Zoom security bug lets attackers steal Windows passwords

Zoom , the videoconferencing software that’s skyrocketed in popularity as much of the globe sits at home due to the  coronavirus outbreak , is quickly turning into a privacy and security nightmare.

BleepingComputer  reports about a newly found vulnerability in Zoom that allows an attacker to steal Windows login credentials from other users. The problem lies with the way Zoom’s chat handles links, as it converts Windows networking UNC (Universal Naming Convention) paths into clickable links. If a user clicks on such a link, Windows will leak the user’s Windows login name and password.

The good thing is that the password is hashed; but the bad thing is that it is in many cases simple to reveal it using password recovery tools such as Hashcat.

The vulnerability was first found by security researcher  @_g0dmode  and verified by security researcher  Matthew Hickey. Additionally, Hickey told the news outlet that this vulnerability can be used to launch programs on a victim’s computer when they click on a link, though Windows will (by default) at least give a security warning before launching the program.

As far as security vulnerabilities go, this one is pretty bad, as it doesn’t require a lot of knowledge to exploit. It does require the victim to actually click on a link, and it can be mitigated by tinkering with Windows’ security settings, but it’s definitely something Zoom should fix by changing the way the platform’s chat handles UNC links.

In the meantime, for a quick fix, go to Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers and set to “Deny all”.

Mashable has contacted Zoom for comment on this story, and we’ll update it when we hear back.

This is not the only privacy/security-related issue that has been unearthed at Zoom in the past couple of weeks. Just yesterday, The Intercept  reported  that Zoom doesn’t actually use an end-to-end encrypted connection for its calls, despite claiming to do so. There’s also the  issue  of leaking users’ emails and photos to unrelated parties, and the fact that the company’s iOS app, until recently,  sent data to Facebook  for no good reason.

Zoom software also has a couple of  worrying  privacy features, and although this isn’t Zoom’s fault, it’s worth noting that  hackers  are using the app’s newfound popularity to trick users into downloading malware.

CREDITS:  STAN SCHROEDER | Mashable

The post Zoom security bug lets attackers steal Windows passwords appeared first on National Association of Real Estate Brokers.