Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘War Dialing’ tool exposes Zoom’s password problems

krebsonsecurity.com

Post reply on HN
Print view View original

181–190 of 247 posts

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#181

Post by girvo »

nicoburns wrote: post #155
devin wrote: post #149

Earlier quoted context omitted.

I'm not sure about "just works", but I am sure about "works" in the sense that is head and shoulders above every other video chat app I've used when it comes to audio and video quality, especially for large numbers of participants, audio sharing, document camera sharing, multiple participants sharing simultaneously, and there are plenty more. I've never used the web version, but it wouldn't surprise me if it's not th…

Yeah, the only other video app I've used that approaches the call quality is Slack. I've not tried to use that with more than a handful of people though.

Slack would be great if my team didn’t constantly have issues with it dropping audio or video altogether when attempting to connect, and that’s if the connection works in the first place! A shame, because we’d love to use only a single app for our comms...

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#182

Post by albertshin »

somethoughts wrote: post #140
Spooky23 wrote: post #139

Earlier quoted context omitted.

I'm not a fan of Zoom... But the pile-on of grief is ridiculous. The "war dialing" issue is a great example. Webex has had the exact same "flaw" for a decade, with the exact same solution - set a meeting password. Other solutions like Google Meet or Skype have the "lobby" approach.

Fun fact - perhaps not widely known and perhaps why it shares a similar philosophy as Webex: Zoom was founded in 2011 by Eric Yuan, a lead engineer from Cisco Systems and its collaboration business unit WebEx.[1] [1] https://en.wikipedia.org/wiki/Zoom_Video_Communications#Hist...

I've always wondered about spinoff startups like this from larger companies: aren't there usually non competes that would prevent them starting them?

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#184

Post by reggieband »

RobotCaleb wrote: post #147
cs702 wrote: post #65

One positive thing about all these horrendous security flaws that have been recently discovered in Zoom, due to its popularity, is that the company seems to be taking them seriously, recently instituting a feature freeze to focus on fixing them: https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-u... As a consequence, I suspect Zoom's security is more likely than not to improve going forward... although it wi…

Why do people keep saying it just works? It just works if you install their app, probably. But audio doesn't work at all in Firefox. That's not really just works for me.

For every N users that say something works, you will always find M users that say it doesn't. For good products the ratio of N:M (works:doesn't) is high in the direction of N (works).

So people keep saying "it just works" because Zoom has a noticeably high ratio of works compared to almost any other video conferencing software. It does not mean it works 100% of the time flawlessly for every single user ever always and forever.

FWIW, of the hundreds of Zoom calls I've had, many with non-technical people, I have yet to encounter any issues. I cannot say the same for most other video conferencing products I have used. YMMV, take with grain of salt, caveat emptor, etc.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#185

Post by reaperducer »

albertshin wrote: post #182
somethoughts wrote: post #140

Earlier quoted context omitted.

Fun fact - perhaps not widely known and perhaps why it shares a similar philosophy as Webex: Zoom was founded in 2011 by Eric Yuan, a lead engineer from Cisco Systems and its collaboration business unit WebEx.[1] [1] https://en.wikipedia.org/wiki/Zoom_Video_Communications#Hist...

I've always wondered about spinoff startups like this from larger companies: aren't there usually non competes that would prevent them starting them?

They're not usually infinite. My father waited one out for three years, then went back into the industry for a rival firm and put his old boss out of business.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#186

Post by govg »

wazanator wrote: post #175
boardwaalk wrote: post #168

Earlier quoted context omitted.

I wouldn't be shy about betting the reason they haven't done this is because they don't want the ids to be longer/have a larger character set than they have to be, because they'd take longer/be more error prone to type/say out loud. Lowest possible friction: the reason for most of their flaws thus far.

A phone number is already 10 digits. As long as you put proper break characters between the groupings it's not hard to read IMO.

They could also just generate 4 words and string them together as the password. Considerably more entropy than 10 digital and easier to communicate too.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#187

Post by cozzyd »

ehsankia wrote: post #163
Spooky23 wrote: post #139

Earlier quoted context omitted.

I'm not a fan of Zoom... But the pile-on of grief is ridiculous. The "war dialing" issue is a great example. Webex has had the exact same "flaw" for a decade, with the exact same solution - set a meeting password. Other solutions like Google Meet or Skype have the "lobby" approach.

Isn't it easily fixed by making IDs slightly higher entropy, and also rate limiting retries? Something like a Youtube ID which is 11-char in Base62, which is short enough but has so much entropy that even know with billions of videos, entering a random ID will most likely not work. You should also always have some reasonable rate limit of any sort of API query, if someone is querying rooms at 10qps or more, there's c…

Zoom meeting ids have to be enterable in the phone bridge

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#188

Post by joshspankit »

boardwaalk wrote: post #168
ehsankia wrote: post #163

Earlier quoted context omitted.

Isn't it easily fixed by making IDs slightly higher entropy, and also rate limiting retries? Something like a Youtube ID which is 11-char in Base62, which is short enough but has so much entropy that even know with billions of videos, entering a random ID will most likely not work. You should also always have some reasonable rate limit of any sort of API query, if someone is querying rooms at 10qps or more, there's c…

I wouldn't be shy about betting the reason they haven't done this is because they don't want the ids to be longer/have a larger character set than they have to be, because they'd take longer/be more error prone to type/say out loud. Lowest possible friction: the reason for most of their flaws thus far.

Agreed.

I will add: security and convenience are always polar opposites.

The most successful companies are typically the ones that can get away with being as convenient as possible for the longest.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#189

Post by hermitdev »

cs702 wrote: post #65

One positive thing about all these horrendous security flaws that have been recently discovered in Zoom, due to its popularity, is that the company seems to be taking them seriously, recently instituting a feature freeze to focus on fixing them: https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-u... As a consequence, I suspect Zoom's security is more likely than not to improve going forward... although it wi…

> Security is Capital-H Hard.

It is even harder when you try and graft the security on after the fact. Security needs to be a consideration from day 1, not once youve your minimal product. Proper security may steer architecture decisions that may be difficult or impossible which to adapt. This is especially true for internet facing services.

I had a hell of a time bolting on authentication/permission to an internal API (not web based) at a previous employer. By the time I left, we had all users authenticating, but only maybe 20% of the API surface had permissions beyond being authenticated. It was a CRUD API over +300 objects. Yeah, everything was audited, so we couls recover from a malicious or bumbling idiot authenticated user, but the exposure was way to high with people having far more access than their roles needed. It was a mess.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#190

Post by kardos »

kelnos wrote: post #118
crazygringo wrote: post #98

I worked in videoconferencing for a while. When it comes to meeting identifiers, striking the right balance between ease of use and security is really hard. On the one side, maximum ease-of-use is a name or code short enough for someone to say over the phone. "Here, just jump into the videoconferencing meeting 'mikefred' or 'john10' or '39584'". That works particularly well for small meetings where it's immediate obv…

This is a really good point, and I actually sympathize with how difficult it is for Zoom to strike the right balance here. If the only method of operation here were for people to invite others by copy/pasting a URL, and the invitees' only method of joining were to click on that link, then long UUIDs or such would be just fine. But Zoom lets you dial in audio-only from a regular phone. You simply just cannot use "long…

> Even having an 9- to 11-digit meeting code plus say a 6-digit passcode would be a burden for some people, though it's really the only way to do that portion of it right.

Strong disagree; people can handle 10-digit phone numbers, they can handle an order 10-digit meeting ID.

Post reply on HN