The vulnerability was found by Check Point Software Technologies, which published its findings.

In July last year, Zoom made headlines following a serious security vulnerability in its client app for macOS that allowed remote attackers or malicious websites to turn on users' device camera without their permission or knowledge.Zoom Video Communications has fixed a vulnerability that - under certain conditions - could have allowed an uninvited third party to guess a Zoom meeting ID and join a conference call.

We thank the Check Point team for sharing their research and collaborating with us,' a spokesperson for Zoom told The Hacker News. The issue was addressed in August of 2019, and we have continued to add additional features and functionalities to further strengthen our platform. 'The privacy and security of Zoom's users is our top priority. Device blocker - To prevent brute force attacks, repeated attempts to scan for meeting IDs will cause a device to be blocked for some time.Thus, a bad actor will not be able to quickly narrow the pool of meetings to attempt to join. For each connection, the page will load and attempt to join the meeting. Meeting ID Validation - Zoom will no longer automatically indicate if a meeting ID is valid or invalid, making it harder for automated scripts to determine active meetings.Account and Group Level Password Enforcement - Under new controls, three new password settings are now enforceable at the account, group, and user levels by the account admin.Default Passwords ⁠- Zoom now, by default, automatically generates a six-digit numeric password for each meeting you create that participants need to enter when joining by manually entering the meeting ID.'We were able to predict ~4% of randomly generated Meeting IDs, which is a very high chance of success, compared to the pure brute force.'Īs a result of Check Point's disclosure, Zoom introduced the following security features and functionalities into its cloud-based video conferencing service:

'A hacker could pre-generate a long list of Zoom Meeting IDs, use automation techniques to quickly verify if a respective Zoom Meeting ID was valid or not, and then gain entry into Zoom meetings that were not password protected,' researchers claimed.

Zoom random meeting id