Skip to main content

Zoom apologies for security issues, promises fixes


Zoom is to pause the development of any new features to concentrate on safety and privacy issues, in the wake of criticism from users of the app.
In a blog, the chief executive of the video conferencing app apologized for “falling short” on security issues and promised to address concerns.
He said that the use of Zoom had soared in ways he could never have foreseen prior to the coronavirus pandemic.
One security expert said he hoped the company culture would change.
Zoom is now being used by millions of people for work and leisure, as lockdowns are imposed in many countries.
Eric Yuan spoke candidly about how “usage of Zoom ballooned overnight”.
“As of the end of December last year, the maximum number of daily meeting participants, both free and paid, was approximately 10 million. In March this year, we reached more than 200 million, he said.
He admitted that despite “working around the clock” to support the influx of new users, the service had “fallen short of the community’s — and our own — privacy and security expectations”.
“For that, I am deeply sorry,” he wrote.
“We did not design the product with the foresight that, in a matter of weeks, every person in the world would suddenly be working, studying, and socializing from home,” he wrote.
“We now have a much broader set of users who are utilizing our product in a myriad of unexpected ways presenting us with challenges we did not anticipate when the platform was conceived.”
Zoom has been criticized for a range of privacy issues, including sending user data to Facebook, wrongly claiming the app had end-to-end encryption, and allowing meeting hosts to track attendees.
Ex-NSA (National Security Agency) hacker Patrick Wardle identified a series of issues, including a flaw which left Mac users vulnerable to having webcams and microphones hijacked.
Security consultant Graham Cluley said that Zoom faced “a crisis”.
“It risked losing a large amount of goodwill it had received because of revelations about its less-than-perfect attitude towards security and privacy.”
The fact that it was addressing some of the “alarming vulnerabilities” and had recognized the need to focus on security rather than “adding bells and whistles” was good news, he said.
“Let’s hope that the company’s culture will change from its previous ‘fast and loose’ attitude when it comes to such concerns,” he added.

Zoombombing

The huge uptake of Zoom has created the new phenomenon of ‘zoombombing’ which sees uninvited guests join video conferences, usually to shout abuse, share pornography or make racist remarks.
The mischief-makers find out the details of the meetings either via links that have been shared publicly on social media platforms or websites or, in some cases, by simply guessing the nine digit ID code. It is reasonably easy to prevent attacks by password protecting meetings and not allowing anyone other than the host to screen-share.
Mr Yuan, who founded Zoom in 2011, said steps the firm had taken to address concerns included:
  • clarifying its encryption practices
  • removing code that meant information was shared from its iOS app to Facebook
  • releasing fixes for Mac-related issues
  • removing a LinkedIn feature to prevent unnecessary data disclosure
  • issuing guidelines about how to avoid becoming a victim of zoombombing
And over the next 90 days it plans to:
  • freeze development of new features to focus on safety and privacy
  • conduct a review with independent experts to understand new security features needed for new customers
  • prepare a transparency report on data requests
  • enhance its bug bounty program
  • hold a weekly webinar to provide privacy and security updates
Rik Ferguson, vice president of security research at Trend Micro, welcomed the changes.
“These issues run the full gamut: from configuration and lax default settings, software vulnerabilities, corporate policy and product roadmap decisions, and that it painfully clear from the blog post.”
“One has to feel some sympathy for an organisation that was one of the first to offer free services during the pandemic and found itself not just a victim of poor decision-making, but also a victim of its own success.”

‘High-risk’

There has been debate in the UK about whether the government should be using Zoom for cabinet meetings.
The government justified its use during “unprecedented times” when some members of the government were self-isolating and did not have access to more secure technology at home.
But the debate intensified when prime minister Boris Johnson tweeted a picture which included the ID number of the latest meeting.
It is also reported that Elon Musk has banned the use of Zoom for SpaceX meetings, citing security concerns. Nasa, which is one of Space X’s biggest customers, also prevents employees from using it.
Mr Cluley said anyone using it for sensitive conversations needed to be careful.
“Fixing these problems will take time. And those particularly high-risk users of Zoom, having highly sensitive discussions on the service, who might potentially be the target of state-sponsored attacks (for instance the UK cabinet), might be wise to find alternative, more secure methods of communication in the meantime.”

Originally published at https://www.bbc.com on April 2, 2020.

Comments

Post a Comment

Popular posts from this blog

Bogus Android Clubhouse App Drops Credential-Swiping Malware

The malicious app spreads the BlackRock malware, which steals credentials from 458 services — including Twitter, WhatsApp, Facebook and Amazon. Researchers are warning of a fake version of the popular audio chat app Clubhouse, which delivers malware that steals login credentials for more than 450 apps. Clubhouse has burst on the social media scene over the past few months, gaining hype through its audio-chat rooms where participants can discuss anything from politics to relationships. Despite being invite-only, and only being around for a year, the app is closing in on 13 million downloads . However, as of now the app is only available on Apple’s App Store mobile application marketplace — there’s no Android version yet (though plans are in the works to develop one). Cybercriminals are swooping in on Android users looking to download Clubhouse by creating their own fake Android version of the app. To add a legitimacy to the scam, the fake app is delivered from a website purporting to b...
Post a Comment
Read more

Razer has created a concept N95 mask with RGB and voice projection

  Razer claims to have made the world’s smartest mask: its new reusable N95 respirator called Project Hazel. It’s a concept design with a glossy outside shell made of waterproof and scratch-resistant recycled plastic, which is transparent to allow for lip-reading and seeing facial cues when you chat with people. Currently, there isn’t a price or release date attached. Razer refers to Project Hazel as a surgical N95, but it hasn’t yet earned any of the necessary approvals and certifications from the Food and Drug Administration, the Centers for Disease Control and Prevention, or Occupational Safety and Health Administration. In a statement to The Verge , Razer said it is working with a team of medical experts and scientists who are helping to develop the mask. The main features of this mask lie within its two circular zones that flank your mouth. They’re used for ventilation, giving the device an almost futuristic gas mask look. Razer claims Project Hazel will use active disc-type v...
Post a Comment
Read more

Hackers Compromise Mimecast Certificate For Microsoft Authentication

A sophisticated threat actor compromised a Mimecast certificate used to authenticate several of the company’s products to Microsoft 365 Exchange Web Services, Mimecast disclosed Tuesday. The Lexington, Mass.-based email security vendor said the certificate used to authenticate its Sync and Recover, Continuity Monitor and Internal Email Protect (IEP) products to Microsoft 365 has been compromised. Mimecast said it was recently informed of the compromise by Microsoft. Mimecast’s stock is down $2.40 per share (4.67 percent) to $49 per share in pre-market trading Tuesday, which is the lowest the company’s stock has traded since Dec. 15. Mimecast declined to answer questions about whether the compromise of its certificate was carried out by the same threat actor who for months injected malicious code into the SolarWinds Orion network monitoring tool. Approximately 10 percent of Mimecast’s customers use the compromised connection, according to the company. Of those that do, Mimecast said cu...
Post a Comment
Read more