Today on Zoom: ’Not suited for secrets’, encryption issues and more
- apr
- 03
- Posted by Michael
- Posted in Okategoriserade
More Zoom issues and vulnerabilities have come to light.
What you need to know
- More concerning security issues have been found within popular video-conferencing app Zoom.
- They include an encryption vulnerability, servers in China, and an automated tool that can find 100 Zoom meeting IDs an hour.
- Zoom has already publicly apologized for previous issues, vowing to freeze new features for 90 days whilst it issues fixes.
Two separate reports have revealed further issues within popular video-conferencing app Zoom.
First up, a report from The Verge notes that a security professional has used an automated tool that can scour meetings to find ones that are not protected by passwords. Apparently, it was able to find 2,400 calls in a single day, extracting a link to meeting, date, time, organizer and meeting topic information. From the report:
Security professional Trent Lo and members of SecKC, a Kansas City-based security meetup group, made a program called zWarDial that can automatically guess Zoom meeting IDs, which are nine to 11 digits long, and glean information about those meetings, according to the report.
In addition to being able to find around 100 meetings per hour, one instance of zWarDial can successfully determine a legitimate meeting ID 14 percent of the time, Lo told Krebs on Security. And as part of the nearly 2,400 upcoming or recurring Zoom meetings zWarDial found in a single day of scanning, the program extracted a meeting's Zoom link, date and time, meeting organizer, and meeting topic, according to data Lo shared with Krebs on Security.
Automated Zoom conference meeting finder 'zWarDial' discovers ~100 meetings per hour that aren't protected by passwords. The tool also has prompted Zoom to investigate whether its password-by-default approach might be malfunctioning https://t.co/dXNq6KUYb3 pic.twitter.com/h0vB1Cp9Tb
— briankrebs (@briankrebs) April 2, 2020
In a statement to The Verge regarding this issue Zoom said:
"Zoom strongly encourages users to implement passwords for all of their meetings to ensure uninvited users are not able to join... Passwords for new meetings have been enabled by default since late last year, unless account owners or admins opted out. We are looking into unique edge cases to determine whether, under certain circumstances, users unaffiliated with an account owner or administrator may not have had passwords switched on by default at the time that change was made."
A second separate report from The Intercept published today claims that Zoom's encryption algorithm has "serious, well-known weaknesses" and that keys are being issued by servers sometimes based in China, even if all the participants are based in the US.
MEETINGS ON ZOOM, the increasingly popular video conferencing service, are encrypted using an algorithm with serious, well-known weaknesses, and sometimes using keys issued by servers in China, even when meeting participants are all in North America, according to researchers at the University of Toronto.
The researchers also found that Zoom protects video and audio content using a home-grown encryption scheme, that there is a vulnerability in Zoom's "waiting room" feature, and that Zoom appears to have at least 700 employees in China spread across three subsidiaries. They conclude, in a report for the university's Citizen Lab — widely followed in information security circles — that Zoom's service is "not suited for secrets" and that it may be legally obligated to disclose encryption keys to Chinese authorities and "responsive to pressure" from them.
Zoom has not commented further on this issue, which was also reported by Forbes who note:
"...in an interview published on Forbes on Friday, Chief Executive Eric Yuan said the company was going to check on how it was routing conversations to China, but emphasized the data was protected. As Citizen Lab hadn't sent its findings to Zoom, saying it was in the public interest to release the information as soon as possible, the videoconferencing company wouldn't have been aware of the findings. But Yuan assured that if user data was being transferred to China when users weren't even based there, "we are willing to address that."
Security concerns regarding Zoom are now seemingly well noted in the community. The encouraging sign is that Zoom has taken notice, apologized and vowed to fix all of these issues over the next 90 days, freezing new features in the meantime.
Senaste inläggen
- The Apple silicon end-game comes into focus with iOS 18 AI features set to be powered by data centers full of Apple’s chips, just not the ones you’d expect
- If you want to edit out photobombers you need this iPhone app
- Logitech announces M4 iPad Pro and M2 iPad Air keyboard and trackpad accessories, undercutting Apple’s $299 Magic Keyboard
- What is Zenless Zone Zero, the spiritual successor to Genshin Impact, and why have 15 million people wishlisted it?
- WhatsApp users are getting a revamped iPhone app with an updated color palette, a cleaner way to add attachments, and more
Senaste kommentarer
Arkiv
- maj 2024
- april 2024
- mars 2024
- februari 2024
- januari 2024
- december 2023
- november 2023
- oktober 2023
- september 2023
- augusti 2023
- juli 2023
- juni 2023
- maj 2023
- april 2023
- mars 2023
- februari 2023
- januari 2023
- december 2022
- november 2022
- oktober 2022
- september 2022
- augusti 2022
- juli 2022
- juni 2022
- maj 2022
- april 2022
- mars 2022
- februari 2022
- april 2021
- mars 2021
- januari 2021
- december 2020
- november 2020
- oktober 2020
- september 2020
- augusti 2020
- juli 2020
- juni 2020
- maj 2020
- april 2020
- mars 2020
- februari 2020
- januari 2020
- december 2019
- november 2019
- oktober 2019
- september 2019
- augusti 2019
- juli 2019
- juni 2019
- maj 2019
- april 2019
- mars 2019
- februari 2019
- januari 2019
- december 2018
- november 2018
- oktober 2018
- september 2018
- augusti 2018
- juli 2018
- juni 2018
- maj 2018
- april 2018
- mars 2018
- februari 2018
- januari 2018
- december 2017
- november 2017
- oktober 2017
- september 2017
- augusti 2017
- juli 2017
- juni 2017
- maj 2017
- april 2017
- mars 2017
- februari 2017
- januari 2017
- december 2016
- november 2016
- oktober 2016
- september 2016
- augusti 2016
- juli 2016
- juni 2016
- maj 2016
- april 2016
- mars 2016
- februari 2016
- januari 2016
- december 2015
- november 2015
- oktober 2015
- september 2015
- augusti 2015
- juli 2015
- juni 2015
- maj 2015
- april 2015
- mars 2015
- februari 2015
- januari 2015
- december 2014
- november 2014
- oktober 2014
- september 2014
- augusti 2014
- juli 2014
- juni 2014
- maj 2014
- april 2014
- mars 2014
- februari 2014
- januari 2014
Kategorier
- –> Publicera på PFA löp
- (PRODUCT) RED
- 2015
- 25PP
- 2nd gen
- 32gb
- 3D Touch
- 3D-kamera
- 4k
- 64gb
- 9to5mac
- A10
- A9X
- Aaron Sorkin
- Accessories
- adapter
- AirPlay
- AirPods
- Aktiv
- Aktivitetsarmband
- Aktuellt
- Alfred
- AMOLED
- Android Wear
- Angela Ahrendts
- Ångerätt
- announcements
- Ansiktsigenkänning
- app
- App Store
- Appar
- Apple
- Apple Beta Software Program
- Apple Book
- Apple CarPlay
- Apple Event
- Apple iMac
- Apple Mac Mini
- Apple Macbook
- Apple MacBook Air
- Apple MacBook Pro
- Apple Macos
- Apple Maps
- Apple Music
- Apple Music Festival
- Apple Music Radio
- Apple Offer
- Apple Online Store
- Apple Park
- Apple Pay
- Apple Pencil
- Apple Podcast
- Apple Store
- Apple Store 3.3
- Apple TV
- apple tv 4
- Apple TV 4K
- Apple Watch
- Apple Watch 2
- Apple Watch 8
- Apple Watch 9
- Apple Watch Apps
- Apple Watch SE
- Apple Watch Series 2
- Apple Watch Sport
- Apple Watch Ultra
- AppleCare
- AppleTV
- Application
- Applications
- Apps
- AppStore
- Apptillägg
- Apptips
- AppTV
- April
- Arbetsminne
- armband
- Art Apps
- Återköp
- återvinning
- Åtgärdsalternativ
- atvflash
- Audio Apps
- Augmented REality
- Back-to-school
- Bakgrundsbilder
- BankId
- Barn
- Batteri
- batteriskal
- batteritid
- Beats
- Beats 1
- Beats Solo 2 Wireless
- Beats Solo2
- Bebis
- Beginner Tips
- Belkin
- Bendgate
- beta
- Beta 3
- betaversion
- betaversioner
- bilddagboken.se
- bilder
- bilhållare
- billboard
- Bioteknik
- Blendtec
- Bloomberg
- Bloons TD 5
- Bluelounge
- Bluetooth
- Böj
- Booking.com
- Borderlinx
- bose
- bugg
- Buggar
- Buggfixar
- Butik
- C More
- Calc 2M
- Camera
- Campus 2
- Canal Digital
- Carpool Karaoke
- Caseual
- Catalyst
- CES 2015
- Chassit
- Chip
- Chrome Remote Desktop
- Chromecast
- citrix
- clic 360
- CNBC
- Connect
- Cydia
- Dagens app
- Dagens tips
- Damm
- Danny Boyle
- Data
- datamängd
- Datorer
- Datortillbehör
- Datum
- Defense
- Dekaler
- Designed by Apple in California
- Developer
- Development
- Digital Inn
- Digital Touch
- Digitalbox
- DigiTimes
- Direkt
- Discover
- display
- DisplayMate
- Dive
- Docka
- Dräger 3000
- Dropbox
- Droples
- DxOMark
- E-post
- earpod
- EarPods
- Earth Day
- Eddie Cue
- eddy cue
- Educational Apps
- Ekonomi
- Ekonomi/Bransch
- El Capitan
- Elements
- ElevationLab
- Elgato Eve
- Elgato Eve Energy
- EM 2016
- Emoji
- emojis
- emoticons
- Enligt
- EU
- event
- Eventrykten
- EverythingApplePro
- Faceshift
- facetime
- Fäste
- Featured
- Features
- Feng
- Film / Tv-serier
- Filmer
- Filstorlek
- Finance Apps
- Finder For AirPods
- Finland
- FireCore
- Fitbit
- Fitness Accessories
- Fjärrstyr
- Flurry
- Födelsedag
- fodral
- Förboka
- Force Touch
- förhandsboka
- Första intryck
- Forumtipset
- foto
- FoU (Forskning och Utveckling)
- Fource Touch
- Foxconn
- FPS Games
- Framtid
- Fre Power
- Frontpage
- Fullt
- Fuse Chicken
- Fyra
- Gadgets
- Gagatsvart
- Gamereactor
- Games
- Gaming
- Gaming Chairs
- Gästkrönika
- General
- Gigaset
- Gitarr
- Glas
- GM
- Google Maps
- Google Now
- gratis
- grattis
- Guide
- Guider
- Guider & listor
- Guld
- hack
- Halebop
- hållare
- Hälsa
- Hårdvara
- HBO
- HBO Nordic
- Health
- Health and Fitness
- Health and Fitness Apps
- Hej Siri
- Helvetica Neue
- Hemelektronik
- Hemknapp
- Hemlarm
- Hermes
- Hitta min iphone
- Hjärta
- högtalare
- HomeKit
- HomePod
- hörlurar
- htc
- Hue
- Humor
- i
- I Am A Witness
- IBM
- iBolt
- iBomber
- iBook
- icar
- iCloud
- iCloud Drive
- iCloud Voicemail
- iCloud.com
- iDevices
- IDG Play
- idownloadblog
- iFixit
- ikea
- iKörkort
- iLife
- Illusion Labs
- iMac
- IMAP
- iMessage
- iMessages
- iMore Show
- Incipio
- InFuse
- Inspelning
- Instagram-flöde
- Instrument
- Intel
- Internet/Webbtjänster
- iOS
- iOS 10
- iOS 12
- iOS 17
- iOS 18
- iOS 5
- iOS 7
- iOS 8
- iOS 8 beta
- iOS 8.1.3
- iOS 8.2
- iOS 8.3
- iOS 8.4
- iOS 8.4.1
- iOS 9
- iOS 9 beta 4
- iOS 9.1
- iOS 9.1 beta 2
- iOS 9.2
- iOS 9.2.1
- iOS 9.3
- IOS Games
- ios uppdatering
- ios9
- iPad
- iPad Accessories
- iPad Air
- iPad Air 2
- iPad Air 3
- iPad Apps
- iPad Mini
- iPad mini 4
- iPad Mini 6
- iPad mini retina
- iPad Pro
- iPados
- iphone
- iPhone 12
- iPhone 14
- iPhone 14 Pro
- iPhone 15
- iPhone 16
- iPhone 17
- iPhone 5
- iPhone 5S
- iPhone 5se
- iPhone 6
- iphone 6 plus
- iPhone 6c
- iPhone 6s
- iPhone 6S plus
- iPhone 7
- iPhone 7 display
- iPhone 7 Plus
- iPhone 7s
- iPhone Accessories
- iPhone Apps
- iPhone SE
- iphone x
- iPhone XS
- iPhone XS Max
- iPhone7
- iPhoneGuiden
- iPhoneguiden.se
- iPhones
- iPod
- iPod Nano
- iPod shuffle
- ipod touch
- iSight
- iTunes
- iWatch
- iWork
- iWork för iCloud beta
- Jailbreak
- James Corden
- Jämförande test
- Jämförelse
- Jet Black
- Jet White
- Jönssonligan
- Jony Ive
- Juice Pack
- Juridik
- Just mobile
- kalender
- kalkylator
- Kamera
- Kameratest
- Karriär/Utbildning
- Kartor
- Kevin Hart
- keynote
- Keynote 2016
- KGI
- KGI Security
- Kina
- Klassiskt läderspänne
- Kod
- Kollage
- koncept
- konceptbilder
- köpguide
- krasch
- Krascha iPhone
- Krönika
- Kvartalsrapport
- Laddhållare
- laddningsdocka
- Laddunderlägg
- läderloop
- lagar
- Lagring
- Lajka
- Länder
- lansering
- laserfokus
- Layout
- leather loop
- LG
- Liam
- Lifeproof
- Lightnigport
- lightning
- Linux
- LinX
- live
- Live GIF
- Live Photos
- Live-event
- Livsstil
- Ljud & Bild
- Logitech
- LOL
- Lösenkod
- Lösenkodlås
- Lovande spel
- LTE
- Luxe Edition
- M3
- M3TV
- Mac
- Mac App Store
- Mac Apps
- Mac Mini
- Mac OS
- Mac OS X
- Mac OS X (generellt)
- Mac OS X Snow Leopard
- Mac Pro
- Macbook
- Macbook Air
- Macbook Pro
- Macforum
- Macintosh
- macOS
- Macs
- MacWorld
- Made for Apple Watch
- magi
- Magic
- MagSafe
- Martin Hajek
- matematik
- Meddelanden
- Media Markt
- Medieproduktion
- Mediocre
- Messaging Apps
- Messenger
- MetaWatch
- Mfi
- Michael Fassbender
- microsoft
- Mikrofon
- Minecraft
- Ming-Chi Kuo
- miniräknare
- minne
- Mixer
- Mixning
- Mjukvara
- mobbning
- Mobile Content
- Mobilt
- Mobilt/Handdator/Laptop
- Mobiltelefon
- Mockup
- Mophie
- mors dag
- moto 360
- Motor
- MTV VMA
- multitasking
- Music
- Music Apps
- Music, Movies and TV
- Musik
- Musikmemon
- MW Expo 2008
- native union
- Nätverk
- Navigation Apps
- nedgradera
- Netatmo Welcome
- Netflix
- Netgear Arlo
- News
- Niantic
- Nike
- Nikkei
- Nintendo
- Nöje
- Norge
- Notis
- Notiscenter
- nya färger
- Nyfödd
- Nyheter
- Officeprogram
- Okategoriserade
- OLED
- omdöme
- Omsättning
- OS X
- OS X El Capitan
- OS X Mavericks
- OS X Yosemite
- Outlook
- Övrig mjukvara
- Övrigt
- PanGu
- papper
- patent
- PC
- pebble
- Pebble Smartwatch
- Pebble Steel
- Pebble Time
- Pebble Time Steel
- Persondatorer
- Petter Hegevall
- PewDiePie
- Philips
- Philips Hue
- Phones
- Photoshop
- Planet of the apps
- Plex
- Pluggar
- Plus
- Plusbox
- Podcast
- Podcast Apps
- Pokemon
- Pokemon Go
- Policy
- Porträttläge
- PP
- Pris
- priser
- problem
- Problems
- Productivity Apps
- Program
- Prylar & tillbehör
- Publik
- publik beta
- QuickTime
- räkenskapsår
- räkna
- ram
- RAM-minne
- Rapport/Undersökning/Trend
- Rea
- Reading Apps
- recension
- Red
- reklaamfilm
- reklam
- reklamfilm
- reklamfilmer
- rekord
- Rendering
- reparation
- Reportage
- Reptest
- ResearchKit
- Retro
- Review
- Ring
- Ringa
- Rocket Cars
- Rosa
- Rumors
- Rumours
- RunKeeper
- rykte
- Rykten
- Safir
- Säkerhet
- Säkerhetsbrist
- Samhälle/Politik
- samsung
- Samtal
- San Francisco
- SAP
- security
- Series 2
- Servrar
- Shigeru Miyamoto
- Sia
- Siri
- SJ Min resa
- skal
- Skal iPhone 6
- skal iPhone 6s
- skärm
- SKärmdump
- Skärmglas
- Skribent
- skribenter medarbetare
- Skriva ut
- skruvmejsel
- skydd
- Skyddsfilm
- Skype
- slice intelligence
- Smart
- smart hem
- Smart Home
- Smart Keyboard
- Smart klocka
- Smart Lights
- smartphone
- Smartwatch
- Snabbt
- Snapchat
- Social Apps
- Software
- Solo2
- sommar
- Sonos
- Sony
- soundtouch
- Space Marshals
- spår
- Speakers
- Special Event
- Spel
- Spelkonsol
- Spellistor
- Split Screen
- Split View
- Sport
- Sportband
- Sports Apps
- spotify
- Spring forward
- Statistik
- Steve Jobs
- Stickers
- Stockholm
- Stor iPhone
- Storlek
- Story Mode
- Strategy Games
- streama
- Streaming
- stresstest
- Ström
- Studentrabatt
- stylus
- Super Mario Run
- support
- Surf
- Surfplatta
- svenska
- sverige
- Sverigelansering
- Switch
- Systemstatus
- Systemutveckling
- tåg
- Taig
- Tangentbord
- Taptic Engine
- Tårta
- tät
- Tävling
- Taylor Swift
- Teknik
- tele 2
- Telefoner
- Telekom
- Telia
- Test
- Tid
- TikTok
- Tile
- tillbehör
- Tim Cook
- TIME
- TimeStand
- Tiny Umbrella
- Tips
- Toppnyhet IDG.se
- Touch ID
- TouchID
- tower defence
- trådlös laddning
- Trådlösa hörlurar
- trådlöst
- trailer
- Travel Apps
- Tre
- TrendForce
- TripAdvisor
- Trolleri
- trump
- TSMC
- Tum
- tv
- tvätta
- tvOS
- tvOS 9.2
- tvOS beta 2
- Tweak
- Typsnitt
- Ubytesprogram
- UE MegaBoom
- Unboxing
- Underhållning/Spel
- unidays
- United Daily News
- Unix
- Updates
- Uppdatera
- uppdatering
- Upplösning
- upptäckt
- USA
- Ut på Twitter
- utbyte
- utbytesprogram
- Utilities Apps
- Utlottning
- utrymme
- utvecklare
- varumärke
- Vatten
- Vattentålig
- vattentät
- vävt nylon
- Verktyg
- Viaplay
- Vibrator
- video
- Videoartiklar och webb-tv (M3/TW/CS)
- Villkor
- viloknapp
- Virtual Reality
- Virus
- visa
- Vision Pro
- VLC
- Volvo on call
- W1
- Waitrose
- Watch OS
- WatchOS
- WatchOS 2
- watchOS 2.0.1
- watchOS 2.2
- Webbtv (AppTV)
- wi-fi
- Wifi-samtal
- Windows
- Windows 8
- WWDC
- WWDC2015
- yalu
- Youtube
- Zlatan