Since the onset of remote work, attackers have been seeking ways to target individuals and take advantage of vulnerabilities. With the extensive use of videoconferencing tools, such as Zoom, to facilitate the remote work environment, attackers have realized ways to gain unauthorized access and disrupt normal business activities. There have already been 2 privacy and security concerns related to Zoom:
In recent days Zoom users across the world have been experiencing incidents where uninvited individuals have joined Zoom meetings. In some cases, these individuals have disrupted classes and meetings with inappropriate behavior.
In order to mitigate these intrusions, here are steps to utilize Zoom’s security functions to secure your session.
When scheduling your meeting:
- Generate a unique meeting ID, especially for large meetings or public events
- Consider disabling public/private chats if you are hosting a large public event with external participants.
- Enable the “only authenticated users can join” feature (available under Meeting Options) for meetings intended for FIU users. If you are using Zoom within Canvas you can enable this setting via the Zoom application or the FIU Zoom Portal at Zoom.FIU.edu.
- Require a meeting password and distribute the password to only those who need access.
- Enable the waiting room feature (available under Meeting Options). This will allow the host to grant access to those participants who should be part of the meeting/class.
- Prevent removed participants from rejoining.
During your meeting:
- Remove and or manage participants.
- Lock your meetingonce all your participants have joined to avoid uninvited guests.
- Keep control of your screen. Currently this is a default setting for your FIU Zoom account, but if you need to allow someone to share their screen, you can do so by making them a co-host.
- Consider not allowing participants to change their name.
Vulnerability allowing attackers to steal Windows credentials
A vulnerability or security bug was discovered in Zoom, which allowed attackers to steal Windows credentials. Links within Zoom’s chat converted Windows networking UNC (Universal Naming Convention) paths into clickable links. If a user clicked on the link, Windows leaked the user's Windows login name and password. Although the password is not leaked in cleartext, but rather hashed, it is simple to reveal. Zoom has since fixed the issue. It is important that you update! The new version is 4.6.19253.0401. We can use this as a reminder to take precaution with links and put into practice steps on how to detect social engineering and phishing. Learn more about social engineering and phishing.