[deleted]
‘War Dialing’ tool exposes Zoom’s password problems
41–50 of 247 posts
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#42Earlier quoted context omitted.
Yeah but then it sucks for people calling in to have to punch in a 21+ character long meeting ID
> Yeah but then it sucks for people calling in to have to punch in a 21+ character long meeting ID I may be out of touch with the average biz-guy, but how many people are realistically calling in manually, over traditional phone-lines these days? Is it really a significant percentage?
I've been working home since before the lockdown in my country. Since the lockdown, the number of online meetings that I have in a day has tripled. I think in about 2-3 meetings a day I have problems with microphone/hearing, and end up dialing in from my phone. This is normally for Skype for Business meetings.
The same tends to happen with a few colleagues ... Some anecdote.
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#43Not a good idea to use 9 to 11 digit long IDs with no password requirement by default; they should have used at least 128-bit random ids, i.e. 21 character long base64-encoded strings.
It's an incredibly simple thing to screw up. I wonder where else they use low entropy random strings. I wonder if their password reset functionality can be brute forced too. Another problem is where they put rate limiting as it seems probable based on this article there are holes.
I mean, this is intentional. They even allow you to set your meeting ID to a well-known number, like your company's published phone number.
If you want to join the all-hands meetings of a company I used to work for, you only need to go their website and lookup their primary phone number. That's the Zoom meeting ID.
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#44Earlier quoted context omitted.
That's not helpful when you have to punch it into a conference room speakerphone. I did once put together a hack that would scrape the meeting ID from the Zoom UI and emit the touchtones from my laptop to dial in.
There is always a trade off between security and usability. I like your hack though, any chance you'd put it on Github?
The most secure computer is a non-networked standalone box sunk in concrete sunk hidden at the bottom of a deep sea trench. It is not, however, very usable.
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#45Earlier quoted context omitted.
It's an incredibly simple thing to screw up. I wonder where else they use low entropy random strings. I wonder if their password reset functionality can be brute forced too. Another problem is where they put rate limiting as it seems probable based on this article there are holes.
Real engineering is about compromises. In this case, relatively short numeric meeting ids allow users to dial in via plain old phone lines. If my meeting guests had to enter a UUID via their phone keypad, they would probably skip the meeting instead.
That actually makes sense I didn't know you could dial in with a phone.
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#46Earlier quoted context omitted.
> Yeah but then it sucks for people calling in to have to punch in a 21+ character long meeting ID I may be out of touch with the average biz-guy, but how many people are realistically calling in manually, over traditional phone-lines these days? Is it really a significant percentage?
Working in global research, 40% of our ROW (rest of world) sites and vendors use landline or cell pones to join our meetings, depends on their institutional security and IT settings.
Smart phones can dial a long code in software. Only dumb phones and landlines can't
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#47Earlier quoted context omitted.
> Yeah but then it sucks for people calling in to have to punch in a 21+ character long meeting ID I may be out of touch with the average biz-guy, but how many people are realistically calling in manually, over traditional phone-lines these days? Is it really a significant percentage?
Most of my zoom meetings have at least 20% dial-ins.
From landlines?
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#48Oh the number of times I've been on 20+ people Zoom meetings which were interrupted after a minute by someone asking "Hold on folks, who is the phone-user who just dialed in?" Or whenever someone connected who had the wrong nick set (happened on Linux) and hadn't turned the video on yet, which basically meant the conversation stopped until the new arrival had identified himself.
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#49TLDR: With 17 digits meeting password is not needed at all. If meeting will be 17 numbers it will be the same as to protect 11 length digit number with 6 digit password. So basically that's the trade off. One could say that password is not the same as meeting ID, but usually they both sent in one email/message and lifetime and protection for them is equal. Also it's easier to input one number than 2 different.
Please don't think of this in entropy terms alone. There is a massive usability difference between the two.
Re: ‘War Dialing’ tool exposes Zoom’s password problems
#50Earlier quoted context omitted.
Yeah but then it sucks for people calling in to have to punch in a 21+ character long meeting ID
> Yeah but then it sucks for people calling in to have to punch in a 21+ character long meeting ID I may be out of touch with the average biz-guy, but how many people are realistically calling in manually, over traditional phone-lines these days? Is it really a significant percentage?
My place of work didn't have a soft-phone connection to our computers until this COVID-19 mess started. I imagine we weren't alone.