Zoom is compromised

Fri Apr 3 05:04:34 EEST 2020

Zoom has privacy and security issues, let's get that out of the way.

However, other platforms like Microsoft Teams, Cisco WebEx, Citrix
GoToMeeting, Slack, and others also have their own issues around privacy
and security. WebEx does not employ end-to-end encryption by default (and
many users don't know this). GoToMeeting has input validation and
authentication issues and doesn't have any measures to alert or prevent
others from recording sessions, among other things. Most all of them have
third-party integration or API call vulnerabilities. Another issue is that
for functionality and ease of use reasons, many of the robust privacy and
security controls in these platforms are switched off by default. There are
also issues with underlying OS issues that can be exploited through the
tools.

Shouldn't the larger and more valuable discussion be about how we focus our
efforts on making online platforms across the board more secure and privacy
respecting?

This Zoom bashing is a distraction and not constructive at all.

Regards,

Niel Harper

On Fri, Apr 3, 2020 at 10:49 AM lists at icann.guru <lists at icann.guru> wrote:

> For 95% of peoples threat models there is no actual risk here. Its
> fearmongering at its worst.
>
> *---*
> *James Gannon*
>
> On 03/04/2020 09:47:48, Michael J. Oghia <mike.oghia at gmail.com> wrote:
> Raoul, all;
>
> Here is the official response from Zoom:
> https://blog.zoom.us/wordpress/2020/04/01/facts-around-zoom-encryption-for-meetings-webinars/
>
> What do you all make of it? At the moment, I don't intend to switch
> services and hope this can help strengthen Zoom's security and transparency
> processes going forward.
>
> Stay safe and well,
> -Michael
>
>
>
> On Fri, Apr 3, 2020 at 5:14 AM Caleb Olumuyiwa Ogundele <
> muyiwacaleb at gmail.com> wrote:
>
>> Hello Dorothy and All,
>>
>> I'm a strong advocate of FOSS. However, using Linux does not always means
>> it's full proof from attacks.
>>
>> That said, on an advisory note to ICANN ORG, *SSAC* used to be at the
>> fore
>> front of these things and we have not seen them flag this yet. Are they
>> socially distancing themselves from Zoom?
>>
>> In another news, I had concerns about the report ICANN shared recently.
>> It contained information that suggests ICANN had access to some attendees
>> usage of the app. For sure I know hosts might know the programs I'm running
>> at the instance of that meeting.
>> If you read the privacy policy of zoom, it says :"*we may collect
>> Personal Data from or about you when you use or otherwise interact with our
>> Products." *
>> That also calls for concerns.
>>
>> Speaking of Linux and FOSS. Perhaps, now is the time for FOSS enthusiasts
>> to consider running all zoom meeting instances on a sandboxed VM or
>> flatpak.
>>
>> Now that we are locked in and it does not seem we have much alternative.
>> Here is a text and video guide for not so technically advanced users who do
>> not know how to use sandboxed VM or flatpak to help us at the moment
>> pending when zoom fixes it's flaws.
>>
>> https://youtu.be/JvTMA6d-LwU
>>
>> Or
>>
>>
>>
>> https://www.wordfence.com/blog/2020/04/safety-and-security-while-video-conferencing/
>>
>>
>> Caleb Ogundele
>>
>> ________________
>>
>> Sent with thumbs from a small screen mobile device.
>>
>> Pelase exsuce typos adn errosr.
>>
>> On Thu, Apr 2, 2020, 9:46 AM dorothy g <dgdorothydg at gmail.com> wrote:
>>
>>> Stick with Linux!
>>>
>>> On Thu, Apr 2, 2020 at 8:16 AM Joly MacFie <jolynyc at gmail.com> wrote:
>>>
>>>> I agree with this commenter.
>>>>
>>>> https://arstechnica.com/information-technology/2020/04/unpatched-zoom-bug-lets-attackers-steal-windows-credentials-with-no-warning/?comments=1&post=38771635#comment-38771635
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> *This is evidently a Microsoft Windows flaw.It appears to be reported
>>>> along the same lines as: the Tech Industry built insecure products, so
>>>> let's train users to not click links.Fix Windows so it doesn't send
>>>> credentials to random SMB servers on the internet that bear no relation to
>>>> the host's domain, and using an insecure protocol to boot.Sheesh!  *
>>>>
>>>> On Wed, Apr 1, 2020 at 9:35 PM Raoul Plommer <plommer at gmail.com> wrote:
>>>>
>>>>>
>>>>> https://arstechnica.com/information-technology/2020/04/unpatched-zoom-bug-lets-attackers-steal-windows-credentials-with-no-warning/
>>>>>
>>>>> This discovery was made yesterday, so it's not an April fool's day
>>>>> prank..
>>>>>
>>>>> -Raoul
>>>>>
>>>>> On Tue, 31 Mar 2020 at 17:41, Remmy Nweke <remmyn at gmail.com> wrote:
>>>>>
>>>>>> Very instructive. Thanks
>>>>>> ____
>>>>>> REMMY NWEKE, mNGE,
>>>>>> Lead Consulting Strategist/Group Executive Editor,
>>>>>> DigitalSENSE Africa Media [*Multiple-award winning medium*]
>>>>>> (DigitalSENSE Business News
>>>>>> <http://www.digitalsenseafrica.com.ng/businessnews>; ITREALMS
>>>>>> <http://www.itrealms.com.ng>, NaijaAgroNet
>>>>>> <http://www.naijaagronet.com.ng>)
>>>>>> Block F1, Shop 133 Moyosore Aboderin Plaza, Bolade Junction,
>>>>>> Oshodi-Lagos
>>>>>> M: 234-8033592762, 8023122558, 8051000475, T: @ITRealms
>>>>>> <http://www.twitter.com/ITRealms>
>>>>>> Author: A Decade of ICT Reportage in Nigeria
>>>>>> <https://www.facebook.com/adecadeofictreportageinnigeria%E2%80%8E>
>>>>>>
>>>>>> *2020 Nigeria DigitalSENSE Forum on IG4D & Nigeria IPv6 Roundtable
>>>>>> <http://www.digitalsenseafrica.com.ng>*
>>>>>> JOIN us!!
>>>>>>
>>>>>> *Vice President, African Civil Society on the Information Society
>>>>>> (ACSIS <http://www.acsis-scasi.org/en/>)
>>>>>> _________________________________________________________________
>>>>>> *Confidentiality Notice:* The information in this document and
>>>>>> attachments are confidential and may also be privileged information. It is
>>>>>> intended only for the use of the named recipient. Remmy Nweke does not
>>>>>> accept legal responsibility for the contents of this e-mail. If you are not
>>>>>> the intended recipient, please notify me immediately, then delete this
>>>>>> document and do not disclose the contents of this document to any other
>>>>>> person, nor make any copies. Violators may face court persecution.
>>>>>>
>>>>>>
>>>>>>
>>>>>> On Sat, Mar 28, 2020 at 12:03 AM Raoul Plommer <plommer at gmail.com>
>>>>>> wrote:
>>>>>>
>>>>>>>
>>>>>>> https://www.vice.com/en_us/article/k7e599/zoom-ios-app-sends-data-to-facebook-even-if-you-dont-have-a-facebook-account
>>>>>>>
>>>>>>>
>>>>>>> "The Zoom app notifies Facebook when the user opens the app, details
>>>>>>> on the user's device such as the model, the time zone and city they are
>>>>>>> connecting from, which phone carrier they are using, and a unique
>>>>>>> advertiser identifier
>>>>>>> <https://konsole.zendesk.com/hc/en-us/articles/115013349668-Identify-Android-AdIDs-Apple-IDFAs-and-Safari-IDs> created
>>>>>>> by the user's device which companies can use to target a user with
>>>>>>> advertisements
>>>>>>> <https://www.singular.net/mobile-tutorial-series-idfa-apple-identifier-advertisers/>
>>>>>>> "
>>>>>>>
>>>>>>> -Raoul
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> On Fri, 27 Mar 2020 at 17:53, Raoul Plommer <plommer at gmail.com>
>>>>>>> wrote:
>>>>>>>
>>>>>>>> FYI:
>>>>>>>>
>>>>>>>>
>>>>>>>> https://www.theguardian.com/technology/2020/mar/27/trolls-zoom-privacy-settings-covid-19-lockdown
>>>>>>>>
>>>>>>>>
>>>>>>>
>>>
>>> --
>>> Dorothy Gordon
>>>
>>

-- 
*Niel Harper*
Barbados: +(246) 424 3809
London: +44 207 193 9826
Mobile: +(246) 243 3818
Email: niel.harper at ieee.org
Website: http://nielharper.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ncsg.is/pipermail/ncsg-discuss/attachments/20200403/c4d577b3/attachment.htm>