Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘War Dialing’ tool exposes Zoom’s password problems

krebsonsecurity.com

Post reply on HN
Print view View original

111–120 of 247 posts

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#111

Post by gchamonlive »

david_shaw wrote: post #101
jfjrjri9nn wrote: post #86

They’re explaining how seriously they take security using Wordpress.

I know that WordPress doesn't have the greatest security record, but it seems unfair to judge an organization for using WP. Many, many respectable businesses use WordPress for their brochureware or corporate blogs. In my experience, it's not a security nightmare if it's well maintained.

Sometimes it is not just a matter of good maintenance. WP has a bad quality control for plugins and that can be catastrophic: https://wordpress.org/support/topic/amazon-cloudfront-invali...

> I have had the same issue with the plugin. This was on a simple WooCommerce site with a few thousand products. Notice it incurred over $6,000 in fees.

> Amazon CloudFront Invalidations $6,485.76 > $0.000 per URL – first 1,000 URLs / month.1,000 URL$0.00 > $0.005 per URL – over 1,000 URLs / month.1,297,151 URL$6,485.76

After a user reporting a plugin costing his business over 6000 USD, months go by without proper attention to this issue. If there was good quality control, the plugin should have been pulled. It just shows how the ecosystem is not designed with robustness and security in mind.

But I agree, WP cannot be a proxy to judge how companies treat security. This just illustrates how bad WP itself is.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#112

Post by deegles »

motohagiography wrote: post #95

This is what technical debt gets you. I really don't know that zoom has a lot or much at all, but I do know that the number of viable solutions to this could be taken off the table internally because they probably made tech debt commitments in their architecture during their scale up phase that prevents bolting on obvious fixes. I have a lot of sympathy for their position. They aren't evil or bad, but they could do a…

> This is what technical debt gets you.

Becoming one of the top names in video conferencing and displacing dozens of established players virtually overnight? Sign me up.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#113

Post by kortilla »

chefandy wrote: post #60
softwaredoug wrote: post #36

Earlier quoted context omitted.

Yeah but this time, it’s an easy as guessing a world leaders zoom meeting, and tricking them into believing something preposterous

Modern Version: "Shall we play a game?" "Love to" "‼To play Global Thermonuclear War, you must first update your flash player. Click here‼️"

Those red exclamation points have convinced me this is legitimate.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#114

Post by antoncohen »

dewey wrote: post #72
jascii wrote: post #66

Earlier quoted context omitted.

I'm not sure I understand your point. The usability of clicking a link stays equal regardless of the amount of digits in the ID. Adding a password reduces the usability.

An important Zoom feature is that you can dial in from a regular cell phone / landline and conference phones. That's one of the selling points of Zoom.

But when joining a Zoom call from your phone you dial a number, then enter the meeting ID. The meeting ID has the same number of digits as a US phone number, but it isn't the number you dial. The calendar invites generated by Zoom format the number + meeting ID in such as way that a user can tap them and it will dial the number and enter the meeting ID.

Basically, in both cases (computer/app or dial-in), increasing the number of digits of the meeting ID has very little impact on the users. Forcing a user to enter a password after joining (which is just more digits) does impact the user.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#115

Post by chrismarlow9 »

deegles wrote: post #112
motohagiography wrote: post #95

This is what technical debt gets you. I really don't know that zoom has a lot or much at all, but I do know that the number of viable solutions to this could be taken off the table internally because they probably made tech debt commitments in their architecture during their scale up phase that prevents bolting on obvious fixes. I have a lot of sympathy for their position. They aren't evil or bad, but they could do a…

> This is what technical debt gets you. Becoming one of the top names in video conferencing and displacing dozens of established players virtually overnight? Sign me up.

> Becoming one of the top names in video conferencing and displacing dozens of established players virtually overnight? Sign me up.

What!? That's small thinking. You could be so many greater things than that if you're willing to compromise peoples security and personal information.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#116

Post by softwaredoug »

motohagiography wrote: post #95

This is what technical debt gets you. I really don't know that zoom has a lot or much at all, but I do know that the number of viable solutions to this could be taken off the table internally because they probably made tech debt commitments in their architecture during their scale up phase that prevents bolting on obvious fixes. I have a lot of sympathy for their position. They aren't evil or bad, but they could do a…

I think you overestimate the reliability of the alternatives.

Zoom focused all their early engineering muscle on reliability. When we build new products, we don't have infinite resources to attack every front simultaneously. We have finite resources to prove a concept, and we incur debt in just about every other dimension.

Now that everyone is using them (precisely because of reliability) the emphasis becomes other things - UX, security, etc.

Tech debt is what the 2nd generation of engineers gets to complain about after the 1st gen made the product succesful at something.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#117

Post by pdehaan »

crazygringo wrote: post #98

I worked in videoconferencing for a while. When it comes to meeting identifiers, striking the right balance between ease of use and security is really hard. On the one side, maximum ease-of-use is a name or code short enough for someone to say over the phone. "Here, just jump into the videoconferencing meeting 'mikefred' or 'john10' or '39584'". That works particularly well for small meetings where it's immediate obv…

For the phone only route, it seems like you could still mostly automate it by going oldschool. Give the host an option to play the meeting code as a DTMF signal (or whatever) while the other person holds their phone near the mic.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#118

Post by kelnos »

crazygringo wrote: post #98

I worked in videoconferencing for a while. When it comes to meeting identifiers, striking the right balance between ease of use and security is really hard. On the one side, maximum ease-of-use is a name or code short enough for someone to say over the phone. "Here, just jump into the videoconferencing meeting 'mikefred' or 'john10' or '39584'". That works particularly well for small meetings where it's immediate obv…

This is a really good point, and I actually sympathize with how difficult it is for Zoom to strike the right balance here.

If the only method of operation here were for people to invite others by copy/pasting a URL, and the invitees' only method of joining were to click on that link, then long UUIDs or such would be just fine.

But Zoom lets you dial in audio-only from a regular phone. You simply just cannot use "long random string" as an identifier if you're expecting someone to punch it into a telephone keypad. Even having an 9- to 11-digit meeting code plus say a 6-digit passcode would be a burden for some people, though it's really the only way to do that portion of it right.

Now, one thing I do not cut Zoom any slack for is having an API where you can request validity and status of any meeting ID, without any rate limits placed on it. That's Security 101 right there.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#119

Post by _red »

crazygringo wrote: post #98

I worked in videoconferencing for a while. When it comes to meeting identifiers, striking the right balance between ease of use and security is really hard. On the one side, maximum ease-of-use is a name or code short enough for someone to say over the phone. "Here, just jump into the videoconferencing meeting 'mikefred' or 'john10' or '39584'". That works particularly well for small meetings where it's immediate obv…

All good points.

There is no reason why short meeting codes + 2-3 sec delay before joining + temporarily banning users who enter more than 10 invalid meeting codes in a row can't work.

There are ways to improve the security without putting on the clients shoulders. A 6 digit room code is fine if a person can only "war dial" 10 tries before being banned for an hour or so.

Re: ‘War Dialing’ tool exposes Zoom’s password problems

#120

Post by minitech »

madeofpalk wrote: post #105
jtaft wrote: post #97

Earlier quoted context omitted.

I've been thinking about security and usability for a while. IMO a big part of use-ability issues are related to interfaces people have to interact with. This is mainly concerning authentication and crypto related processes. I generally like the idea of smartcards, or having some physical thing you carry around which is used to authenticate with systems.

Two factor auth - some physical thing you carry around with you to authenticate with systems - is the very definition of decreasing usability in order to increase security.

I think they’re referring to passwordless login with physical keys. One unphishable factor that can’t be brute-forced or cloned and doesn’t require typing and password management.
Post reply on HN