Home > News

Security Researchers Develop Tool that Harvests Zoom Meeting Info

By Simon Batt
Zoom Wardial Featured

In light of the recent coronavirus pandemic, many people have been forced to work at home. When it comes to interpersonal meetings, companies had to find a solution that would allow them to teleconference for cheap. Zoom was one solution that was adopted and recommended the world over, to the point where Zoom is being used for both business and education.

Unfortunately, Zoom isn’t very secure. Security researchers proved this by developing a tool that can harvest information from Zoom meetings.

What Does the Tool Do?

When someone creates a new Zoom meeting, it’s given a unique ID. The host can then share this ID with the people they want to create a meeting with. Attendees then enter the ID on their side to enter the room.

Security researchers developed zWarDial, a tool that scans these IDs for information. The tool managed to find a legitimate meeting ID 14 percent of the time, which is pretty impressive given how Zoom IDs are between nine and eleven digits long.

The tool found around 100 meetings per hour that didn’t have a password lock on them. From these meetings, the tool could glean information about them. This information includes who started the meeting and what the topic of the meeting was.

Why Is this Bad?

This flaw is bad for two reasons: Zoom-bombing and espionage.

Zoom-bombing is when an individual or a group raids an open Zoom meeting. Zoom-bombers often yell obscene comments at the attendees and show offensive images via Zoom’s screen-share feature.

Zoom Wardial Hacker

Because this tool specifically finds meetings that have no password on them, Zoom-bombers can take the ID from the tool and use it to invade the meeting without being stopped.

Not everyone is concerned with causing trouble, however. By using the host details and meeting topic, malicious agents can glean information leaks from the company hosting the meeting. If the agent wanted to know more, they could try sneaking into the unprotected meeting to get more information.

Adding Security to Meetings

Fortunately, the tool was created by a security researcher called Trent Lo. As such, while this flaw is quite scary, it was discovered by someone who wants to show and alert others to the problem, rather than benefit from it.

Lo went on to say that, because the tool could only glean information from non-password-protected meetings, the best way to defeat the attack was to put a password on every Zoom teleconference. This stopped zWarDial from grabbing details.

In response to the development of zWarDial, Zoom said the following:

Zoom strongly encourages users to implement passwords for all of their meetings to ensure uninvited users are not able to join.

“Passwords for new meetings have been enabled by default since late last year, unless account owners or admins opted out. We are looking into unique edge cases to determine whether, under certain circumstances, users unaffiliated with an account owner or administrator may not have had passwords switched on by default at the time that change was made.

As such, even if it’s convenient to share a meeting link with no password, always set one to avoid people invading your teleconference.

Keeping Safe on Zoom

Zoom has exploded in popularity after the coronavirus outbreak, but its security has much to be desired. This is proven by zWarDial, a tool created by researchers that can harvest information from unprotected meeting rooms. By setting a password, you can protect your own meetings from this attack. Alternatively, you can make use of other video conferencing tools with better security.

Subscribe to our newsletter!

Our latest tutorials delivered straight to your inbox

Simon Batt Avatar
Simon Batt
Simon Batt is a Computer Science graduate with a passion for cybersecurity.

Read next

When the SS Great Eastern laid the first working transatlantic telegraph cable in 1866, a message that had taken ten days by steamship suddenly crossed the ocean in minutes, and the financial markets of London and New York were forced, within a single trading week, to invent the modern concept of synchronised global price.
From below of blue starry sky over radio telescope and trees with leaves
The Big Ear telescope was scanning at 1420.4056 megahertz on the night of 15 August 1977, the exact frequency at which hydrogen atoms vibrate across the universe, because Giuseppe Cocconi and Philip Morrison had argued years earlier that any species trying to be found would broadcast on that channel — and then, for 72 seconds, something did.
In 2016, archaeologists dated two rings of snapped stalagmites in France’s Bruniquel Cave to 176,500 years ago, evidence that Neanderthals had walked 336 metres into darkness with fire and built architecture deep underground long before modern humans reached Europe
Otto von Bismarck was 74 when Germany adopted the world’s first national old-age social insurance program in 1889, setting the pension age at 70 after years of fighting socialists with bans, laws, and a promise few workers would live long enough to use
When cosmonaut Valeri Polyakov stepped out of his Soyuz capsule in March 1995 after 437 consecutive days aboard Mir, doctors recorded him at several centimetres above his pre-flight height, and his spine had become so unaccustomed to gravity that the recovery team carried him to a chair rather than risk the compression of letting him walk.
When Bell Labs engineer Karl Jansky pointed a rotating antenna at the sky in 1932 looking for sources of transatlantic radio static, he kept picking up a faint hiss that peaked every 23 hours and 56 minutes, and he eventually realized he had become the first human to hear the center of the Milky Way.
A contemplative scene with two scientists in a vintage laboratory setting.
When Harvard astronomer Cecilia Payne submitted her 1925 doctoral thesis arguing that the Sun was made almost entirely of hydrogen, the field’s senior figure Henry Norris Russell talked her into adding a line calling the result ‘almost certainly not real,’ and then published the same conclusion himself four years later to widespread acclaim.
When seismic waves from the Chicxulub impact reached what is now North Dakota roughly ten minutes after the asteroid struck, they appear to have triggered a ten-metre standing wave in an inland river that flung fish onto the bank and buried them under glass beads still falling from the sky.