{"id":17619,"date":"2020-04-02T10:46:44","date_gmt":"2020-04-02T14:46:44","guid":{"rendered":"https:\/\/www.elteni.com\/?p=17619"},"modified":"2020-04-02T10:46:44","modified_gmt":"2020-04-02T14:46:44","slug":"are-you-considering-fleeing-zoom-dont-be-so-quick-to-do-so","status":"publish","type":"post","link":"https:\/\/www.elteni.com\/insights\/?p=17619","title":{"rendered":"Are you considering fleeing Zoom? Don\u2019t be so quick to do so."},"content":{"rendered":"

Zoom<\/a> has been under the spotlight over the past few weeks due to privacy and security issues. They were served with a class-action lawsuit<\/a> over its data sharing practices, and come under scrutiny from the New York Attorney General\u2019s Office<\/a>.<\/p>\n

Headlines like this may make you want to \u201cZoom\u201d for the hills, but hit the pause button and take a look at the most recent issues:<\/p>\n

    \n
  1. Zoom was found to violate data sharing practices by providing information to Facebook.<\/li>\n
  2. Two zero-day vulnerabilities have been uncovered in Zoom\u2019s macOS client version, which can allow locally based<\/strong> threat actors to access your microphone and camera.<\/li>\n
  3. The Zoom Windows client is vulnerable to UNC path injection in the\u00a0client’s chat feature that could allow attackers to steal the Windows credentials of users who click on the link.<\/li>\n
  4. Zoom-bombing<\/li>\n<\/ol>\n

    Would you throw your laptop running the Microsoft operating system out the window? Would you stop using the Outlook client? Would you switch browsers and use something other than Google Chrome? Netflix too much of a privacy concern for you, or is binge watching more important? The answer for most, if not all, is No! <\/strong>Did you know that all of the vulnerabilities and data sharing practices that Zoom faces now have existed on many of the apps you use today?<\/p>\n

    Let us break down the issues identified above.<\/p>\n

    Sharing of data with Facebook<\/strong><\/p>\n

    Obviously, a violation of privacy is a paramount concern, but it seems many of the software and apps we use today share data with Facebook. Is this a good enough reason to ignore it? Probably not, but realize this, we only know what we know. There are tons of apps that are sharing our information that we are not aware of. We ignore the fine print, click a button and giveaway our personal information. Zoom is under scrutiny because of the popularity it gained over the past few months. In a few months it will be another popular app that was found to be violating our privacy.<\/p>\n

    If you are genuinely concerned about the data that Zoom is sharing with Facebook, assuming Facebook does not already have your information from another app, then maybe you can stop using it. Otherwise, it seems Zoom already made some changes to address the already late concern. If you are ok with this, then happy Zooming.<\/p>\n

    Zero-day vulnerabilities<\/strong><\/p>\n

    The zero-day vulnerabilities that were found seem to only affect the MAC<\/strong>-based client. The vulnerabilities could allow someone to gain full-privileged access to the machine or at a minimum take over the webcam and microphone in order to eavesdrop\/record meetings. Yes these are huge concerns, however, it is important to note that these vulnerabilities require a bad actor to have local access to the machine. This means they would have to be sitting in the same room as you, or they would have had to compromise access to the machine prior to exploiting the Zoom vulnerability. We do not use MACs, so this is not a concern for us. If we did, we would be concerned, so the easiest thing to do at this point is to remove the Zoom client when it is no longer needed. This reduces the exposure to this threat.<\/p>\n

    UNC Path Injection<\/strong><\/p>\n

    This vulnerability allows a bad actor to use the chat feature in the Zoom Windows client to steal Windows credentials of users. How? This is a little technical, but here we go: In the Zoom chat window you can create a clickable link that points to an SMB server (e.g. File Server). A bad actor can host this server on the internet. When someone clicks on this link, the Windows operating system attempts to connect to this server and will automatically send encrypted credentials to the server to try to connect to it. These encrypted credentials can then be cracked offline.<\/p>\n

    This issue has existed in Microsoft for a long time. This same method can be performed in Outlook clients, internet browsers, etc. \u00a0To protect against this vulnerability, you can avoid using the chat feature in the Zoom client, until Zoom produces their own fix for it. You can also block outbound SMB connections on your firewall. This may be difficult to do in Work From Home environments, so the best thing to do is if you can\u2019t avoid using the chat feature or blocking it on the firewall, avoid clicking links in the chat window.<\/strong><\/p>\n

    Another quick thought, how many people that you are inviting to your meetings are bad actors? Will your participants do such a thing?<\/p>\n

    Zoom-Bombing<\/strong><\/p>\n

    This vulnerability is not really a vulnerability. It is the user misunderstanding how to properly use Zoom. Bad actors are infiltrating Zoom sessions because the host of the meeting did not set up the meeting in a secure way. Some of the things to do to prevent against Zoom-Bombing include:<\/p>\n

      \n
    • Do not make meetings public. In Zoom, there are two options to make a meeting private: require a meeting password or use the waiting room feature and control the admittance of guests. We like the waiting room feature.<\/li>\n
    • Do not share a link to meeting publicly. Make sure meeting invites only go to the people you want in the meeting.<\/li>\n
    • Manage screensharing options. In Zoom, change screensharing to \u201cHost Only.\u201d This will prevent other participants from taking over the screen sharing feature.<\/li>\n
    • Make sure the Zoom client has been updated. Using old versions could leave someone vulnerable.<\/li>\n<\/ul>\n
      \n

      Participate in our work from home survey<\/h2>\n

      We understand you are extremely busy and probably have little time for this, but sharing your experiences will not only help others feel socially connected, it will help us all determine the major issues and allows us to solve challenges together. We fully appreciate any time you spend responding to this.<\/p>\n

      The results of this survey will be shared with all participants.<\/p>\n

      [button color=”green” size=”large” light=”no” icon=”” open_in_new_window=”yes” link=”https:\/\/us18.list-manage.com\/survey?u=b7f681478c27a5cb772d5bede&id=6601bb6239″]Take Our Survey Now[\/button]<\/p>\n

      \n

       <\/p>\n","protected":false},"excerpt":{"rendered":"

      Zoom has been under the spotlight over the past few weeks due to privacy and security issues. They were served with a class-action lawsuit over its data sharing […]<\/p>\n","protected":false},"author":2,"featured_media":17620,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[68,3,91,101,102,103,18,111,21,17,15,106,19],"tags":[],"class_list":["post-17619","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloud","category-cyber","category-exploit","category-hackers","category-hedge-fund","category-investment-adviser","category-microsoft","category-microsoft-windows-10","category-ntlm-hash","category-password","category-privacy","category-private-equity","category-vulnerability"],"yoast_head":"\nAre you considering fleeing Zoom? Don\u2019t be so quick to do so. - Insights<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.elteni.com\/insights\/?p=17619\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Are you considering fleeing Zoom? Don\u2019t be so quick to do so. - Insights\" \/>\n<meta property=\"og:description\" content=\"Zoom has been under the spotlight over the past few weeks due to privacy and security issues. They were served with a class-action lawsuit over its data sharing […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.elteni.com\/insights\/?p=17619\" \/>\n<meta property=\"og:site_name\" content=\"Insights\" \/>\n<meta property=\"article:published_time\" content=\"2020-04-02T14:46:44+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2020\/04\/elteni-zoom-vulnerability.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"600\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Elteni\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Elteni\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=17619#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=17619\"},\"author\":{\"name\":\"Elteni\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#\\\/schema\\\/person\\\/e415dfcf12d1dc9ad6eca68055c5e075\"},\"headline\":\"Are you considering fleeing Zoom? Don\u2019t be so quick to do so.\",\"datePublished\":\"2020-04-02T14:46:44+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=17619\"},\"wordCount\":1031,\"image\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=17619#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/elteni-zoom-vulnerability.png\",\"articleSection\":[\"Cloud\",\"Cyber\",\"Exploit\",\"Hackers\",\"Hedge Fund\",\"Investment Adviser\",\"Microsoft\",\"Microsoft Windows 10\",\"NTLM hash\",\"Password\",\"Privacy\",\"Private Equity\",\"Vulnerability\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=17619\",\"url\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=17619\",\"name\":\"Are you considering fleeing Zoom? Don\u2019t be so quick to do so. - Insights\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=17619#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=17619#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/elteni-zoom-vulnerability.png\",\"datePublished\":\"2020-04-02T14:46:44+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#\\\/schema\\\/person\\\/e415dfcf12d1dc9ad6eca68055c5e075\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=17619#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=17619\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=17619#primaryimage\",\"url\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/elteni-zoom-vulnerability.png\",\"contentUrl\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/elteni-zoom-vulnerability.png\",\"width\":1024,\"height\":600,\"caption\":\"Elteni Zoom Vulnerability\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=17619#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.elteni.com\\\/insights\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Are you considering fleeing Zoom? Don\u2019t be so quick to do so.\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#website\",\"url\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/\",\"name\":\"Insights\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#\\\/schema\\\/person\\\/e415dfcf12d1dc9ad6eca68055c5e075\",\"name\":\"Elteni\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=mm&r=g\",\"caption\":\"Elteni\"},\"url\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?author=2\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Are you considering fleeing Zoom? Don\u2019t be so quick to do so. - Insights","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.elteni.com\/insights\/?p=17619","og_locale":"en_US","og_type":"article","og_title":"Are you considering fleeing Zoom? Don\u2019t be so quick to do so. - Insights","og_description":"Zoom has been under the spotlight over the past few weeks due to privacy and security issues. They were served with a class-action lawsuit over its data sharing […]","og_url":"https:\/\/www.elteni.com\/insights\/?p=17619","og_site_name":"Insights","article_published_time":"2020-04-02T14:46:44+00:00","og_image":[{"width":1024,"height":600,"url":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2020\/04\/elteni-zoom-vulnerability.png","type":"image\/png"}],"author":"Elteni","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Elteni","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.elteni.com\/insights\/?p=17619#article","isPartOf":{"@id":"https:\/\/www.elteni.com\/insights\/?p=17619"},"author":{"name":"Elteni","@id":"https:\/\/www.elteni.com\/insights\/#\/schema\/person\/e415dfcf12d1dc9ad6eca68055c5e075"},"headline":"Are you considering fleeing Zoom? Don\u2019t be so quick to do so.","datePublished":"2020-04-02T14:46:44+00:00","mainEntityOfPage":{"@id":"https:\/\/www.elteni.com\/insights\/?p=17619"},"wordCount":1031,"image":{"@id":"https:\/\/www.elteni.com\/insights\/?p=17619#primaryimage"},"thumbnailUrl":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2020\/04\/elteni-zoom-vulnerability.png","articleSection":["Cloud","Cyber","Exploit","Hackers","Hedge Fund","Investment Adviser","Microsoft","Microsoft Windows 10","NTLM hash","Password","Privacy","Private Equity","Vulnerability"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.elteni.com\/insights\/?p=17619","url":"https:\/\/www.elteni.com\/insights\/?p=17619","name":"Are you considering fleeing Zoom? Don\u2019t be so quick to do so. - Insights","isPartOf":{"@id":"https:\/\/www.elteni.com\/insights\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.elteni.com\/insights\/?p=17619#primaryimage"},"image":{"@id":"https:\/\/www.elteni.com\/insights\/?p=17619#primaryimage"},"thumbnailUrl":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2020\/04\/elteni-zoom-vulnerability.png","datePublished":"2020-04-02T14:46:44+00:00","author":{"@id":"https:\/\/www.elteni.com\/insights\/#\/schema\/person\/e415dfcf12d1dc9ad6eca68055c5e075"},"breadcrumb":{"@id":"https:\/\/www.elteni.com\/insights\/?p=17619#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.elteni.com\/insights\/?p=17619"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.elteni.com\/insights\/?p=17619#primaryimage","url":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2020\/04\/elteni-zoom-vulnerability.png","contentUrl":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2020\/04\/elteni-zoom-vulnerability.png","width":1024,"height":600,"caption":"Elteni Zoom Vulnerability"},{"@type":"BreadcrumbList","@id":"https:\/\/www.elteni.com\/insights\/?p=17619#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.elteni.com\/insights"},{"@type":"ListItem","position":2,"name":"Are you considering fleeing Zoom? Don\u2019t be so quick to do so."}]},{"@type":"WebSite","@id":"https:\/\/www.elteni.com\/insights\/#website","url":"https:\/\/www.elteni.com\/insights\/","name":"Insights","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.elteni.com\/insights\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.elteni.com\/insights\/#\/schema\/person\/e415dfcf12d1dc9ad6eca68055c5e075","name":"Elteni","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=mm&r=g","caption":"Elteni"},"url":"https:\/\/www.elteni.com\/insights\/?author=2"}]}},"_links":{"self":[{"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/posts\/17619","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=17619"}],"version-history":[{"count":0,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/posts\/17619\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/media\/17620"}],"wp:attachment":[{"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17619"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17619"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17619"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}