On Tuesday, according to an article from Motherboard, video-calling service Zoom accidentally released the personal email addresses and photos of thousands of its users. This is because the service had an issue with its “Company Directory” feature, that groups together users who share the same email domain.
Since the ides of March, Twitter users of Zoom have been reporting that this feature is grouping thousands of strangers as if they all worked for the same company – sharing private information amongst the group.
The Intercept would also go on to report that Zoom’s meetings aren’t protected by end-to-end encryption, despite the company claiming that its product uses the feature several times in marketing. End-to-end encryption would mean that neither external attackers nor Zoom itself could access the contents of any video meeting you take part in.
What Zoom actually offers is “Transport Encryption”, a form that protects content from external attackers, but not from Zoom itself – despite what Zoom says.
Zoom is also in hot water with cybersecurity researchers, who discovered that the Windows version of the service is at risk from cybercriminals who could send malicious links to user chats interfaces and gain access to their network credentials.
A few cybersecurity researchers were able to replicate the exploit.
Zoom has yet to respond to the news of this Windows flaw.
Finally, the company is being sued for sending user information to Facebook without permission.
Vice reports that “by analyzing the network traffic of the Zoom iOS app, Motherboard found that when opened, the app sent information about the user’s device such as the model, the city and timezone they are connecting from, which phone carrier they are using, and a unique advertiser identifier created by the user’s device”.
A Princeton computer-science professor, Arvind Narayanan criticized the company for its enormous amount of security and privacy faults – calling the service a “malware”, via Business Insider.
It can be rationalized that all of these issues had been flying under the radar at Zoom until the coronavirus caused thousands to turn to the service for their businesses and companies. The more eyes on the product meant the more it was scrutinized for flaws.
So far it appears that Zoom was not prepared for its newfound popularity.
