Zoom is a work-from-home privacy disaster waiting to happen

guest · May 25, 2020

India moves to ban Zoom over privacy concerns
May 25, 2020
https://mspoweruser.com/india-moves-to-ban-zoom-over-privacy-concerns/

After advising against the use of Zoom, India has moved to ban the app. A petition has been filed against Zoom noting that the lack of encryption is a violation of Information Technology Act, 2000, and Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009. The Supreme Court of India has reached out to the government for an official response on the plea filed by the petitioner.
Click to expand...

India might ban Zoom app ahead of JioMeet launch; Petition filed against Zoom in Supreme Court

Earlier, the Government of India itself said that the Zoom app was unsafe and restricted the use of the Zoom video-conferencing service among its officials. Now, the apex court is seeking the official response from the Indian government on a plea filed by the petitioner.
Zoom responds
Responding to SC seeking a reply from the government, Zoom assured the video-calling app takes user privacy, security, and trust “extremely seriously”. In the statement shared with TheWindowsClub, Zoom spokesperson said:

“We have been focused on enhancing our commitment to security and privacy under our 90-day plan announced April 1st, and have made significant progress.”
Click to expand...

Minimalist · May 26, 2020

Everyone you know uses Zoom. That wasn't the plan

The tweet was when Eric Yuan knew something had to change.
Boris Johnson, the UK prime minister, shared a photo from his first ever virtual cabinet meeting. The cybersecurity red flags jumped out immediately.
Some cabinet secretaries' Zoom screen names were visible, you could see which platform the cabinet was running its computers on, and most glaringly, the meeting ID was visible for all to see.
The significance of the moment was not lost on the team at Zoom.
"That was the big aha moment," Zoom board member Santi Subotovsky told CNN Business.
Click to expand...

https://edition.cnn.com/2020/05/21/tech/zoom-founder-eric-yuan/index.html

guest · May 29, 2020

Zoom may not work for you from May 30: Here’s all you need to know
May 29, 2020
https://siliconcanals.com/news/zoom-upgrade-may-discontinued/

The company announced that it will take concrete steps to fix current security issues with its app and enhance its security over time. In an effort to deliver on its promise, all versions lower than Zoom 5.0 will cease to work from May 30.

With the aim of enabling better security for its users, Zoom is implementing GCM or Galois/Counter Mode encryption. The new encryption protocol will enable AES 256-bit security for all accounts, which is good news for privacy-centric users.
However, there is one caveat with the new encryption in place. The encryption is being implemented only with Zoom 5.0, which was released on April 27. As a result, the company will be shuttering the older versions of its video conferencing app.
How to upgrade to Zoom 5.0
A solution to keep using Zoom is to simply upgrade to the latest version. You can head over to the Zoom web page here to download the latest version of the app.
Click to expand...

Zoom: 90-Day Security Plan Progress Report: May 27

Will there be a different version of encryption for different license types?
Only our paid users will have access to end-to-end encryption for their meetings. However, all users will use the 256-bit GCM encryption on May 30 regardless of their license type.
Click to expand...

guest · Jun 3, 2020

Zoom won’t encrypt free calls so that it can help the FBI catch intruders
June 3, 2020
https://www.digitaltrends.com/computing/zoom-free-end-to-end-encryption-law-enforcement/

Zoom won’t encrypt calls made by users on the free plan so that it can work with the FBI and local enforcement agencies to trace down repeat offenders and spammers, CEO Eric Yaun told investors on the company’s Q1 2021 earnings call. The end-to-end encryption feature, which is at the moment in beta stages, will be soon available exclusively to enterprise and paid clients.

“Free users, for sure, we don’t want to give that [end-to-end encryption]. Because we also want to work it together with FBI and local law enforcement, in case some people use Zoom for bad purposes,” added Mr. Yuan.
Most of these intruders, as one might guess, are on Zoom’s free tier and the company hopes to make it easier for law enforcement agencies to crack down on them when a host reports abuse on a call.
Click to expand...

Some facts on Zoom's current plans for E2E encryption, which are complicated by the product requirements for an enterprise conferencing product and some legitimate safety issues.
The E2E design is available here:https://t.co/beLdeAwMSM
— Alex Stamos (@alexstamos) June 3, 2020
Click to expand...

Minimalist · Jun 3, 2020

Zoom has partially fixed two new flaws, with other security hurdles ahead

Cisco Talos researchers recently uncovered two new flaws in Zoom that could allow attackers to execute arbitrary code on users’ computers, according to research published Wednesday.

Zoom has partially fixed the vulnerabilities, according to Cisco Talos. The cybersecurity company said it worked with Zoom on addressing the flaws.
Click to expand...

https://www.cyberscoop.com/zoom-flaws-cisco-talos-encryption/

guest · Jun 4, 2020

mood said: ↑

Zoom won’t encrypt free calls so that it can help the FBI catch intruders June 3, 2020
Click to expand...

Zoom's Commitment to User Security Depends on Whether you Pay It or Not
June 4, 2020
https://www.schneier.com/blog/archives/2020/06/zooms_commitmen.html

Zoom was doing so well.... And now we have this:

"Free users for sure we don't want to give that because we also want to work together with FBI, with local law enforcement in case some people use Zoom for a bad purpose," Yuan said on the call.
This is just dumb. Imagine the scene in the terrorist/drug kingpin/money launderer hideout: "I'm sorry, boss. We could have have strong encryption to secure our bad intentions from the FBI, but we can't afford the $20." This decision will only affect protesters and dissidents and human rights workers and journalists.

Here's advisor Alex Stamos doing damage control: [...]
I read that document, and it doesn't explain why end-to-end encryption is only available to paying customers. And note that Stamos said "encrypted" and not "end-to-end encrypted." He knows the difference.
Anyway, people were rightly incensed by his remarks. And yesterday, Yuan tried to clarify:

"We plan to provide end-to-end encryption to users for whom we can verify identity, thereby limiting harm to vulnerable groups," he said. [...]
Click to expand...

Notice that is specifically did not say that he was offering end-to-end encryption to users of the free platform. Only to "users we can verify identity," which I'm guessing means users that give him a credit card number.
The Twitter feed was similarly sloppily evasive: [...]

Come on, Zoom. You were doing so well. Of course you should offer premium features to paying customers, but please don't include security and privacy in those premium features. They should be available to everyone.
Click to expand...

Minimalist · Jun 9, 2020

Google Meet takes on Zoom with AI-powered noise cancellation

After years of wheel-spinning, Google is frantically trying to compete in the video messaging space, where the coronavirus pandemic has led to an explosion in demand for video conferencing. Meet's latest feature is noise cancellation for video conferencing, which can cut out a lot of the annoying background noises you would normally encounter in video calls.
Click to expand...

https://arstechnica.com/gadgets/202...s-on-zoom-with-ai-powered-noise-cancellation/

guest · Jun 11, 2020

Zoom says China demanded shutting activists' accounts over Tiananmen event
June 12, 2020
https://www.reuters.com/article/us-...s-accounts-over-tiananmen-event-idUSKBN23I3GP

Zoom Video Communications Inc (ZM.O) said on Thursday the Chinese government demanded the termination of four public meetings held on its video conferencing platform on June 4 to commemorate the 31st anniversary of China’s Tiananmen Square crackdown.

Zoom said it did not provide any user information or meeting content to the Chinese government and that it would not allow further requests from China to impact users outside the country.

“The Chinese government informed us that this activity is illegal in China and demanded that Zoom terminate the meetings and host accounts,” the company said.
The company's statement here comes after it temporarily shut three accounts, one based in Hong Kong and two in the United States, after they held the event.
Click to expand...

Zoom decided to end three of the meetings and temporarily suspend the host accounts as it is currently unable to remove specific participants from a meeting or block participants from a certain country from joining a meeting, the company said.
Click to expand...

Zoom: Improving Our Policies as We Continue to Enable Global Collaboration

We will do better as we strive to make Zoom the most secure and trusted way to bring people together.
How We Fell Short
We strive to limit actions taken to only those necessary to comply with local laws. Our response should not have impacted users outside of mainland China. We made two mistakes: [...]
Actions We’re Taking
• Going forward Zoom will not allow requests from the Chinese government to impact anyone outside of mainland China.
• Zoom is developing technology over the next several days that will enable us to remove or block at the participant level based on geography. [...]
Click to expand...

guest · Jun 12, 2020

U.S. lawmakers ask Zoom to clarify China ties after it suspends accounts
June 12, 2020
https://in.reuters.com/article/zoom...ties-after-it-suspends-accounts-idINKBN23J08S

Three U.S. lawmakers asked Zoom Video Communications Inc to clarify its data-collection practices and relationship with the Chinese government after the firm said it had suspended user accounts to meet demands from Beijing.

The California-based firm has come under heavy scrutiny after three U.S. and Hong Kong-based activists said their accounts had been suspended and meetings disrupted after they tried to hold events related to the anniversary of China’s Tiananmen Square crackdown.
Zoom said on Friday it was notified of the events and asked to take action by the Chinese government in May and early June.

“We did not provide any user information or meeting content to the Chinese government,” Zoom said in a statement. “We do not have a backdoor that allows someone to enter a meeting without being visible.”
Click to expand...

Representatives Greg Walden, the top Republican on the House Energy and Commerce Committee, and Cathy McMorris Rodgers, the ranking member of a consumer subcommittee, sent a letter to Zoom CEO Eric Yuan on Thursday asking him to clarify the company’s data practices, whether any was shared with Beijing and whether it encrypted users’ communications.
Click to expand...

Minimalist · Jun 12, 2020

Zoom apologizes for disabling US accounts commemorating Tiananmen Square anniversary

Video conferencing service Zoom has apologized for yielding to Chinese government pressure and suspending U.S.-based user accounts that commemorated the anniversary of the Tiananmen Square massacre in China.
Click to expand...

https://www.cyberscoop.com/zoom-tiananmen-square-china-censorship/

guest · Jun 17, 2020

Privacy advocates urge Zoom to encrypt free video calls
June 17, 2020
https://www.itpro.co.uk/security/cy...ozilla-urges-zoom-to-encrypt-free-video-calls

Mozilla and the Electronic Freedom Foundation (EFF) have published an open letter to Zoom that urges it to make end-to-end encryption available for all users.

The letter, addressed to Zoom CEO Eric Yuan, criticises the company’s decision to offer end-to-end encryption only to paying users.
It has been signed by 19,000 internet users and backed by tech organisations and advocacy groups including Fight for the Future and MPower Change.

“Around the world, end-to-end encryption is already an important tool for journalists and activists that are living under repressive regimes and fighting censorship,” wrote Mozilla’s Advocacy and Engagement VP Ashley Boyd and EFF’s associate director of Research Gennie Gebhart.
Click to expand...

guest · Jun 17, 2020

Zoom says it’ll provide end-to-end encryption even for free users now
June 17, 2020
https://thenextweb.com/security/202...nd-to-end-encryption-even-for-free-users-now/

After mounting pressure from privacy activists and users, Zoom said today that it’ll provide end-to-end encryption protection to everyone — including free users.

Earlier this month, the company had said that it’ll provide this feature to only paid users to comply with law enforcement and catch abusers of the service.
Zoom‘s CEO, Eric Yuan, said that the company consulted with many encryption experts and government representatives for feedback on this feature: [...]

The company said that free users will have to verify themselves with a phone number in a one-time process. It claimed that this will stop bad actors from creating multiple abusive accounts.
Click to expand...

Zoom plans to roll out an easy beta version of the end-to-end encryption feature in July.
Click to expand...

Zoom: End-to-End Encryption Update

Today, Zoom released an updated E2EE design on GitHub. We are also pleased to share that we have identified a path forward that balances the legitimate right of all users to privacy and the safety of users on our platform. This will enable us to offer E2EE as an advanced add-on feature for all of our users around the globe – free and paid – while maintaining the ability to prevent and fight abuse on our platform.
Click to expand...

guest · Jun 25, 2020

Zoom hires security executive from Salesforce as chief information security officer
June 24, 2020
https://www.cnbc.com/2020/06/24/zoo...n-lee-chief-information-security-officer.html

As Zoom approaches the end of its self-imposed 90-day period to put in place a comprehensive security and privacy policy, the company announced on Wednesday that it’s hired a head of security from Salesforce.

Jason Lee, who has spent almost three years as senior vice president of security operations at Salesforce, is joining Zoom as chief information security officer, starting June 29, the company said in a press release. Lee previously spent 15 years at Microsoft.
In early April, Yuan hired former Facebook security chief Alex Stamos as a consultant to help the company beef up its efforts, and a month later Zoom acquired start-up Keybase to add end-to-end encryption to video calls.

“Ensuring that customers trust our products is of the utmost importance and I look forward to working with the team to continue instilling security into the DNA of Zoom.”
Click to expand...

guest · Jul 1, 2020

Zoom Misses Its Own Deadline To Publish Its First Transparency Report
July 1, 2020
http://www.businessworld.in/article...-first-transparency-report/01-07-2020-293076/

Video-conferencing giant Zoom has missed its own deadline of publishing its first transparency report.

Zoom had previously stated that it would be releasing the number of government demands it has received by June 30. But now the company has said that it has missed the deadline, TechCrunch reported.
The video-conferencing giant hasn't confirmed any date as of now as to when it will publish the transparency report.

"We look forward to providing the fiscal second-quarter data in our first report later this year," the chief executive of Zoom Eric Yuan said in an official blog post.
Click to expand...

Transparency reports in general offer rare insights into the number of demands or requests a company gets from the government for user data. These reports are not mandatory but they are important to understand the scale and scope of government surveillance. (ANI)
Click to expand...

Zoom: Improving Our Policies as We Continue to Enable Global Collaboration (June 11, 2020)

Editor’s note 7/1/20: We have updated this blog post to reflect new information regarding the planned release of our Transparency Report. We have made significant progress defining the framework and approach for a transparency report that details information related to requests Zoom receives for data, records, or content. We look forward to providing the fiscal Q2 data in our first report later this year.
Click to expand...

Minimalist · Jul 9, 2020

Zero-day flaw found in Zoom for Windows 7

A previously unknown flaw in the videoconferencing software Zoom could allow a hacker to remotely commandeer computers running old versions of the Microsoft Windows operating system, security researchers said Thursday.
Click to expand...

https://www.cyberscoop.com/zoom-zero-day-windows-7-acros/

Minimalist · Jul 11, 2020

Zoom fixes zero-day RCE bug affecting Windows 7, more updates soon

The Zoom web conference Client contained a zero-day vulnerability that could have allowed attackers to execute commands on vulnerable systems remotely.

The exploitation of the vulnerability required at least some form of action on the victim's end, such as downloading and opening a malicious attachment, however, no security notifications would be triggered during exploitation.
Click to expand...

https://www.bleepingcomputer.com/ne...ce-bug-affecting-windows-7-more-updates-soon/

guest · Jul 16, 2020

Check Point Research and Zoom Collaborate to Fix ‘Vanity URL’ Issue
July 16, 2020
https://www.wallstreet-online.de/na...-and-zoom-collaborate-to-fix-vanity-url-issue

Check Point Research, the Threat Intelligence arm of Check Point Software Technologies Ltd. (NASDAQ: CHKP), recently helped to mitigate risk associated with a potential security issue in Zoom’s customizable ‘Vanity URLs’ feature that could have allowed hackers to send legitimate-looking Zoom business meeting invitations that appear as associated with a particular Zoom user with the aim of inserting malware and surreptitiously stealing data or credentials from that user.

The new potential Vanity URL security issue was found by researchers following up on the prior January collaboration. This potential security issue could have allowed a hacker to attempt to manipulate a Vanity URL (e.g., https://yourcompany.zoom.us) [...]
Click to expand...

Check Point Research: Fixing the Zoom ‘Vanity Clause’ – Check Point and Zoom collaborate to fix Vanity URL issue

Minimalist · Jul 30, 2020

Zoom security flaw meant random people could have spied on your calls

A security flaw with Zoom meant hackers could enter password-protected calls "in a matter of minutes", a researcher has revealed.

The issue stemmed from a lack of limits on the number of times a password could be attempted on private meetings.
Click to expand...

https://www.independent.co.uk/life-...zoombomb-hack-security-password-a9645431.html

guest · Aug 3, 2020

Zoom to halt direct sales of products to users in China and switch to partner-only model
Zoom has faced scrutiny from the U.S. regarding its links to China
August 3, 2020
https://www.cnbc.com/2020/08/03/zoom-to-halt-direct-sales-of-services-to-users-in-china.html

Zoom said Monday it will stop selling new or upgraded products directly to customers in mainland China, and will instead only offer its video conferencing services via third-party partners.

“Dear Customers, thank you for choosing our services. We wish to inform you that we will be selling services in Mainland China only through our partners. If you have a need for online video conferencing, you may reach out to our partners,” the company said on its Chinese website.
Zoom started notifying customers in China on Monday about the change, which will come into effect on Aug. 23, 2020, according to a letter seen by CNBC. A spokesperson confirmed the date.
“Users in Mainland China may continue to join Zoom meetings as participants,” a spokesperson for the company added.
Click to expand...

Scrutiny on China ties
Zoom is one the companies that has come under fire for its ties to China. The company admitted earlier this year that it had mistakenly routed some meetings through servers in China.

However, the company’s development team is “largely” based in China, according to Zoom’s regulatory filing from earlier this year.
Technology firms with any links to China have been in the crosshairs of lawmakers in Washington.
Click to expand...

guest · Aug 11, 2020

Researcher Demonstrates Several Zoom Vulnerabilities at DEF CON 28
August 10, 2020
https://thehackernews.com/2020/08/zoom-software-vulnerabilities.html?&

Popular video conferencing app Zoom has addressed several security vulnerabilities, two of which affect its Linux client that could have allowed an attacker with access to a compromised system to read and exfiltrate Zoom user data—and even run stealthy malware as a sub-process of a trusted application.

According to cybersecurity researcher Mazin Ahmed, who presented his findings at DEF CON 2020 yesterday, the company also left a misconfigured development instance exposed that wasn't updated since September 2019, indicating the server could be susceptible to flaws that were left unpatched.
After Ahmed privately reported the issues to Zoom in April and subsequently in July, the company issued a fix on August 3 (version 5.2.4).
Click to expand...

That's not all. In a similar vein, an attacker with access to the victim's machine can read and exfiltrate Zoom user data and configuration by navigating to the local database and even accessing chat messages stored on the system in plaintext format.

But it gets more interesting. Ahmed went on to highlight a memory leak vulnerability by exploiting the profile picture feature on Zoom to upload a malicious GIF image, download the rendered file, and extract data from it to leak portions of system memory.
Click to expand...

guest · Aug 12, 2020

The Cybersecurity 202: Zoom sued by consumer group for misrepresenting its encryption protections
August 11, 2020
https://www.washingtonpost.com/poli...p-misrepresenting-its-encryption-protections/

A consumer advocacy group is suing Zoom and seeking millions of dollars in damages, accusing the company of misleading its users about the strength of its encryption protections.
The nonprofit group Consumer Watchdog is also accusing the videoconferencing company of deceiving users about the extent of its links with China and the fact that some calls between people in North America were routed through servers in China.

Those phony claims “lull[ed] consumers and businesses into a false sense of security” and helped Zoom to soar in popularity during the early months of the pandemic, according the lawsuit, which was filed late yesterday in Washington D.C. Superior Court.
The consumer group fears that if Zoom isn't punished, other companies will be incentivized to make false claims about their security and privacy protections to attract users and stand out against competitors.
Click to expand...

The suit would cover instances where people used Zoom for social reasons or possibly for distance learning, said Ari Scharg, an attorney with Edelson PC, which is representing Consumer Watchdog in the case. It would not apply to cases in which people used the service for business reasons.
Click to expand...

Consumer Watchdog Sues Zoom on Behalf of Public for Deceiving Users About Privacy Protections

Download the lawsuit, filed in D.C. Superior Court, here: https://www.consumerwatchdog.org/sites/default/files/2020-08/Zoom%20Complaint.pdf

The importance of secure video conferencing has become particularly salient in recent months, as entire sectors of the country have shifted to a new normal, whereby conducting business transactions as well as visiting friends and family is done entirely remotely.
Click to expand...

guest · Aug 23, 2020

Zoom launches new Singapore data centre following backlash
August 21, 2020
https://www.crn.com.au/news/zoom-launches-new-singapore-data-centre-following-backlash-552117

Zoom Video Communications has opened a new data center in Singapore after the region briefly halted the use of the videoconferencing superstar for home-based education following reports that hackers were breaking in and posting obscene images.

In addition, Zoom said this year that it had mistakenly routed some video meeting traffic through servers in China, which caused backlash from several government agencies as well as other companies over fears of Chinese surveillance.
On the data center front, Zoom has taken its mainland China data centers off an approved list of backups for users outside China.
Click to expand...

hawki · Aug 24, 2020

Zoom is down for Eastern half of USA:

https://gizmodo.com/zoom-is-down-at-the-worst-possible-time-1844825643

Downdetector Map:

https://downdetector.com/status/zoom/map/

hawki · Aug 24, 2020

hawki said: ↑

Zoom is down for Eastern half of USA:
Click to expand...

Zoom also down across UK

https://9to5mac.com/2020/08/24/zoom-outage-us-uk/

hawki · Aug 24, 2020

hawki said: ↑

Zoom is down for Eastern half of USA:
Click to expand...

Zoom outage resolved.

"...After roughly four hours, the company confirmed it had resolved an issue that kept some users from being able to join Zoom meetings and webinars...

The disruption was tied to an authentication problem with the company’s website..."

https://www.washingtonpost.com/business/2020/08/24/zoom-outages-monday/

Log in or Sign up

Zoom is a work-from-home privacy disaster waiting to happen

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

hawki Registered Member

hawki Registered Member

Log in or Sign up

Zoom is a work-from-home privacy disaster waiting to happen

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

hawki Registered Member

hawki Registered Member

Useful Searches