silversurfer

Level 61
Verified
Trusted
Content Creator
Malware Hunter
A lack of rate limiting on repeated password attempts allowed potential attackers to crack the numeric passcode used to secure Zoom private meetings as discovered by Tom Anthony, VP Product at SearchPilot.

"Zoom meetings are (were) default protected by a 6 digit numeric password, meaning 1 million maximum passwords," as Anthony discovered.

The vulnerability he spotted in the Zoom web client allowed attackers to guess any meeting's password by trying all possible combinations until finding the correct one.

"This enables an attacker to attempt all 1 million passwords in a matter of minutes and gain access to other people’s private (password protected) Zoom meetings," he says.
"This also raises the troubling question a to whether others were potentially already using this vulnerability to listen in to other peoples' call."
 

Spawn

Administrator
Verified
Staff member
Zoom is another household name we'll have to get used to, just like Skype or Hangouts. It also seems like there have been more vulnerabilities for Zoom than Flash player in the past 6 months.

These apps and services so poorly designed, that once they gain any sort of popularity, they break to show how weak they actually are.
 

Eggnog

Level 1
I have a feeling Zoom will tighten things up now that so many are starting to rely on them due to the pandemic. My organization is now using it extensively for a variety of purposes. I've noticed they've been updating it a lot since we first began using it back in March.
 

show-Zi

Level 24
Verified
I think there are many people who have introduced this software because of the sudden telecommuting. For an intruder, finding a vulnerability in the software at this time can be a "blessed rain" that falls just before harvest. It is the software that needs the attention of the security most.
 

Stopspying

Level 10
Zoom is another household name we'll have to get used to, just like Skype or Hangouts. It also seems like there have been more vulnerabilities for Zoom than Flash player in the past 6 months.

These apps and services so poorly designed, that once they gain any sort of popularity, they break to show how weak they actually are.
Totally agree with this. Several months ago there were numerous posts being made about Zoom vulnerabilities, many reported here, the poor coding continues to be exposed and probably will be for a long time to come. Yet Zoom continues to be the go-to app for this type of use, despite all the warnings the wider internet herd of sheep mentality continues to use it. We've seen this same behaviour pattern since the internet started to grow.

Its a job creation project run by by IT experts! There's usually a silver lining for some!
 

upnorth

Level 44
Verified
Trusted
Content Creator
Malware Hunter
According to the researcher, using 4-5 cloud servers it would be possible to check all the possible six digit numeric passwords in just “a few minutes.”
 
Top