Zoom Security Reality Check

Zoom has been in the news a lot lately. In this post, we try to put the Zoom security situation in perspective. This is a longread™ with a short section at the front for those that just want the takeaways.

Credit: The Onion

I really didn’t want to write an “I told you so” blog post, and when I started writing my instinct was that people should just use Zoom anyway. As you will see if you make it through the post, I’m a little less bullish on just using Zoom and part of the reason is the historical context.

Toward the end, I include a letter I wrote to be delivered to Zoom when they had their last major snafu (7/2019 where Apple had to patch their OS to prevent people running Zoom from being exposed). At that time the issue was egregious, but more importantly the response was lackluster and lacked understanding and conviction about how to build secure responsible software.

TL;DR - Takeaways

If you don’t really care about all of the details and background, and just want to know what to do, this section is for you. Our guidance for customers and partners is captured here.

1. You care a lot about quickly and easily starting reliable meetings
2. You use social apps all the time and don't care too much about privacy (already using Facebook, LinkedIn, WhatsApp, and/or Instagram)
3. You are not sharing data that meets one of the following criteria
   • Law enforcement
   • Trade secrets
   • Regulated data (personal health info, financial info)

Then you can probably use Zoom without worrying too much.

If the above doesn’t apply to you, you should read this post and understand what you are getting into and go into it with eyes wide open.

Note that we are using Zoom for meetings with our customers but also actively looking for alternatives. When we find one that is as stable and easy to use, we will probably shift hard. Our basic message is: it is ok to use Zoom but you should know what your risks are.

Your risks are:

• Zoom doesn’t have a great track record of proactively finding and fixing security issues, but they have closed the recently disclosed ones. It is likely there will be future security issues. This is true of most software.
• Your data probably flows through Zoom’s servers in a way that a malicious embedded 3rd party (Zoom employee, Government agent or even a contractor to Zoom) might be able to intercept that data.

If you use Zoom:

1. Ensure that you have passwords on your meetings (to prevent random people from guessing your meeting id).
2. You can require this for all users in your account. Details can be found here.
3. Don’t use your personal meeting room id for every meeting as that doesn’t change and anyone that has been to any meeting can use that URL again (if you don’t have a password / waiting room). If you have been doing this, you should consider selecting a new PMI
4. Enable the waiting room.
5. Keep track of who is in your meetings.
6. Don’t click on links in chats.
7. Consider controlling or disabling chat when appropriate. Details can be found here.

Deeper Context

With so many people working remotely, Zoom has emerged as almost critical infrastructure. Many organizations quickly adopted it as a backbone of their new communications strategy. Frankly, that’s probably because Teams, WebEx, Skype, GotoMeeting, Hangouts, UberConference and lots of other technologies just don’t work as well (in my subjective experience). Other alternatives we’ve tried include Jitsi, Whereby, BlueJeans and Lifesize but we’re still waiting for any of them to match Zoom’s call and video quality.

Zoom is on its way to being the Kleenex of Video Conferencing. We’re getting to the point where we can say “we’re going to Zoom” or “we’re going to get on a Zoom”.

As people adoption is drastically increasing, Zoom has come under closer scrutiny from a security perspective and several issues have been unearthed. Bruce Schneier wrote a good blog post about this last week. The following sections explore these issues just a little deeper, provide some additional historical context, and present a more nuanced conclusion than the one put forward in the Takeaways section above.

Zoombombing

Zoombombing is the idea that a user can guess a valid Zoom meeting id and join even though they weren’t invited. This became widely known when it happened to a few classes and the Zoombombers shared inappropriate content.

The thing is, there is inherently no great way to limit who can join without impacting useability.

There are really two levels of protection to this.

If we don’t password protect our meetings, truly random people can guess the ids and potentially join uninvited.

If we do password protect our meetings, this will usually be sufficient to prevent truly random crashers. But someone who actually received the meeting invitation could forward it to someone they want to join to disrupt or spy on a meeting. Or of course, if I hacked someone’s email account that had access to the invitation I would know the URL and password.

Note that this same approach could work with any video conferencing platform that is configured the way Zoom is. Teams is only “more secure” than Zoom if all of the participants are authenticated to Microsoft and invited - which is not strictly required. If I have the link to a meeting, I can potentially join.

Zoom quickly introduced the idea of a Waiting Room, which allows the host to screen attendees before admitting them to the meeting - effectively preventing this sort of Zoombombing.

What you should do to prevent Zoombombing:

1. Set meeting passwords
2. Use the waiting room for guests (users that aren’t invited and authenticated to Zoom)
3. Monitor who is in the meeting

Privacy and Selling Personal Data

There were several privacy related fiascos with Zoom that have mostly been addressed with updates. Doc Searls Blog covers these in detail. Here was his original conclusion:

What Zoom’s current privacy policy says is worse than “You don’t have any privacy here.” It says, “We expose your virtual necks to data vampires who can do what they will with it.”

These “lapses” included using a Facebook SDK and thereby sharing user data with Facebook.
In addition to the issues, a look at Zoom’s privacy policy on selling of data prior to the increased scrutiny indicates a cavalier attitude towards such an important issue. The first sentence that section reading Depends what you mean by “sell.”.

There were also data mining features based on an integration with LinkedIn Sales Navigator that automatically grabbed data from LinkedIn for integration into Zoom meetings, e.g. for “Icebreakers”.

There is extensive ad network tracking embedded in Zoom and it is unclear if Zoom actually sells customer data that it gathers. Because many people use a desktop application for Zoom and not a browser, it is trickier to identify these trackers than it might otherwise be.

Zoom did not disclose many of these in their privacy policy until it came under fire for lax security and privacy. Much of the feedback to Zoom has been that they should remove the tracking software and just sell their excellent service. As is true with many online services, users cannot be expected to understand the implications of using the service.

End to End Encryption

In a system with End To End Encryption, such as Signal or FaceTime, a message between two users is encrypted completely throughout the system in such a way that only the two end users can see the messages.

If Bob and Alice are communicating, when Bob sends Alice a message, the underlying technology between Bob’s phone or laptop and Alice’s phone or laptop can’t see the content of the message.

End To End Encryption has a specific meaning. Zoom flaunted this by saying that they employed End To End Encryption when in fact they only support transport level encryption. What does this mean? Simply put, Bob’s message to Alice could be readable on intermediate servers relaying the messages within the Zoom infrastructure. They were protecting it from external eavesdroppers, but had full access to it themselves.

We note that Zoom appears to be built on top of AWS:

$ dig zoom.us

;; ANSWER SECTION:
zoom.us. 19 IN A 52.202.62.250

$ dig -x 52.202.62.250

;; ANSWER SECTION:
250.62.202.52.in-addr.arpa. 112 IN PTR ec2-52-202-62-250.compute-1.amazonaws.com.

That suggests that the streams of data flowing through Zoom’s servers in AWS might be exposed to:

• Zoom employees
• AWS employees
• Contractors working for either Zoom or AWS
• Probably contractors working for contractors working for contractors working for Zoom or AWS

Nearly every company we work with has this type of exposure, but it is important to understand that Zoom overpromised here in a way that certainly appears sleazy after the fact.

Also note that typical channels such as phone lines, email and other mediums suffer from this very same potential issue. End To End Encryption is hard enough to implement that we would guess that very few systems that we use on a day to day basis actually implement it.

Windows Credential Stealing

There was a legitimate windows credential stealing bug in Zoom written about by Ars Technica. This points back to a careless approach to security in general. In a more security conscious organization, someone would have reviewed this code, conducted an ethical hacking exercise or through some other means identified that this “feature” could be a problem.

The reason this should give us pause is that Zoom has had this happen before.

An Old Email To Try To Help Zoom

Last year, Zoom had an egregious security issue that signaled to me (and anyone paying attention) that their security was either not empowered or not paying attention. Here’s what I said to someone that said they could pass it on to Zoom.

Here’s the kicker for those that couldn’t read through that:

It’s because the information around this issue suggests that there could likely be more issues that we just don’t know about yet..

Security Sayings

There are some common security sayings that apply here.

There is always a risk calculation.

Any time we use any system, we make decisions that impact privacy and the security of our personal data. I don’t use FaceBook, WhatsApp or Instagram. I prefer services that have better privacy rules.

Most people maybe don’t know the difference, don’t care, or decide that the tradeoff is worth it. It is funny to see a lot of people worry about Zoom while they use other insecure social, file sharing, conferencing and other solutions without realizing these are all part of a risk analysis. Whatever risk analysis we do against Zoom, we need to do the same against any alternative we propose to be making a rational decision.

Note that even phones have inherent risks. It’s just that we believe the threat actors in that case are contained to law enforcement. Whether that is truly the case or not is a whole other question. A guy on my team just told me he could tap my phone in 10 minutes from a spot down the street.

Nothing is 100% secure.

The existence of a security issue is not necessarily the most important part of a security story. The company’s response probably is. I’m just waiting for similar stories about other platforms to emerge. As you can see, there is some history here with Zoom as well, including some underwhelming responses to different issues.

We talked about End To End Encryption a bit. The ironic thing is if you need that, you probably need to be using something like Signal that won’t exist in the US if laws pass (eg. EARN IT Act of 2020 restricting the use of strong encryption like that. Here is Signal’s blog post about it.

CISOs don’t sleep at night.

That’s because they know that everything is broken, underfunded and not well understood. They live in fear of having a breach that is inevitable given the investment in security. One funny side effect of this Zoom story is that maybe CISOs will sleep better. After all, Zoom’s new hired gun, the former CISO at FaceBook and Yahoo!, obviously wasn’t negatively impacted by the breaches those companies suffered.

Conclusion

If you’re looking for really secure conferencing software, I wouldn’t trust Zoom. Not because of a current actual security issue, but because their historical stance has been so dang reactive.

Unfortunately, with experience as a security pro, I would bet that many of Zoom’s competitors have similar issues when you look under the microscope - so I wouldn’t trust most of them to be what we need them to be.

If you are willing to live with your data going places that it probably already does (eg. Google, FaceBook and that ecosystem), you believe Zoom has turned the corner about security, and you really want a reliable usable conferencing service, Zoom is unfortunately still head and shoulders above its competitors in terms of usability.

We are actively looking for alternatives that have a track record of being proactive about security and privacy, because that is important to us.

References

• Zoombombing
• Waiting Room
• Zoom Set a Meeting Password
• Bruce Schneier on Zoom Security
• Zoom To Steal Windows Credentials
• Zoom Oversharing LinkedIn
• Zoom Encryption Exposed
• Doc Searls Blog: Zoom Privacy Discussions
• Signal
• Web Server on Mac OS Issue
• Zoom Defending Web Server
• Older Zoom Issue