Hackers Are Selling a Critical Zoom Zero-Day Exploit and Over 500,000 Zoom accounts

guest · Apr 15, 2020

Hackers Are Selling a Critical Zoom Zero-Day Exploit for $500,000
...there are two Zoom zero-days, one for Windows and one for MacOS, on the market
April 15, 2020
https://www.vice.com/en_us/article/qjdqgv/hackers-selling-critical-zoom-zero-day-exploit-for-500000

Hackers are selling two critical vulnerabilities for the video conferencing software Zoom that would allow someone to hack users and spy on their calls, Motherboard has learned.

The sources have not seen the actual code for these vulnerabilities, but have been contacted by brokers offering them for sale.
Last week, Motherboard reported that there was an increased interest in zero-days for Zoom as millions of people , including employees and executives at big companies around the world, moved onto the platform for sensitive or confidential meetings, due to the coronavirus pandemic.
Click to expand...

“From what I've heard, there are two zero-day exploits in circulation for Zoom. [...] One affects OS X and the other Windows,” said Adriel Desautels, the founder of Netragard, a company that used to sell and trade zero-days. “I don't expect that these will have a particularly long shelf-life because when a zero-day gets used it gets discovered.”

“[The Windows zero-day] is nice, a clean RCE [Remote Code Execution],” said one of the sources, who is a veteran of the cybersecurity industry. “Perfect for industrial espionage.”
The MacOS bug is not an RCE, making it less dangerous and harder to use in a real hack, according to the two anonymous sources.
Click to expand...

“Zoom takes user security extremely seriously. Since learning of these rumors, we have been working around the clock with a reputable, industry-leading security firm to investigate them,” the company said in a statement. “To date, we have not found any evidence substantiating these claims.”
Click to expand...

guest · Apr 16, 2020

Over 500,000 Zoom accounts sold on hacker forums, the dark web
April 13, 2020
https://www.bleepingcomputer.com/ne...-accounts-sold-on-hacker-forums-the-dark-web/

Over 500,000 Zoom accounts are being sold on the dark web and hacker forums for less than a penny each, and in some cases, given away for free.
These credentials are gathered through credential stuffing attacks where threat actors attempt to login to Zoom using accounts leaked in older data breaches. The successful logins are then compiled into lists that are sold to other hackers.

Cybersecurity intelligence firm Cyble told BleepingComputer that around April 1st, 2020, they began to see free Zoom accounts being posted on hacker forums to gain an increased reputation in the hacker community.
Accounts sold in bulk
Cyble was able to purchase approximately 530,000 Zoom credentials for less than a penny each at $0.0020 per account.
Cyble has told BleepingComputer that these accounts include ones for well-known companies such as Chase, Citibank, educational institutions, and more.
Click to expand...

guest · Apr 28, 2020

Troves of Zoom Credentials Shared on Hacker Forums
Several new databases have been uncovered on underground forums sharing recycled Zoom credentials
April 28, 2020
https://threatpost.com/troves-of-zoom-credentials-shared-on-hacker-forums/155163/

In his investigations, he’s found troves of recycled Zoom credentials being shared, starting with 2,000 credentials a few weeks ago, and continuing to this week with the discovery of multiple databases uncovered in new, Tuesday research.
Maor’s discoveries are similar to those of other researchers, who have previously found as many as 500,000 credentials being sold (for less than a penny each) by cybercriminals.

Learn more about what Maor’s investigations into underground forums have revealed about how credentials are being uncovered, shared and leveraged to attack remote workers, in this week’s Threatpost podcast. [...]
Click to expand...

IntSights: Recycling Credentials in Four Easy Steps

IntSights researchers have obtained multiple databases, offered on several underground forums, that contain usernames and passwords to Zoom. An analysis of these databases reveals that they were created using credential stuffing attacks and old compromised databases. Here is what the attackers do: [...]

Credential stuffing attacks highlight an ongoing issue with passwords. Many people tend to find a strong password – one that contains eight or more characters and includes lowercase and uppercase letters, numbers and special symbols. The problem is it can be very challenging for users to remember many complex passwords.
When one of these websites gets hacked the criminals can attempt to access additional victims’ account in other services using the same credentials.
Click to expand...

Log in or Sign up

Hackers Are Selling a Critical Zoom Zero-Day Exploit and Over 500,000 Zoom accounts

guest Guest

guest Guest

guest Guest

Log in or Sign up

Hackers Are Selling a Critical Zoom Zero-Day Exploit and Over 500,000 Zoom accounts

guest Guest

guest Guest

guest Guest

Useful Searches