Zoom Impersonation Attacks Aim to Steal Credentials

A new Zoom-themed phishing attack is circulating through email, text and social media messages, aiming to steal credentials for the videoconferencing service. The Better Business Bureau BBB warned last week that the attack uses Zoom’s logo, and in a message tells recipients that their Zoom accoun...

A week in security (November 23 – November 29)

Last week on Malwarebytes Labs, we talked with Chris Boyd about charities that track you online. We also looked back at Zoom, and wondered whether its any safer months after its first vulnerability was reported. We talked about how Apples security is hampering the detection of potentially unwante...

TurkeyBombing Puts New Twist on Zoom Abuse

Millions of family and friends, forced to spend Thanksgiving socially distant, are being targeted by cybercriminals as they turn to video platforms like Zoom to virtually be together. In this ongoing attack, cybersecurity experts warn, victims are targeted with a Zoom-related and...

Looks like we’re stuck with Zoom: Is it any safer?

Earlier this month, Zoom’s stock price took a dive on news of two promising COVID vaccines offering over 90 percent effectiveness against the virus a third vaccine was just announced. That’s nice. Glad to know some people think this nightmare is ending soon and we’ll all go back to the office and...

Zoom Takes on Zoom-Bombers Following FTC Settlement

Zoom has once again upped its security controls to prevent “Zoom-bombing” and other cyberattacks on meetings. The news comes less than a week after Zoom settled with the Federal Trade Commission over false encryption claims. Two of the new features allow moderators to act as “club bouncers,” givi...

Zoom Snooping: How Body Language Can Spill Your Password

You’ve heard of Zoom Bombing, but have you heard of Zoom Snooping? Researchers contend they can extract keystroke data from participants in a video call simply by tracking shoulder movements. A recently published study warns malicious actors might use the technique to decipher personal passwords...

Zoom Finally Has End-to-End Encryption. Here's How to Use It

You can lock down your meetings like never before—even if you have to give up a few features to do so...

Researchers: Instagram, LinkedIn Vulnerable to Preview-Link RCE Security Woes

UPDATE Link previews in popular chat apps on iOS and Android are a firehose of security and privacy issues, researchers have found. At risk are Facebook Messenger, LINE, Slack, Twitter Direct Messages, Zoom and many others. In the case of Instagram and LinkedIn, it’s even possible to execute remo...

News Wrap: Barnes & Noble Hack, DDoS Extortion Threats and More

The Threatpost editors break down the top security stories of the week ended Oct. 16, including: Patch Tuesday insanity, with Microsoft and Adobe releasing fixes for severe vulnerabilities – including a critical, potentially wormable remote code execution bug known as the “Ping of Death” Barnes a...

Zoom Rolls Out End-to-End Encryption After Setbacks

Video-conferencing giant Zoom is rolling out a technical preview of its end-to-end encryption E2EE next week. Zoom has faced various controversies around its encryption policies over the past year, including several lawsuits alleging that the company falsely told users that it offers full...

Grindr's Bug Bounty Pledge Doesn't Translate to Security

SAS@Home 2020– After a Grindr security flaw was disclosed this week, the dating site promised it would launch a bug-bounty program in an effort to “keep its service secure.” But Katie Moussouris, CEO of Luta Security and a bug bounty program expert, warned at this week’s SAS@home virtual event th...

This One Time on a Pen Test: I Know...Everything

Each year, Rapid7 penetration testers complete hundreds of internally and externally based penetration testing service engagements. This post is part of an ongoing series featuring testimonials of what goes on beneath the hoodie. For more insights, check out our 2020 Under the Hoodie report. It...

Hackers Target Porn Site Visitors Using Flash and Internet Explorer

Plus: Ransomware holds up schools, Zoom adds two-factor, and more of the week's top security news...

Zoom adds Two-factor authentication (2FA) as extra layer of security

By Zara Khan Video conferencing platform Zoom has announced two-factor authentication 2FA to enhance protection by adding an extra layer of security. This is a post from HackRead.com Read the original post: Zoom adds Two-factor authentication 2FA as extra layer of security...

Zoom Client < 4.6.10 Weak Encryption

The version of the Zoom Client installed on the remote host is prior to 4.6.10. It is, therefore, affected by a weak encryption vulnerability. Zoom Client for Meetings through 4.6.9 uses the ECB mode of AES for video and audio encryption. Within a meeting, all participants use a single 128-bit ke...

September 1, 2020, update for Office 2016 (KB4484500)

None None...

Zoom Client < 4.6.12 Path Traversal

The version of the Zoom Client installed on the remote host is prior to 4.6.12. It is, therefore, affected by multiple vulnerabilities : - A path traversal vulnerability exists in the Zoom Client in the message processing. An unauthenticated, remote attacker can exploit this, by sending a special...

You are not alone; video conferencing app Zoom is down for many

By Waqas You are not alone; Zoom is down for many around the world. This is a post from HackRead.com Read the original post: You are not alone; video conferencing app Zoom is down for many...

The vulnerability of GIPHY’s video conferencing service allows a perpetrator to execute arbitrary commands.

The vulnerability of GIPHY’s Zoom video conferencing service exists due to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created GIF file...

The vulnerability of the Zoom video conferencing service arises from an incorrect path name limitation for accessing the restricted catalog, allowing a violator to execute arbitrary code.

The vulnerability of the Zoom video conferencing service exists due to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created message a “snippet” with the code...