company states.More
Story image
Kaspersky ranked number one in channel partner satisfaction
“Being recognised for the second consecutive year as the number one cybersecurity vendor for channel satisfaction, reflects the investment we have made in the Kaspersky United partner program over the past two years."More
Story image
Sandbox evasion malware used for cyber espionage, new study shows
The company's findings show that 25% of that malware was active in 2019-2020, and that at least 23 APT groups around the world have used them in attacks.More
Story image
IWD 2021: LogRhythm VP on recognising the skills women bring to the table
"There is an opportunity for IT companies to strengthen their learning and development pipeline and help women acquire the relevant skills."More