Tuesday, 7 December 2021

Zoom bug allowed anyone to use a company’s custom meeting URL

NEW YORK: Cybersecurity professionals are still finding some big problems with Zoom.

Researchers at online security firm Check Point detailed their latest discovery: an exploit in Zoom which would have allowed any bad actor to use a company’s vanity URL for their own video meeting.

Here’s what this means. Basically, companies and organizations paying Zoom for video conferencing services can set up a unique vanity subdomain to brand their meetings right in the Zoom domain name. For example, a company can set up its video meetings to live on the URL https://YourCompany.zoom.us/meetingID.

This bug allowed anyone to setup their own Zoom meeting and add any subdomain registered with Zoom. Let’s say McDonald’s used a mcdonalds.zoom.us custom subdomain for its meetings. Anyone could have started their own meeting, add the “mcdonalds” subdomain to their own personal Zoom meeting link and the link would have worked. That URL would have led users who clicked it to the bad actor’s personal Zoom meeting.

Those attending the Zoom meeting could be tricked into believing they were on a conference call with the company mentioned in the subdomain. Attackers could have used this ability to pose as a company representative and social engineer real employees or customers into divulging sensitive information.

Furthermore, there was a secondary way in which this exploit could have been abused too.

Some companies with custom Zoom URLs set up branded web conference interfaces for its meeting logins. Continuing to use the example above, McDonald’s could have set up its own branded mcdonalds.zoom.us dashboard with company logo and other branding to act as a central space for its employees to login and input meeting IDs to attend.

The exploit allowed any ID meeting to be entered into a company’s branded Zoom interface, regardless of whether or not it was a meeting set up by a company employee. That means an attacker could’ve started their own meeting then direct a user to the mcdonalds.zoom.us dashboard to input the attacker’s meeting ID, and the user would have entered the attacker’s Zoom meeting.

Check Also

Porsche to set up joint venture with Customcells

© Reuters. FILE PHOTO: A Porsche Taycan electrical automobile (EV) is seen displayed throughout a ...

Leave a Reply