Zoom has fixed an eavesdropping issue tied to 'waiting rooms'

It’s the latest evidence that Zoom is working to address security and privacy concerns about its video teleconferencing platform.

Earlier this week video teleconferencing company Zoom fixed an issue that would have allowed users in Zoom “waiting rooms” to spy on meetings even if they weren’t approved to attend them, according to researchers at Toronto-based Citizen Lab.

Before the fix, which was issued on Sunday, Zoom servers automatically sent live streams of meetings and meeting decryption keys to the users in the rooms, where they must wait for approval to join a meeting. This vulnerability allowed those users to eavesdrop without approval.

“Because users in a Zoom waiting room are not yet approved to join the meeting, and Zoom’s documentation appears to promote waiting rooms as a confidentiality feature, we assessed that this issue could represent a security concern,” Bill Marczak, a senior research fellow at Citizen Lab, and John Scott-Railton, a senior researcher at Citizen Lab, write in a blog post on the issue.

The vulnerability would have been particularly relevant for users concerned about the safety of their Zoom meetings. As Zoom has faced a host of other reports detailing other security and privacy issues, advocates for privacy and security have promoted the waiting room feature as a way to prevent uninvited users from barging into meetings, a practice more commonly known as “zoombombing.”

Until this week, however, even users who were not approved to join meetings could have gained access to the meeting’s AES-128 key and decrypted the meeting’s live video stream from their Internet traffic, according to Marczak and Scott-Railton.

The vulnerability would have been “relatively straightforward” for a user with “moderate technical sophistication” to exploit, so Citizen Lab held off public disclosure of the vulnerability until it was mitigated.

“Zoom quickly addressed the waiting room issue we identified, and communicated straightforwardly and professionally with us throughout the disclosure process,” Marczak and Scott-Railton write.

It’s the latest evidence that Zoom is working to address security and privacy concerns about its video teleconferencing platform as use surges around the world amid stay-at-home orders intended to fend off the spread of the novel coronavirus.

Other researchers disclosed last week that if attackers had physical access to victim devices, they could gain access to victims’ webcams and microphones via Zoom, as well as an issue where Zoom was leaking email addresses and user photos. Zoom is also now facing a class-action lawsuit over allegations it was sharing user data with Facebook in violation of California’s new privacy law.

Zoom has also paid a bug bounty to independent security researcher Youssef Abdullah, who found late last month that if attackers tried to attach a Facebook account to their Zoom account via an organization’s email address that is already in Zoom’s database, an attacker could have gained access to all email accounts associated with the account’s organization. Zoom fixed the issue early this month.

In a blog post published last week following a flurry of researchers disclosing Zoom vulnerabilities, Zoom CEO Eric S. Yuan pledged to refocus the company’s engineers on security and privacy programs, rather than usability.

“We recognize that vendors of video conferencing products need to provide friction-free, low-latency experiences for their users, or risk losing customers,” Citizen Lab’s Marczak and Scott-Railton write. “Indeed, the bug that we identified may have its origins in this same pressure: meeting video and decryption keys were provided to waiting room users, perhaps in order to make admittance to the meeting nearly instantaneous.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems