Topic: Zoom video conferencing - security warning (Read 3927 times)

Steve_freereeder · « **on:** April 03, 2020, 08:07:20 AM »

I know that many of you are using or perhaps thinking of using the Zoom video conference application for holding remote sessions or teaching.
However, it appears there are potential security risks associated with this:
https://www.theguardian.com/technology/2020/apr/02/zoom-technology-security-coronavirus-video-conferencing

My wife has now deleted Zoom from her Mac and will not be using it again, at least until appropriate securty patches have been developed, released, and installed.
I was on the point of trying it myself, but will desist for the time being.

Do take care, folks.

xgx · « **Reply #1 on:** April 03, 2020, 08:57:23 AM »

Thanks for the 'heads up' ...timely 'cos was on the point of trying it too (!)

Helena Handcart · « **Reply #2 on:** April 03, 2020, 10:28:38 AM »

Yes, a bit disturbing. I saw the article yesterday and I'm currently looking at alternative solutions. As it happens I'm also doing a similar piece of work professionally to facilitate remote therapies during lockdown. I'd already discounted Zoom for that purpose.

I will report back after some testing.

Fred · « **Reply #3 on:** April 03, 2020, 10:43:09 AM »

Zoom's app is a bit shady, to say the least. We've had discussions about this at work lately. Time will tell if things will change.

In the meantime, here are two great open source alternatives for video conferencing and webinars/teaching:

https://meet.jit.si/
More focussed on normal

https://bigbluebutton.org/
More focussed on teaching and presentations.

However, both can do both.

Chris Rayner · « **Reply #4 on:** April 03, 2020, 11:21:03 AM »

Once again my natural idleness rides to my rescue. I was going to give it a go, but practice on my CBA[1] meant I CBA[2].

[1] Continental button accordion
[2] Couldn’t be ärsed.

Chris Brimley · « **Reply #5 on:** April 03, 2020, 12:03:37 PM »

Yes Steve, I'm also interested in using Zoom, and the security issue is a big no-no, though I don't know what else is available for musos, that works practically when sharing. Zoom market their stuff as being good for musicians, but they seem to have a list of countries where expanded facilities in their software are available. I've read their protestations of innocence, but I've also noted that the banned countries seem to be those with strong and proactive privacy policies, such as the UK. You have to sign up to a lengthy catch-all consent clause. I'd like to use it, but I'm reluctant to allow audio and video data to be transferred to the normal Google/FB/Analytics crowd of sharks. What's your take on it?

Corinto · « **Reply #6 on:** April 03, 2020, 12:20:53 PM »

Thanks Steve, thanks Fred!

Bob Ellis · « **Reply #7 on:** April 03, 2020, 12:29:55 PM »

I have already started using Zoom - I taught a lesson with it yesterday and I have taken part in two sessions. I have another lesson and another session booked in the next few days. Can anyone summarise concisely what the problems are and the severity of the risks? Having just learnt how to use it (and it seems to do the job well), I don't want to have to learn a new system if there is no real need.

Chris Ryall · « **Reply #8 on:** April 03, 2020, 12:34:22 PM »

Very timely, just zoomed with my family, 5 in UK, one in sydney. It is a fantastic product, superb quality.

But 🤔 Thanks for the heads up.

Tone Dumb Greg · « **Reply #9 on:** April 03, 2020, 12:41:01 PM »

Am I right in thinking there are three hazards?

1. They steal your data (I thought they all did that)
2. It is vulnerable to external hacking and trolling.
3. Your emails can be hacked through the app.

Gena Crisman · « **Reply #10 on:** April 03, 2020, 01:06:06 PM »

I would be very surprised if it compromised your actual email messages themselves. My understanding is if you are operating under windows vs osx the vulnerabilities it creates are different, but, the ones that are practical vectors for bad-stuff right now aren't wildly dissimilar.

The issue is that the program is a vector for 3rd parties, ie, neither you nor zoom, to obtain information about you & photos or files that are associated somehow with zoom. I'm unclear on the details, but, it's important to understand that this will include a subset of people actively seeking to attack/disrupt/phish/blackmail etc and are able to steal data, zoom credentials, force you into chat rooms, infiltrate & disrupt business meetings etc - the program as is & the usage it's receiving is seemingly creating a venue for people who are acting maliciously.

While we all have basically nothing of value to them, like, it's still bad. But, importantly, I don't believe anything mentioned it allowing arbitrary code execution of any kind, which is where a program is used to run other programs, which typically install the really bad stuff.

Did you know that video conferencing has only needed to exist the past few weeks? That's definitely why we use Zoom, which no one had ever heard of before March! It's quite fascinating. I think everyone's going crazy for zoom in the same way people went crazy for toilet paper.

edit: to be clear, Zoom is 100% also selling things about you but the things it's selling are, well, let's go with 'less illegal', more like usage metrics and profile information or whatever.

Chris Brimley · « **Reply #11 on:** April 03, 2020, 01:20:11 PM »

Gena, you talk about a subset of people, but isn't it the case that most IT giants have business models that depend for their profit upon selling our data, and because many apps are in cahoots with these people, that's why so much of what we use is 'free'? Yes, we can't control the reuse of our data by the 'fourth party' crooks, but the big third party ones ones are as bad. I don't subscribe to the 'Welcome to the 21st C!' model of data protection, nor does the UK Information Commissioners Office, AFAIK.

On a separate matter, do you know of any other musician-friendly platforms for streaming performances successfully, that are likely to be recognised by others?

Gena Crisman · « **Reply #12 on:** April 03, 2020, 01:34:48 PM »

Well, no, I mostly don't think IT giants are going into other people's business meetings, streaming porn to everyone there and calling everyone racial expletives. Like all of that kinda thing would look preeeeety bad for Zoom? I don't think there's really a lot of cahoots between the large IT firms, and the people looking to make a buck by blackmailing or compromising you in some fashion. The companies are still absolutely crooks, but they make a hell of a lot more money and have fewer arrests by doing what they do.

If we're going to say fourth party crooks vs 3rd party IT giants, a 3rd party IT giant isn't thinking of infiltrating your business meeting/the company email system, pasting a link to some kind of ransomware, infecting half of the company & their home computers, and extorting tens or hundreds of thousands of pounds out of people.

Chris Ryall · « **Reply #13 on:** April 03, 2020, 01:46:19 PM »

Guardian warned that your camera might be taken over. I bounced this off a nephew who is doing the Bournemouth degree course in computer hacking (=> be a protector) but seems they’ve not got that far yet.

He had managed to hack my old Raspberry Pi though 😉, but I digress 🙄

They do hack clever information. I tried some cannabis for pain relief last year, which worked 🙂 but my GP said “don’t go there” and sent me to the pain clinic

Then attached ad arrived by email this morning. Maybe I googled something?

Theo · « **Reply #14 on:** April 03, 2020, 01:53:46 PM »

Yes if you are still happy to use Google then perhaps the data collection by zoom is less of a concern.

Chris Brimley · « **Reply #15 on:** April 03, 2020, 02:03:12 PM »

This maybe drifting some way from melodeons, and apologies! Gena, the 3rd parties allow 4th parties (such as malign states) to operate with your data, and the IT giants do it for profit. They were caught with their pants down over the Cambridge Analytica scandal, but honestly, has anything fundamentally changed? People still read out their bank card details over the phone, blithely unaware that in total they are immediately giving fourth parties enough info to take down the whole of our banking systems at some convenient time in the future. And all because of the IT giants' irresponsible business models. The 3rd parties are the ones who could shut this down, but they won't.

Chris Brimley · « **Reply #16 on:** April 03, 2020, 02:05:31 PM »

More relevantly, is it the case that it's only the PC version of Zoom that allows the 'Original Sound' option (ie disabling AGC and noise suppression)?

Tone Dumb Greg · « **Reply #17 on:** April 03, 2020, 02:07:05 PM »

Quote from: Chris Brimley on April 03, 2020, 01:20:11 PM

On a separate matter, do you know of any other musician-friendly platforms for streaming performances successfully, that are likely to be recognised by others?

Jamkazam?

boxcall · « **Reply #18 on:** April 03, 2020, 02:08:58 PM »

In the link it states that the camera and mic can be hacked as being an issue.
Also it is very easy to generate the numbers needed to gain access to calls and your computer.
Thanks for the heads up , my wife has been using it for teacher conferencing.

Tone Dumb Greg · « **Reply #19 on:** April 03, 2020, 02:14:19 PM »

Quote from: boxcall on April 03, 2020, 02:08:58 PM

In the link it states that the camera and mic can be hacked as being an issue.
Also it is very easy to generate the numbers needed to gain access to calls and your computer.
Thanks for the heads up , my wife has been using it for teacher conferencing.

As I read it "Zoom bombing is on the rise" means that this hacking is already taking place and is becoming more common.

"On 30 March, the FBI announced it was investigating increased cases of video hijacking, also known as “Zoom-bombing”, in which hackers infiltrate video meetings, often shouting racial slurs or threats."

News:

Author Topic: Zoom video conferencing - security warning (Read 3927 times)