itb-au logo
Story image

Zoom meetings infiltrated by hackers - Check Point

Check Point Research identified a major security flaw in Zoom, the video conferencing service used by over 60% of the Fortune 500. 

Check Point’s researchers were able to prove that hackers could easily generate and verify Zoom Meeting IDs to target victims, enabling a hacker to eavesdrop on Zoom meetings, giving them intrusive access to all audio, video and documents shared throughout the duration of the meeting.

Guessing Zoom meeting IDs

Zoom meeting IDs are access points for Zoom meeting participants. Typically, these ID numbers comprise of 9, 10 and 11-digit numbers.

Researchers at Check Point learned that a hacker could pre-generate a long list of Zoom Meeting ID numbers, use automation techniques to quickly verify if a respective Zoom Meeting ID was valid or not, and then gain entry into Zoom meetings that were not password protected. 

Researchers found that around 4% of their randomly-generated meeting IDs led to a genuine Zoom meeting ID.

Eavesdropping in three easy steps

In summary, a hacker could eavesdrop into a Zoom meeting by following three easy steps:

  1. Generate a list of Zoom Meeting IDs
  2. Quickly validate the existence of each Zoom Meeting ID
  3. Connect to the meeting.

Check Point first contacted Zoom on July 22, 2019 and shared these findings as part of its standard responsible disclosure process.

Check Point subsequently worked with Zoom to issue out a series of fixes and new functionality to fully patch the security flaws Check Point discovered.

Zoom’s security changes 

As a result of Check Point’s disclosure, Zoom introduced the following security features and functionalities into its technology:

  1. Default passwords: Passwords are added by default to all future scheduled meetings.
     
  2. Password additions by user: Users can add a password to already-scheduled future meetings.
     
  3. Account and group level password enforcement: Password settings are enforceable at the account level and group level by the account admin.
     
  4. Meeting ID validation: Zoom will no longer automatically indicate if a meeting ID is valid or invalid. For each attempt, the page will load and attempt to join the meeting. Thus, a bad actor will not be able to quickly narrow the pool of meetings to attempt to join.
     
  5. Device blocker: Repeated attempts to scan for meeting IDs will cause a device to be blocked for a period of time.
Story image
Webinar: TLC for Kids on their usage of Nintex Drawloop DocGen
The charity is using the software to free up resources and enable its team to focus on its mission — which, simply put, is to put smiles back on sick kids’ faces. It does this through its TLC Ambulance, Rapid TLC, and distraction box programs, and its services are used over a million times each year across Australia.More
Story image
Why automating the finance function is critical for future growth
As well as continually struggling with tedious workflows and manual processing, many finance professionals are still finding it a challenge to complete their month-end close. This is where software can help, writes BlackLine regional vice president for A/NZ Claudia Pirko.More
Story image
ECI Software Solutions acquired by Leonard Green & Partners
"We are excited to welcome LGP as our new partner, and I am confident that this is the right choice for our future – and the future of our 1,700 employees and more than 22,000 customers.”More
Story image
D-Link launches new router and cloud IoT management solution
The DWM-315 is a 4G LTE Cat 6 Dual SIM M2M VPN Router with EWAN and GPS and the D-ECS edge cloud management solution expands the D-Link IoT range.More
Link image
How to supercharge digital transformation with Azure training
Cloud computing is proliferating fast in New Zealand, but many organisations are being held back by limited knowledge. Power up your transformation with Auldhouse's Azure training classes.More
Story image
Environmental Intelligence sector increasingly important, report states
The EI sector is emerging as one where technology meets real-world challenges, and is set to become more significant as climate change and environmental issues dominate public interest, the report states.More