IS IT SAFE TO USE ZOOM?

- April 25, 2020

By: Nur 'Inayah

Over the past month, the teleconference software Zoom has seen explosive growth because of, you know, the thing. But that growth has also come with increased scrutiny and a slew of uncovered security screwups. Taken individually, many of the problems seem more sloppy than malicious or sneaky, but taken in aggregate, they make a billion-dollar publicly traded company seem like it’s held together with duct tape and string.

A Sketchy Installer

There was the problem with Zoom’s installer, which took over admin privileges to gain root access to a user’s computer. That access could be abused to surreptitiously install programs without the user’s knowledge, including the ability to access a user’s webcam and microphone. (Last summer, a security researcher found a Zoom feature that opened up vulnerabilities by turning any user’s computer into a local server. In an unprecedented move, Apple silently pushed out an operating-system update to disable it.)

Questionable Routing

There are questions about where Zoom is sending the data it collects from your computer. Zoom was found to be sending data to Facebook, even if you weren’t logged in to a Facebook account. Zoom also apologized this month for mistakenly routing traffic through China, where the internet is heavily monitored by the government. Most tech companies operating in China have strict separations between domestic and international online traffic.

Dubious encryption

That monitoring would be less of a concern if Zoom were encrypted end-to-end, as the company claimed in marketing materials. But it admitted to The Intercept that Zoom did not use E2EE for video calls. Zoom uses some encryption (known as transport encryption) but not the more secure end-to-end type. Some of the confusion stems from defining what an “end” is. Zoom seems to think that its servers, acting as middlemen between users, count as such.

Zoombombing
There’s also the rash of “Zoombombing” that has gone on. People are guessing or finding Zoom meeting ID numbers online and entering uninvited to leave disruptive comments or share disruptive media using Zoom’s screen-share feature. Finding open meetings, which have IDs from nine to 11 digits, is relatively simple and has already been automated. Until a patch issued this week, the meeting ID would often be highly visible in screenshots.