Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘War Dialing’ tool exposes Zoom’s password problems

krebsonsecurity.com

Post reply on HN
Print view View original

121–130 of 247 posts

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#121

Post by jariel »

motohagiography wrote: post #95

This is what technical debt gets you. I really don't know that zoom has a lot or much at all, but I do know that the number of viable solutions to this could be taken off the table internally because they probably made tech debt commitments in their architecture during their scale up phase that prevents bolting on obvious fixes. I have a lot of sympathy for their position. They aren't evil or bad, but they could do a…

It's not technical debt, because it was not a problem before.

More likely just a poorly designed system.

Security is always a game of 'staying ahead' - with a totally new userbase context, the security parameters have changed under their feet. So now they need to quickly adapt their product to the new context.

A vastly new usage context is going to create all sorts of stresses.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#122

Post by kube-system »

antoncohen wrote: post #114
dewey wrote: post #72

Earlier quoted context omitted.

An important Zoom feature is that you can dial in from a regular cell phone / landline and conference phones. That's one of the selling points of Zoom.

But when joining a Zoom call from your phone you dial a number, then enter the meeting ID. The meeting ID has the same number of digits as a US phone number, but it isn't the number you dial. The calendar invites generated by Zoom format the number + meeting ID in such as way that a user can tap them and it will dial the number and enter the meeting ID. Basically, in both cases (computer/app or dial-in), increasing t…

>Basically, in both cases (computer/app or dial-in), increasing the number of digits of the meeting ID has very little impact on the users.

It is a frequent use-case that people join meetings from devices that are not running a calendar application, or the calendar does not have the meeting invite.

For example: conference rooms.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#123

Post by cbsmith »

_red wrote: post #119
crazygringo wrote: post #98

I worked in videoconferencing for a while. When it comes to meeting identifiers, striking the right balance between ease of use and security is really hard. On the one side, maximum ease-of-use is a name or code short enough for someone to say over the phone. "Here, just jump into the videoconferencing meeting 'mikefred' or 'john10' or '39584'". That works particularly well for small meetings where it's immediate obv…

All good points. There is no reason why short meeting codes + 2-3 sec delay before joining + temporarily banning users who enter more than 10 invalid meeting codes in a row can't work. There are ways to improve the security without putting on the clients shoulders. A 6 digit room code is fine if a person can only "war dial" 10 tries before being banned for an hour or so.

There's a really good reason why that wouldn't work. There's no reason why a war dialer can't create millions of users. The 2-3 second delay doesn't really accomplish much unless you limit their capacity to have requests pending.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#124

Post by aidenn0 »

kelnos wrote: post #118
crazygringo wrote: post #98

I worked in videoconferencing for a while. When it comes to meeting identifiers, striking the right balance between ease of use and security is really hard. On the one side, maximum ease-of-use is a name or code short enough for someone to say over the phone. "Here, just jump into the videoconferencing meeting 'mikefred' or 'john10' or '39584'". That works particularly well for small meetings where it's immediate obv…

This is a really good point, and I actually sympathize with how difficult it is for Zoom to strike the right balance here. If the only method of operation here were for people to invite others by copy/pasting a URL, and the invitees' only method of joining were to click on that link, then long UUIDs or such would be just fine. But Zoom lets you dial in audio-only from a regular phone. You simply just cannot use "long…

I don't know if botnets are still a thing, but it used to be that any rate-limits needed to be multiplied by 10k for even a modest attacker, as being able to query from 10k unique nodes was a fairly trivial problem by renting a botnet.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#125

Post by aidenn0 »

jascii wrote: post #66
diebeforei485 wrote: post #49

Earlier quoted context omitted.

Please don't think of this in entropy terms alone. There is a massive usability difference between the two.

I'm not sure I understand your point. The usability of clicking a link stays equal regardless of the amount of digits in the ID. Adding a password reduces the usability.

The other day my wife got an e-vite with a link to a zoom meeting, but the e-vite software will prerender all the text to an image, so the link had to be copied in :(

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#126

Post by Nextgrid »

bobbyi_settv wrote: post #87
Nextgrid wrote: post #18

Earlier quoted context omitted.

The telephone dial-in option should've been separate - if the user chooses to enable it then they can fall back to shorter IDs, while meetings that don't need it (or where it doesn't make sense anyway - screen shares, presentations, etc) would use longer, more secure IDs.

The "just works" nature is why Zoom is popular. No one wants to have every meeting start with "Is Larry here? Oh, I think he's trying to dial in. I'm going to cancel this meeting and send out a new ID so he can dial in. Everyone watch for that so you can reconnect"

The second ID can be generated in addition to the first, primary ID.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#127

Post by Nextgrid »

azinman2 wrote: post #59
Nextgrid wrote: post #18

Earlier quoted context omitted.

The telephone dial-in option should've been separate - if the user chooses to enable it then they can fall back to shorter IDs, while meetings that don't need it (or where it doesn't make sense anyway - screen shares, presentations, etc) would use longer, more secure IDs.

which means all you gotta do is war dial the phone network...

Even if the phone dial-in ID would be enabled by default (which isn't what I am suggesting), the extra latency and cost of brute forcing them over the phone network will make these attacks much harder.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#128

Post by fock »

I think a tool which is basically yet another webchat-solution but tries too push their omnipotent app onto you, no matter what, has some issues beyond security. All the "user"-friendly execution looks like some 2002 nigerian adware. I guess userfriendly is really easy if your app can never be closed (not sure about that), can't be uninstalled and you nag the user twice to actually really start that app before allowing to use a runtime under his/her control.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#129

Post by moftz »

catalogia wrote: post #75

> "KrebsOnSecurity is not naming the companies involved" This chart suggests that one of the companies they found was an aerospace company: https://krebsonsecurity.com/wp-content/uploads/2020/04/zward... I wonder if this is related to the news yesterday that SpaceX has banned the use of Zoom.

SpaceX seems big enough that they pay for a self-hosted meeting suite. I've worked at a couple places that use WebEx that is self-hosted. You can only access it via dialing the number (from any phone) or by being on the VPN to see the shared presentation. Trying to log into the public version of WebEx gives you an unknown user error. Someone could still wardial their way into the call but it would require getting the non-public phone number and guessing the meeting number AND possibly guessing a meeting password.
Post reply on HN