Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘War Dialing’ tool exposes Zoom’s password problems

krebsonsecurity.com

Post reply on HN
Print view View original

21–30 of 247 posts

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#21

Post by anamexis »

toomuchtodo wrote: post #13
umvi wrote: post #10

Earlier quoted context omitted.

Yeah but then it sucks for people calling in to have to punch in a 21+ character long meeting ID

Could you not use a telephone intent, where the meeting ID is the suffix to the dial in number with commas for any necessary pauses? Skype for business meeting invites have this. Zoom might then support inviting mobile phone conference participants using SMS, containing the link (think weak 2FA). Example: tel://18005551212,, #

That's not helpful when you have to punch it into a conference room speakerphone.

I did once put together a hack that would scrape the meeting ID from the Zoom UI and emit the touchtones from my laptop to dial in.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#22

Post by wgjordan »

NikolaeVarius wrote: post #8
devit wrote: post #5

Not a good idea to use 9 to 11 digit long IDs with no password requirement by default; they should have used at least 128-bit random ids, i.e. 21 character long base64-encoded strings.

I enjoy being able to dial meeting IDs into my phone

I would also enjoy being able to punch in '12345' as my password everywhere instead of launching LastPass all the time, but I accept that some conveniences aren't worth security consequences.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#23

Post by andor »

shiado wrote: post #14
devit wrote: post #5

Not a good idea to use 9 to 11 digit long IDs with no password requirement by default; they should have used at least 128-bit random ids, i.e. 21 character long base64-encoded strings.

It's an incredibly simple thing to screw up. I wonder where else they use low entropy random strings. I wonder if their password reset functionality can be brute forced too. Another problem is where they put rate limiting as it seems probable based on this article there are holes.

Real engineering is about compromises.

In this case, relatively short numeric meeting ids allow users to dial in via plain old phone lines. If my meeting guests had to enter a UUID via their phone keypad, they would probably skip the meeting instead.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#24

Post by toomuchtodo »

anamexis wrote: post #21
toomuchtodo wrote: post #13

Earlier quoted context omitted.

Could you not use a telephone intent, where the meeting ID is the suffix to the dial in number with commas for any necessary pauses? Skype for business meeting invites have this. Zoom might then support inviting mobile phone conference participants using SMS, containing the link (think weak 2FA). Example: tel://18005551212,, #

That's not helpful when you have to punch it into a conference room speakerphone. I did once put together a hack that would scrape the meeting ID from the Zoom UI and emit the touchtones from my laptop to dial in.

There is always a trade off between security and usability. I like your hack though, any chance you'd put it on Github?

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#26

Post by apocalyptic0n3 »

josteink wrote: post #17
umvi wrote: post #10

Earlier quoted context omitted.

Yeah but then it sucks for people calling in to have to punch in a 21+ character long meeting ID

> Yeah but then it sucks for people calling in to have to punch in a 21+ character long meeting ID I may be out of touch with the average biz-guy, but how many people are realistically calling in manually, over traditional phone-lines these days? Is it really a significant percentage?

Far greater than you would expect, I think. This is anecdotal, but we're an admittedly small company (~20-25 employees) and all of our interactions with other companies (clients) are either direct line-to-line or if we do a conference call, we all call in over the phone. Many of the companies who send us WebEx or join.me or Hangouts Meet or whatever invites only send the phone number even, not even bothering to give us a link (and if you go to the room manually in your browser, you're the only one actually connected via computer)

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#27

Post by [deleted] »

josteink wrote: post #17
umvi wrote: post #10

Earlier quoted context omitted.

Yeah but then it sucks for people calling in to have to punch in a 21+ character long meeting ID

> Yeah but then it sucks for people calling in to have to punch in a 21+ character long meeting ID I may be out of touch with the average biz-guy, but how many people are realistically calling in manually, over traditional phone-lines these days? Is it really a significant percentage?

[deleted]

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#28

Post by larrik »

josteink wrote: post #17
umvi wrote: post #10

Earlier quoted context omitted.

Yeah but then it sucks for people calling in to have to punch in a 21+ character long meeting ID

> Yeah but then it sucks for people calling in to have to punch in a 21+ character long meeting ID I may be out of touch with the average biz-guy, but how many people are realistically calling in manually, over traditional phone-lines these days? Is it really a significant percentage?

Most of my zoom meetings have at least 20% dial-ins.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#29

Post by randycupertino »

josteink wrote: post #17
umvi wrote: post #10

Earlier quoted context omitted.

Yeah but then it sucks for people calling in to have to punch in a 21+ character long meeting ID

> Yeah but then it sucks for people calling in to have to punch in a 21+ character long meeting ID I may be out of touch with the average biz-guy, but how many people are realistically calling in manually, over traditional phone-lines these days? Is it really a significant percentage?

Working in global research, 40% of our ROW (rest of world) sites and vendors use landline or cell pones to join our meetings, depends on their institutional security and IT settings.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#30

Post by diebeforei485 »

devit wrote: post #5

Not a good idea to use 9 to 11 digit long IDs with no password requirement by default; they should have used at least 128-bit random ids, i.e. 21 character long base64-encoded strings.

This is likely to support dial-in over the telephone network.

I think "no password" is the bigger issue, because repeated attempts with incorrect passwords can be rate-limited. Zoom should be generating a random 6-digit password for each meeting by default.

There may be use cases for not having any password, but that should be explicitly opt-in and have a warning message to every participant that anyone can join and broadcast in this meeting.

Post reply on HN