As you may have read or seen recently, Zoom Video Conferencing has been in the news regarding security concerns over their platform as more and more businesses transition to remote work environments. Although some of these concerns have been addressed by Zoom and are currently being worked on by their developers, we have been made aware of 2 new risks that pose a serious threat to platform users.

As many businesses and consumers alike have found themselves transitioning to a socially distant environment, the use of video conferencing applications such as Zoom have skyrocketed. While many of these applications do offer a secure experience, there will always be a hacker waiting to take advantage of a loophole or error that may expose credentials, contact information, files, or other Personally Identifiable Information (PII). In this quick blog post, we are going to address two concerns related to the Zoom platform and provide a few quick tips on how to stay safe when using this, or any other type of video conferencing application.

In an article posted on ZD.net, security researchers have exposed a flaw related to sharing a URL/Link within the Zoom Chat feature that can potentially expose user credentials to devices, workstations, and network access to hackers who may be lurking in the shadows. 

The technical side of the security concern evolves around how a URL or Link is converted into a Windows Network Universal Naming Convention (UNC) path within the chat window. UNC is used to specify the location of a network resource, such as a file on a server or website, and when the link is clicked Windows then attempts to connect to the remote site or location using SMB network file-sharing protocols. By default, SMB network file-sharing protocols also send a user’s login name and credential hash when attempting to connect, and if a hacker is lurking in the background, they could potentially capture this information and use it to harvest a client’s IP address, domain name, username, host name or more. Additionally, this exploit could also be used by hackers to launch a malicious executable file, although it should be noted that Windows would likely display an alert before attempting to execute the program.

According to the ZD.net article, Zoom is aware of this security flaw and it’s developers are working to resolve it. Matthew Hickey, referenced in the article as a UK Security Researcher, suggests that the simplest solution would be for Zoom to not render UNC paths as hyperlinks within the chat window. As Zoom works to resolve this issue, we have put together a few quick tips on how to keep your chat conversations safe.

UCS Security Recommendations:

• Never click a link or URL sent inside of a chat window unless you are 100% confident that the link is secure, is coming from a trusted source, and is strictly business related.
• In most cases, hovering over any URL or Link on a site, email, or chat conversation will display the actual URL the item links to. Sometimes this is done through a simple pop-up box next to your mouse pointer, and in other cases it is displayed in the lower left hand corner of your browser tab.
• If you suspect a link/URL is suspicious, do not click! Instead, reach out to the individual in the chat conversation or email via phone call to see if they can provide you information on what the link consists of. If they are unable to do so, you can reach out to your IT or Managed Service Provider for assistance with determining whether or not the link is safe to visit.

Zoom Bombing

The second security concern that has been the focus of many news stories is a new trend called “Zoom Bombing”. In essence, bad actors, internet trolls and hackers are gaining access to and disrupting meeting and conferences by yelling obscenities, displaying inappropriate images and videos, and just generally being a nuisance. While this new trend is not necessarily harmful, it can be quite annoying, seemingly unprofessional, and certainly obnoxious.

Although Zoom has been the focus of this trend recently, the same disruptions can happen to almost any video conferencing platform. Many vendors that provide a video conferencing application provide built-in tools and features that and can be used to better secure your interactions. Let’s take a look at a few of these items:

• Never Use Your Personal Meeting ID: Regardless of the platform you choose to use, always ensure you are generating a random meeting ID as opposed to using an identifier that is linked directly back to your account. If you personal meeting ID is leaked on the web, these bad actors can and will start harassing and disrupting your calls.
• Always Use A Meeting Password: Whenever and wherever deemed appropriate, create a meeting password and share it in a separate email or other means of communication to all invitees. This particular feature should be utilized based on the type of meeting or video chat you intend to hold. If it is a public facing meeting, it may be difficult to implement a password feature. However for internal or business to business meetings, we recommend turning on the password features.
• Utilize Waiting Room Features:  If your preferred video conferencing app has a waiting room feature, use it! This is a simple way to screen attendees prior to giving them access to the call. Don’t recognize the person? Don’t let them in!
• Disable or Mute Audio and Video For Attendees: By limiting access to audio and video features to only designated users, you can prevent any inappropriate or unnecessary content from being displayed or heard on camera. Often times this is a simple toggle feature found within your meeting settings.
• Disable Screen Sharing: Before starting your meeting, be sure to get a list of all attendees who may require screen sharing capabilities. Grant access to these members only and in turn you will prevent any unwanted attendees from sharing nefarious content.

UCS Security Recommendations: 

Our security experts echo the tips and steps discussed above by authors at TechRepublic and we are available to help you understand the features and security specs of your preferred video conferencing application. Many of these features are common sense, but in times of uncertainty and a widespread increase in disruptions, we know it can be difficult to track down all the loose ends.

---

If you are attempting to use a video conferencing application like Zoom and need assistance, please give us a call so that we can ensure your meeting runs as smoothly as possible without interruption. Our technicians continue to remain available for remote support Monday through Friday from 7AM to 4PM CST.

You can reach our Help Desk at: 708.922.9444 Option 1

For existing clients, you can also send us a work ticket or email through the designated outlets and our support staff will reach out as quickly as possible.

Please continue to stay safe and smart when it comes to integrating more technology into your remote work capabilities!

---

The information provided in this blog post was sourced from articles on ZD.net and TechRepublic.com. The views and opinions expressed in those articles are in no way affiliated with Unique Computing Solutions. Unique Computing Solutions does not claim rights to or ownership of any material, logos, branding, or other copyrighted and/or proprietary information related to these two sources.