Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘War Dialing’ tool exposes Zoom’s password problems

krebsonsecurity.com

Post reply on HN
Print view View original

141–150 of 247 posts

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#141

Post by teraflop »

Spooky23 wrote: post #139
cs702 wrote: post #65

One positive thing about all these horrendous security flaws that have been recently discovered in Zoom, due to its popularity, is that the company seems to be taking them seriously, recently instituting a feature freeze to focus on fixing them: https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-u... As a consequence, I suspect Zoom's security is more likely than not to improve going forward... although it wi…

I'm not a fan of Zoom... But the pile-on of grief is ridiculous. The "war dialing" issue is a great example. Webex has had the exact same "flaw" for a decade, with the exact same solution - set a meeting password. Other solutions like Google Meet or Skype have the "lobby" approach.

IMO, when it comes to security, the fact that other people have made the same mistake makes a design flaw more egregious, not less.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#142

Post by dylan604 »

jariel wrote: post #121
motohagiography wrote: post #95

This is what technical debt gets you. I really don't know that zoom has a lot or much at all, but I do know that the number of viable solutions to this could be taken off the table internally because they probably made tech debt commitments in their architecture during their scale up phase that prevents bolting on obvious fixes. I have a lot of sympathy for their position. They aren't evil or bad, but they could do a…

It's not technical debt, because it was not a problem before. More likely just a poorly designed system. Security is always a game of 'staying ahead' - with a totally new userbase context, the security parameters have changed under their feet. So now they need to quickly adapt their product to the new context. A vastly new usage context is going to create all sorts of stresses.

>It's not technical debt, because it was not a problem before.

You mean it wasn't problem before just because it wasn't being actively exploited before? A problem is a problem regardless if is as of yet undiscovered. Or do you mean it wasn't a problem because it wasn't preventing any forward progress on the product?

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#143

Post by Slartie »

bscphil wrote: post #132
cbsmith wrote: post #123

Earlier quoted context omitted.

There's a really good reason why that wouldn't work. There's no reason why a war dialer can't create millions of users. The 2-3 second delay doesn't really accomplish much unless you limit their capacity to have requests pending.

s/users/ips/

With IPv6, I can assign myself a gazillion perfectly routable unique public IPs.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#144

Post by kingludite »

diebeforei485 wrote: post #49
varelaz wrote: post #37

TLDR: With 17 digits meeting password is not needed at all. If meeting will be 17 numbers it will be the same as to protect 11 length digit number with 6 digit password. So basically that's the trade off. One could say that password is not the same as meeting ID, but usually they both sent in one email/message and lifetime and protection for them is equal. Also it's easier to input one number than 2 different.

Please don't think of this in entropy terms alone. There is a massive usability difference between the two.

Do it in base 9000 with baby names and common words. "Join us in black raven deodorant daisy mega delta leo"

Also create dud rooms with prerecorded conversation.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#145

Post by jtaft »

madeofpalk wrote: post #105
jtaft wrote: post #97

Earlier quoted context omitted.

I've been thinking about security and usability for a while. IMO a big part of use-ability issues are related to interfaces people have to interact with. This is mainly concerning authentication and crypto related processes. I generally like the idea of smartcards, or having some physical thing you carry around which is used to authenticate with systems.

Two factor auth - some physical thing you carry around with you to authenticate with systems - is the very definition of decreasing usability in order to increase security.

To clarify, do you mean usability as "how easy is it for an end user to perform X?" I feel in general, adding security to a system without security does decrease usability.

I think focusing on "relative usability" is important too. IMO it should be able to increase relative usability AND security.

For instance, I find unlocking my phone and paying with apple pay is easier to use than taking out my wallet and paying with a card. Having my credit card information encrypted on the phone makes it harder for a thief to access, when compared to gaining physical access to the credit card.

I also use a yuibkey to store cryptographic secrets. Generally I leave it plugged into my laptop, so it does not add inconvenience to me in using it. Before I had to type in a long password to decrypt my SSH key. Now it's stored on a YubiKey, protected by a shorter PIN, and requires a physical touch to perform cryptographic operations. By moving cryptographic secrets from a system with a large attack service (the laptop) to a device which requires physical access and has a smaller attack service(the yubikey), I find the system is easier to use, while increasing security.

One could argue a lack of security can lead to a decreases usability. Ex, a system under a successful DoS attack makes the system not very useable. I digress though, as I do not believe this is what you were getting at.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#146

Post by wyattpeak »

xboxnolifes wrote: post #102
crazygringo wrote: post #98

I worked in videoconferencing for a while. When it comes to meeting identifiers, striking the right balance between ease of use and security is really hard. On the one side, maximum ease-of-use is a name or code short enough for someone to say over the phone. "Here, just jump into the videoconferencing meeting 'mikefred' or 'john10' or '39584'". That works particularly well for small meetings where it's immediate obv…

What about a long, unique identifier for the baseline, and the ability to generate temporary, single (or `n`) use, short identifiers that can be used when speaking the id? Clicking a long I'd link takes practically training, and entering a short ID would only require training the salespeople how to generate one (would should only be a few clicks tops). This way, a conference is secure by default and easy for people t…

When I think about having two different solutions for two slightly different usecases, my mind always goes to Microsoft's decade-long battle to teach their users the difference between Standby and Hibernate.

There was very real value in the distinction to those who used it, but it proved so irresolvably confusing to the vast majority of users that eventually they pulled the plug and just gave the one Sleep option.

Educating users about technicalities they've probably never thought about is really hard. Doing so without an actual training session, just through interface, verges on impossible. And if Microsoft couldn't convince businesses to train their users, I doubt Zoom can.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#147

Post by RobotCaleb »

cs702 wrote: post #65

One positive thing about all these horrendous security flaws that have been recently discovered in Zoom, due to its popularity, is that the company seems to be taking them seriously, recently instituting a feature freeze to focus on fixing them: https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-u... As a consequence, I suspect Zoom's security is more likely than not to improve going forward... although it wi…

Why do people keep saying it just works? It just works if you install their app, probably. But audio doesn't work at all in Firefox. That's not really just works for me.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#148

Post by wutbrodo »

RobotCaleb wrote: post #147
cs702 wrote: post #65

One positive thing about all these horrendous security flaws that have been recently discovered in Zoom, due to its popularity, is that the company seems to be taking them seriously, recently instituting a feature freeze to focus on fixing them: https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-u... As a consequence, I suspect Zoom's security is more likely than not to improve going forward... although it wi…

Why do people keep saying it just works? It just works if you install their app, probably. But audio doesn't work at all in Firefox. That's not really just works for me.

Yea, Hangouts is a lot more "it just works" than Zoom is for me. That being said, the quality of the actual calls on Zoom is _way_ better than Hangouts.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#149

Post by devin »

RobotCaleb wrote: post #147
cs702 wrote: post #65

One positive thing about all these horrendous security flaws that have been recently discovered in Zoom, due to its popularity, is that the company seems to be taking them seriously, recently instituting a feature freeze to focus on fixing them: https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-u... As a consequence, I suspect Zoom's security is more likely than not to improve going forward... although it wi…

Why do people keep saying it just works? It just works if you install their app, probably. But audio doesn't work at all in Firefox. That's not really just works for me.

I'm not sure about "just works", but I am sure about "works" in the sense that is head and shoulders above every other video chat app I've used when it comes to audio and video quality, especially for large numbers of participants, audio sharing, document camera sharing, multiple participants sharing simultaneously, and there are plenty more.

I've never used the web version, but it wouldn't surprise me if it's not the same experience. The video and audio encoding and decoding stuff seems like it just makes more sense as a native app. Given the number of variables that browsers, versions, sandboxing, etc. bring to the equation, I can tell you where I'd spend the majority of my efforts if I were doing video chat: on a great native app. You have a lot more control over that experience, IMHO.

Anyway, your comment reads to me like someone who will never install it, but I would encourage you to at least test out the difference to see why it's become so popular.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#150

Post by dsimms »

kingludite wrote: post #144
diebeforei485 wrote: post #49

Earlier quoted context omitted.

Please don't think of this in entropy terms alone. There is a massive usability difference between the two.

Do it in base 9000 with baby names and common words. "Join us in black raven deodorant daisy mega delta leo " Also create dud rooms with prerecorded conversation.

or honeypot rooms with soft porn
Post reply on HN