Cyber SecurityPrivacy

Automated tool to find 100 Zoom meeting IDs per hour

0

Security researchers have developed an automated tool which can find around 100 Zoom meeting IDs in an hour and information of almost 2,400 Zoom meetings in a single day of scans.

The program known as zWarDial was developed by security professional Trent Lo and members of a security meetup group, SecKC. The program can automatically guess Zoom meeting IDs, which are nine to 11 digits long, and obtain information about those meetings.

An instance of zWarDial can also successfully determine a legitimate meeting ID 14 percent of the time. In a single day scan performed by the zWarDial including 2,400 upcoming or recurring Zoom meetings the program also extracted a meeting’s Zoom link, date and time, meeting organizer, and meeting topic.

The security researchers at Check Point Research stated in January that Zoom had applied a new feature that would block repeated attempts to scan for meeting IDs due to their own disclosure of a way to identify valid Zoom meeting IDs. zWarDial routed the searches via Tor in order to avoid the Zoom’s blocking.

But it is important to note that zWarDial is unable to find meetings which are protected by passwords. According to Zoom, passwords for news meetings have been enabled by default last year and this password protects new meetings, instant meetings, and meetings accessed by manually entering a meeting ID. So, any meeting IDs found by zWarDial suggests that many Zoom meetings still doesn’t use a password.

Zoom suggests all users to make use of a strong password for all of their meetings to make sure that an uninvited party does not join the meeting.

In order to password-protect your meetings in Zoom, go to “Meetings” tab, click the “Edit” button under your personal meeting ID, check the “Require meeting password” checkbox, and then enter a password to use for your meetings.

The number of users in Zoom have rapidly increased in view of the COVID-19 pandemic when millions of people have opted to work from home.

Remesh Ramachandran
Security Researcher & Consultant for the Government, Enthusiast, Malware Analyst, Penetration Tester He has been a successful participant in various bug bounty programs and discovered security flaws on major websites. He occasionally performs training and security assessments for various government, non-government and educational organizations.

Docker servers targeted by Kinsing malware

Previous article

Russian telco hijacks internet traffic for Google, AWS, Cloudflare, and others

Next article

You may also like

Comments

Leave a reply

Your email address will not be published. Required fields are marked *