Zoom bug allowed attackers to crack private meeting passwords

[silversurfer]

Content source

https://www.bleepingcomputer.com/news/security/zoom-bug-allowed-attackers-to-crack-private-meeting-passwords/

A lack of rate limiting on repeated password attempts allowed potential attackers to crack the numeric passcode used to secure Zoom private meetings as discovered by Tom Anthony, VP Product at SearchPilot.

"Zoom meetings are (were) default protected by a 6 digit numeric password, meaning 1 million maximum passwords," as Anthony discovered.

The vulnerability he spotted in the Zoom web client allowed attackers to guess any meeting's password by trying all possible combinations until finding the correct one.

"This enables an attacker to attempt all 1 million passwords in a matter of minutes and gain access to other people’s private (password protected) Zoom meetings," he says.
"This also raises the troubling question a to whether others were potentially already using this vulnerability to listen in to other peoples' call."

 

[Ink]

Zoom is another household name we'll have to get used to, just like Skype or Hangouts. It also seems like there have been more vulnerabilities for Zoom than Flash player in the past 6 months.

These apps and services so poorly designed, that once they gain any sort of popularity, they break to show how weak they actually are.

 

[Eggnog]

I have a feeling Zoom will tighten things up now that so many are starting to rely on them due to the pandemic. My organization is now using it extensively for a variety of purposes. I've noticed they've been updating it a lot since we first began using it back in March.

 

[CyberPanther]

Zoom bug meant attackers could brute force their way into...

 

[shmu26]

No one is going to try a million combinations in order to crash your family meeting. It's a non-issue for casual users of Zoom.

 

[show-Zi]

I think there are many people who have introduced this software because of the sudden telecommuting. For an intruder, finding a vulnerability in the software at this time can be a "blessed rain" that falls just before harvest. It is the software that needs the attention of the security most.

 

[Stopspying]

Zoom is another household name we'll have to get used to, just like Skype or Hangouts. It also seems like there have been more vulnerabilities for Zoom than Flash player in the past 6 months.

These apps and services so poorly designed, that once they gain any sort of popularity, they break to show how weak they actually are.

Totally agree with this. Several months ago there were numerous posts being made about Zoom vulnerabilities, many reported here, the poor coding continues to be exposed and probably will be for a long time to come. Yet Zoom continues to be the go-to app for this type of use, despite all the warnings the wider internet herd of sheep mentality continues to use it. We've seen this same behaviour pattern since the internet started to grow.

Its a job creation project run by by IT experts! There's usually a silver lining for some!

 

[upnorth]

According to the researcher, using 4-5 cloud servers it would be possible to check all the possible six digit numeric passwords in just “a few minutes.”

Zoom bug meant attackers could brute force their way into password-protected meetings

Zoom has patched a security hole that could have allowed attackers to break their way into password-protected private calls.

hotforsecurity.bitdefender.com