Threat Update: Zoom Bombing on the Dark Web

With most organisations switching to work from home to prevent the spread of COVID-19, tools related to remote work and the cloud have surged in popularity in recent weeks. Zoom is one of the most popular cloud-based enterprise communication platforms and offers chat, video and audio conferencing, and options to host webinars and virtual meetings online. With this sudden spike in Zoom use, attackers are increasingly seeking to take advantage of users with a variety of tactics. Some attackers are registering new fake Zoom-related domains, which attempt to trick people into downloading malware. Other vectors include compromising Zoom accounts and offering them for sale on hacking forums, and a technique called war-dialing or Zoom bombing, detailed in this advisory.

Recommendations

If you have Zoom, enable Zoom Protection in the ZeroFOX Platform for your organization
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
Beware of lookalike domains and avoid clicking directly on links embedded in emails. Threat actors often use URL shorteners to make malicious links more appealing
If your organization uses Zoom or any other video conferencing software, ensure that you have enabled password-protected meeting invites.

Details

War-dialing is possible because meeting IDs are hardcoded in Zoom URLs. This makes it possible to brute-force meeting ID values until an active meeting is found. This is also called Zoom bombing, which refers to attackers gaining access to unsecured calls and leveraging the call for their own devices. This may involve simply disrupting the call, or could potentially involve an attacker recording or eavesdropping on the call without the intended meeting participants’ knowledge.

A similar string of attacks occurred against Amazon Ring security cameras in December 2019. Lax Ring security protocols allowed hackers to compromise devices and interact with users, often harassing them. Because of the publicity of these attacks, moderators of the hacking forums used to organize these Ring hacks banned the discussion of the devices, in an attempt to fly under law enforcement’s radar. Similar chatter has begun to circulate through the forums, with users concerned that Zoom bombing will draw unwanted attention.

Figure 1. Chatter related to brute-forcing Zoom meetings, using nulled[.]to tools.

In many of the forums ZeroFOX monitors, all posts referencing Zoom appear to have been purged. Although cached posts referencing Zoom can be seen in search results, attempting to access these threads displays an error stating, “The specified thread does not exist.”

Figure 2. Search results for “Zoom” on one hacking forum.

Figure 3. Error message upon attempting to access Zoom-related threads

As hacking forums have restricted discussion of Zoom, chatter has shifted onto Discord channels. Many of these channel links are shared on social media platforms like Twitter, to improve visibility.

Figure 4. One of hundreds of tweets regarding Zoom trolling Discord groups.

ZeroFOX has also identified entire websites dedicated to sharing insecure Zoom call IDs, like this one, below, for sharing digital learning links.

Figure 5. Website dedicated to spamming classroom Zoom calls

In addition to these attacks against open Zoom calls, criminals have been offering compromised Zoom account credentials for sale. Although these sales ads do not specify the method with which these accounts have been compromised, one of the most commonly used methods is credential stuffing. This tactic involves brute force login attempts, where a list of passwords (often generated with breached passwords from other sites) is tried until the attacker achieves a successful login.

Figure 6. A variety of cracked account credentials offered for sale, many for Zoom accounts.

On one of the few hacking forums still allowing Zoom account sales, Alpha Team identified over 4,000 cracked accounts for sale.

Conclusion

The increase in use of video conferencing software like Zoom has also sparked an increase in threat actors targeting the platform. Although Zoom has recently released an update to default meeting configurations, and has paused feature updates for the next 90 days in order to focus on security and privacy, attackers are still able to abuse the platform and profit off of compromised account sales. To best protect your organizations from these risks, ZeroFox recommends practicing the recommendations listed above.