New flaw in Zoom allows fraudsters to breach into networks
By MYBRANDBOOK
The latest Zoom flaw could have allowed attackers to mimic an organization, tricking its employees or business partners into revealing personal or other confidential information using social engineering tricks. In a report shared, researchers at cybersecurity firm CheckPoint disclosed details of a minor but easy-to-exploit flaw they reported in Zoom, the highly popular and widely used video conferencing software.
We know, social engineering attacks may sound a bit boring, but someone used the same to put Twitter on fire just last night when hundreds of high-profile Twitter accounts were hacked to promote a cryptocurrency scam, all thanks to an employee's compromised internal tooling account.
The said vulnerability resides in Zoom's customizable URL feature dubbed Vanity URL, aiming to let companies create a custom URL on its subdomain and branded landing page.
Cyber security team found that due to improper account validation, any meeting ID could have been launched using any organization's Vanity URL, even if a meeting was set up by a separate individual account.
"The security issue is focused on the sub-domain functionalities," the researchers said. "There are several ways to enter a meeting containing a sub-domain, including using a direct sub-domain link containing the meeting ID, or using the organization's customized sub-domain web UI."
Attackers can exploit this loophole in two ways:
Attack via direct links: A hacker can change the invitation URL, when setting up a meeting. A user receiving this invitation link may fall under the attacker's trap, thinking that the invitation was genuine and issued from a real organization.
Attacking dedicated Zoom web interfaces: Since some organizations have their Zoom web interface for conference calls, a hacker could also target such an interface and attempt to redirect a user to enter a meeting ID into the malicious Vanity URL rather than the actual Zoom web interface and join the relevant Zoom session.
The impact of this issue can lead to a successful phishing attempt, allowing the attackers to pose as a legit employee of the company, which potentially enables them to steal credentials and sensitive information and carry out other fraud actions.
Cyber Security researchers responsibly disclosed the issue to Zoom Video Communications Inc. and worked together to address it and put additional safeguards in place for the protection of users.
"Because Zoom has become one of the world's leading communication channels for businesses, governments and consumers, it's critical that threat actors are prevented from exploiting Zoom for criminal purposes," Adi Ikan, Group Manager at Check Point Research, told the press.
"Working together with Zoom's security team, we have helped Zoom provide users globally with a safer, simpler and trusted communication experience so they can take full advantage of the service's benefits."
Earlier this year, the Security Research team also worked with Zoom to patch a severe privacy bug that could have allowed uninvited people to join private meetings and remotely eavesdrop on private audio, video, and documents shared throughout the session.
Due to the ongoing coronavirus outbreak, the usage of Zoom video conferencing software has skyrocketed from 10 million daily meeting participants back in December 2019 to more than 300 million in April 2020, making it a favourite target of cybercriminals.
Just last week, Zoom patched a zero-day vulnerability in all supported versions of the Zoom client for Windows that could have allowed an attacker to execute arbitrary code on a victim's computer running Microsoft Windows 7 or older.
Last month, Zoom addressed two critical security vulnerabilities in its video conferencing software for Windows, macOS, or Linux computers that could have allowed attackers to hack into the systems of group chat participants or an individual recipient remotely.
In April, a series of issues were uncovered and reported in Zoom, which raised privacy and security concerns surrounding the video conferencing software among millions of its users.
The latest version of X helps prevent deepfakes on social medi
To combat deepfakes and shallowfakes, Elon Musk revealed a new update t...
India and Namibia collaborate on a payment system similar to U
Once operational, the platform will enable digital transactions in Namibia,...
Sebi issues show-cause notices to six Adani group firms
Sebi issued show-cause notices to six Adani Group firms, including Adani ...
Microsoft to build a new data centre to support Thailand's tec
Microsoft has revealed intentions to construct a regional data centre as w...
RAMCO SYSTEMS Ltd.
AMARA RAJA POWER SYSTEMS LTD.
HAVELLS INDIA LTD.
SECUREYE SERVICES PVT. LTD.
Technology Icons Of India 2023: Sandip Patel
Sandip Patel is the Managing Director, IBM India/South Asia. He is res...
Technology Icons Of India 2023: B.V.R. Subrahmanyam
B.V.R. Subrahmanyam belongs to Andhra Pradesh. He is a 1987-batch IAS ...
Technology Icons Of India 2023: Anil Kumar Aggarwal
Anil Agarwal is an Indian billionaire businessman who is the founder a...
GSTN aims to integrate indirect tax ecosystem on a shared IT infrastructure
Goods and Services Tax Network (GSTN) has built Indirect Taxation plat...
INDIANOIL helps reach precious petroleum fuels to every nook and corner of the country
IndianOil, a diversified, integrated energy major with presence in alm...
BSE provides highly secure, efficient and transparent market for trading
BSE (formerly known as Bombay Stock Exchange Ltd.) is Asia's first & t...
TECH DATA, A TD SYNNEX COMPANY
Tech Data Corporation was an American multinational distribution compa...
INGRAM MICRO INDIA PVT. LTD.
Ingram Micro India, a large national distributor offers a comprehensiv...
NETPOLEON SOLUTIONS
Netpoleon Group is a Value-Added Distributor (VAD) of Network Security...