Editor’s brief: Since COVID-19 and the global lockdown and the call to “work from home (WFH)”, business people and workers had to stay home and work, relegating face-to-face meetings with peers and clients to looking at computer and smartphone screens. Schools, colleges and kids too, had to use videoconferencing instead of attending class in classrooms. Because of the WFH paradigm, many started to use Zoom as a videoconferencing and whiteboarding tool, along with other tools such as Webex, Skype, Google Meet or MS Teams. As with any popular tool, there are always vulnerabilities. Leading cybersecurity vendor Check Point Research worked with Zoom to fix a recent “vanity URL” issue. The vendor’s news release is below.
Check Point Research and Zoom Collaborate to Fix ‘Vanity URL’ Issue
Check Point and Zoom identified an issue in Zoom’s customisable URL feature which could have potentially been exploited by hackers to manipulate meeting ID links to use for phishing purposes
SINGAPORE, @mcgallen #microwireinfo, July 17, 2020 – Check Point Research, the Threat Intelligence arm of Check Point® Software Technologies Ltd. (NASDAQ: CHKP), recently helped to mitigate risk associated with a potential security issue in Zoom’s customisable ‘Vanity URLs’ feature that could have allowed hackers to send legitimate-looking Zoom business meeting invitations that appear as associated with a particular Zoom user with the aim of inserting malware and surreptitiously stealing data or credentials from that user. Previously, Check Point Research worked with Zoom this past January to fix a different potential vulnerability that could have allowed hackers to join a meeting uninvited.
Zoom usage has exploded during the global Covid-19 lockdowns, from 10 million daily meeting participants in December 2019 to over 300 million in April 2020. Cybercriminals are using this popularity as phishing lure for Zoom and other video communication platform users. According to Check Point, Zoom-related domain registrations and fake Zoom installation programs, in particular, have been the subject of a major increase.
The new potential Vanity URL security issue was found by researchers following up on the prior January collaboration. This potential security issue could have allowed a hacker to attempt to manipulate a Vanity URL (e.g., https://yourcompany.zoom.us) in two ways:
- Targeting via direct links: when setting up a meeting, the hacker could change the invitation URL to include a registered sub-domain of their choice. In other words, if the original link was https://zoom.us/j/##########, the attacker could change it to https://<organisation’s name>.zoom.us/j/##########. Without particular cybersecurity training on how to recognise the appropriate URL, a user receiving this invitation may not recognise that the invitation was not genuine or issued from an actual or real organisation.
- Targeting dedicated Zoom web interfaces: some organisations have their own Zoom web interface for conferences. A hacker could target such an interface and attempt to redirect a user to enter a meeting ID into the malicious Vanity URL rather than the actual or genuine Zoom web interface. As with the direct links attacks, without careful cybersecurity training, a victim of such attacks may not have been able to recognise the malicious URL and have fallen prey to the attack.
Using either method a hacker could attempt to pose as an employee of a potential victim organisation via Zoom, and give the hacker a vector for stealing credentials or sensitive information.
Adi Ikan, Network Research & Protection Group Manager at Check Point said: “Because Zoom has become one of the world’s leading communication channels for businesses, governments and consumers, it’s critical that threat actors are prevented from exploiting Zoom for criminal purposes. Working together with Zoom’s security team, we have helped Zoom provide users globally with a safer, simpler and trusted communication experience so they can take full advantage of the service’s benefits.”
Check Point Research and Zoom worked together to resolve these issues. Zoom has addressed the issue and put additional safeguards in place for the protection of users.
“This was a joint-effort between Check Point and Zoom. Together, we’ve taken important steps to protect users of Zoom everywhere,” said Adi Ikan.
Read the technical details of the security issues in our research report here: https://blog.checkpoint.com/2020/07/16/fixing-the-zoom-vanity-clause-check-point-and-zoom-collaborate-to-fix-vanity-url-issue/
About Check Point Research
Check Point Research provides leading cyber threat intelligence to Check Point Software customers and the greater intelligence community. The research team collects and analyses global cyber-attack data stored on ThreatCloud to keep hackers at bay, while ensuring all Check Point products are updated with the latest protections. The research team consists of over 100 analysts and researchers cooperating with other security vendors, law enforcement and various CERTs.
Follow Check Point Research via:
- Blog: https://research.checkpoint.com/
- Twitter: https://twitter.com/_cpresearch_
- Podcast: https://research.checkpoint.com/category/cpradio/
- Facebook: https://www.facebook.com/checkpointresearch
About Check Point Software Technologies Ltd.
Check Point Software Technologies Ltd. (www.checkpoint.com) is a leading provider of cyber security solutions to governments and corporate enterprises globally. Its solutions protect customers from 5th generation cyber-attacks with an industry leading catch rate of malware, ransomware and other types of attacks. Check Point offers multilevel security architecture, “Infinity” Total Protection with Gen V advanced threat prevention, which defends enterprises’ cloud, network and mobile device held information. Check Point provides the most comprehensive and intuitive one point of control security management system. Check Point protects over 100,000 organisations of all sizes.