Cisco WebEx and Zoom video hit by security flaw

Web conferencing platforms could let attackers snoop on conference calls, says Cequence Security

Security researchers have uncovered a way for attackers to snoop on video conferences run on the Cisco WebEx and Zoom platforms.

Dubbed "Prying Eye", the flaw spotted by Cequence Security is a weakness in web conferencing APIs that would allow attackers to use an enumeration attack to find open calls or meetings.

Advertisement - Article continues below

Enumeration attacks refer to the practice of using brute force to guess ID numbers in this case, for meetings or calls. If the attacker guesses the right meeting ID number, and it isn't password-protected, they have instant access.

That attack technique could work on any application that uses numbers as identifiers, but Cequence notes that it's common practice to disable basic security such as passwords for web conferences in order to reduce friction for meeting participants. The flaw could be particularly troublesome for anyone who reuses meeting IDs, letting an attacker snoop on all future calls or conferences.

"In targeting an API instead of a web form fill, bad actors are able to leverage the same benefits of ease of use and flexibility that APIs bring to the development community," said Shreyans Mehta, Cequence Security CTO and co-founder. "In the case of the Prying-Eye vulnerability, users should embrace the shared responsibility model and take advantage of the web conferencing vendors' security features to not only protect their meetings but also take the extra step of confirming the attendee identities."

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

Cequence alerted both companies to the vulnerability in July before taking it public today, giving Cisco and Zoom time to address the flaw. Cisco and Zoom have responded by altering default security settings and issuing advice to customers to help them avoid the vulnerability.

"Notably, the most effective step to strengthen the security of all meetings is to require a password which is enabled by default for all WebEx meetings," Cisco's security team said in a statement provided by Cequence.

Related Resource

Why UEM is the key to enterprise IT security

A guide to effective endpoint security

Download now

Richard Farley, CISO of Zoom Video Communications, said: "Zoom has improved our server protections to make it much harder for bad actors or malicious bots to troll for access into Zoom meetings."

Farley added that passwords are now enabled by default, but stressed it was still possible to lighten such security settings to whatever is appropriate for different users. He said that, "as is true of other security options, meeting hosts are free to choose security settings that are most appropriate to the sensitivity of their meetings."

Advertisement - Article continues below

Cequence Security added that it had not tested all other web conference vendors, so others may be at risk as well. The flaw can be avoided by requiring a password on sensitive conference calls or videos, and by confirming the identity of all attendees on a call.

The latest vulnerability comes just under a year after the discovery of a remote code execution flaw in WebEx's update service, in which hackers could invoke a Windows update service tool which grants the ability to execute commands with system-level privileges.

Featured Resources

Preparing for long-term remote working after COVID-19

Learn how to safely and securely enable your remote workforce

Download now

Cloud vs on-premise storage: What’s right for you?

Key considerations driving document storage decisions for businesses

Download now

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Transforming productivity

Solutions that facilitate work at full speed

Download now
Advertisement

Recommended

Visit/security/ethical-hacking/356252/poorly-secured-banking-apps-lead-to-cyber-threats
ethical hacking

Mobile banking apps are exposing user data to attackers

26 Jun 2020
Visit/security/malware/356231/most-malware-came-through-https-connections-in-q1-2020
malware

Most malware came through HTTPS connections in Q1 2020

25 Jun 2020
Visit/security/phishing/356211/phishing-attacks-target-unsuspecting-wells-fargo-customers
phishing

Phishing attacks target unsuspecting Wells Fargo customers

24 Jun 2020
Visit/security/hacking/356210/trump-administration-wants-to-enhance-the-security-of-gov-sites
hacking

Trump administration wants to enhance the security of .gov sites

24 Jun 2020

Most Popular

Visit/mobile/google-android/356373/over-2-dozen-additional-android-apps-found-stealing-user-data
Google Android

Over two dozen Android apps found stealing user data

7 Jul 2020
Visit/laptops/29190/how-to-find-ram-speed-size-and-type
Laptops

How to find RAM speed, size and type

24 Jun 2020
Visit/cloud/356260/the-road-to-recovery
Sponsored

The road to recovery

30 Jun 2020