Zoom releases security updates in response to ‘Zoom-bombings’

The video-conferencing platform Zoom has released a new update this week in an effort to address an onslaught of security concerns surrounding the service.

Zoom says the newest version of its app, Zoom 5.0, includes encryption and new privacy controls, updates that are part of a 90-day plan to improve security and privacy on the platform.

Worried about Zoom’s privacy problems? A guide to your video-conferencing options

Read more

“I am proud to reach this step in our 90-day plan, but this is just the beginning,” Eric Yuan, the company’s chief executive officer, said in a call on Wednesday. “We will earn our customers’ trust and deliver them happiness with our unwavering focus on providing the most secure platform.”

Zoom has struggled to meet security needs as the platform has scaled up its user base to unprecedented levels in recent months.

Since the coronavirus lockdown, Zoom’s daily active users shot up from around 10 million to 300 million as people use the platform for happy hours, work meetings, support groups and even funerals.

Users struggled with persistent “Zoom-bombing”, a new kind of attack in which bad actors enter video meetings and shout slurs and threats in an attempt to disrupt them. Narcotics Anonymous and Alcoholics Anonymous meetings were targeted in particular.

Zoom 5.0 will allow hosts to “report a user” to Zoom with a new security button and the app now defaults users to a “waiting room” feature, which requires participants to be approved to enter a meeting. All meetings will now require a password to enter.

Zoom also added a new encryption standard, called AES 256-bit GCM encryption, which is considered the “gold standard” of encryption and is used by the US government to secure data.

The change will help prevent meetings from being hijacked by hackers, said Thomas Hatch, the co-founder and chief technology officer of Utah-based software firm SaltStack.

“The encryption that has been introduced improves the liability that existed before where video conferences could be hijacked out of line,” he said. “This adds a much better layer of privacy that was not present before.”

In addition to Zoom bombing concerns, the app had also received criticism over major bugs in recent months, including one that would allow a hacker to take full control over the user’s computer. To address these concerns, Zoom has beefed up its bug bounty program, incentivizing security professionals to alert them to bugs before hackers can exploit them.

In a call on Wednesday, Yuan reiterated that Zoom will not sell user data. Zoom had been forced to change its policies around data sale after a story from Motherboard at Vice revealed Zoom sends data from users of its iOS app to Facebook for advertising purposes, even if the user does not have a Facebook account.

Zoom is not the only video conferencing platform, but it is easily one of the most popular. That is largely because of how easy it is to use, said Hank Schless, a senior manager at tech security firm Lookout.

“The widespread use of conferencing solutions like Zoom shows how people are OK with putting convenience ahead of security,” he said. “Zoom got a lot of attention because users were not turning on many of its security settings. Despite that, they continue to log in every day because they assume the likelihood of being a victim is too low to affect them.”

• This article was amended on 24 April 2020 to clarify that Zoom’s new encryption standard is not encrypted end-to-end.