Zoom Security Issues

C3 - Safaricom Confidential Internal

Risk Assessment| Zoom Vulnerabilities
# RISK Brief Business Implication (s) Recommended Mitigations

1 Zoom’s app for iPhone and iPads
sends data about users’ devices to
Facebook, including people who
did not have Facebook accounts.
• “Login with Facebook” feature using • Breach of customer • update to the latest version of zoom
the Facebook SDK for iOS in order to privacy application that has been patched
provide zoom users with another
convenient access method. The
Facebook SDK was collecting
unnecessary device information
including mobile OS type and version,
device time zone, device OS, device
model and carrier, screen size,
processor cores, and disk space.

2 over 500,000 Zoom accounts are
being sold on the dark web and
hacker forums
• Compromised zoom accounts being
sold in the dark web
• Breach of customer • Zoom users to change their passwords
privacy
• Check the data breach notification site,
• Lead to more advanced https://haveibeenpwned.com/ to
attacks e.g. phishing determine whether their email addresses
have been leaked in the attack.

C3 - Safaricom Confidential Internal

Risk Assessment| Zoom Vulnerabilities
# RISK
3 Zoom-Bombing’ where hijackers
infiltrate Zoom sessions and can
send profane messages or audio
or send indecent videos
4 Zoom service does not support
end-to-end encryption for video
and audio content
Brief
• People are guessing or finding Zoom
meeting ID numbers online and
entering uninvited to leave disruptive
comments or share disruptive media
using Zoom’s screen-share feature.
Finding open meetings, which have IDs
from nine to 11 digits, is relatively simple
and has already been automated.
• Zoom does not use E2EE for video calls.
Zoom uses some encryption (known as
transport encryption) but not the more
secure end-to-end type.
Business Implication (s) Recommended Mitigations
• Poor customer • Use below recommended settings by
experience zoom
• Reputational damage • Generate random meeting IDs
• Enable the "Waiting Room" feature so that
you can see who is attempting to join the
meeting before allowing them access
• Once the meeting begins and everyone is
in, lock the meeting to outsiders
• Data Leakage
• Breach of customer
privacy
C3 - Safaricom Confidential Internal
Risk Assessment| Zoom Vulnerabilities
# RISK
5 Zoom account hijacking
6 Potential security vulnerability with
zoom file sharing
7 A version of the Zoom installer
(4.4.0.0) has been bundled with
cryptocurrency-mining malware, i.e.
a coin-miner.
Brief Business Implication (s) Recommended Mitigations
A way for anyone to easily hijack any • Fraud • Install the latest version of zoom that has this
existing Zoom account if the account email issue fixed
address was known or successfully guessed. • Breach of customer
privacy
• Vulnerability details not disclosed by • Zoom disabled the file sharing feature
zoom.
The Zoom installer will put Zoom version • Fraud • Ensure a latest Zoom client software is
4.4.0.0 on your Windows PC, but it comes installed and is obtained only from the
with a coin-miner that Trend Micro has given official zoom site
the catchy name
Trojan.Win32.MOOZ.THCCABO. The coin- • Run anti-virus on the machine to detect
miner will ramp up your PC's central malware
processor unit, and its graphics card if there
is one, to solve mathematical problems in
order to generate new units of
cryptocurrency. You'll notice this if you fans
suddenly speed up or if Windows Task
Manager (hit Ctrl + Shift + Esc) shows
unexpectedly heavy CPU/GPU use.
C3 - Safaricom Confidential Internal
Risk Assessment| Zoom Vulnerabilities
# RISK
8 UNC Path injection vulnerability that
allows windows password stealing
9 Windows malware injection.
Rationale Business Implication (s) Recommended Mitigations
If a malicious Zoom bomber slipped a UNC • Fraud • Apply latest Patch from Zoom that fixes the
path to a remote server that he controlled issue
into a Zoom meeting chat, an unwitting • Breach of privacy
participant could click on it.
• Lead to advanced
The participant's Windows computer would attacks
then try to reach out to the hacker's remote
server specified in the path and
automatically try to log into it using the user's
Windows username and password.
The hacker could capture the password
"hash" and decrypt it, giving him access to
the Zoom user's Windows account.
• a hacker can insert a UNC path to a • Fraud • Zoom disabled the file sharing feature
remote executable file into a Zoom
meeting chatroom. If a Zoom user running
Windows clicked on it the user's computer
would try to load and run the software.
C3 - Safaricom Confidential Internal
C3 - Safaricom Confidential Internal