Zoom, the video-conferencing app, has recently surged in popularity as businesses, schools and other organizations look for ways to conduct classes and meetings while maintaining social distance amid lockdowns enforced by countries to contain the coronavirus outbreak.
Unfortunately, the increased usage has led to several Zoom accounts being compromised and leaked on the dark web and hacker forums.
Zoom accounts sold on the dark web
Security researchers at Cyble recently came across a hacker selling stolen Zoom credentials for less than a penny each, and in some cases even giving them away for free on the dark web and hacker forums.
These Zoom credentials are obtained through attacks wherein cybercriminals attempt to login to Zoom using user credentials of other platforms leaked in previous data breaches. The successful logins are then compiled into lists that are sold to other hackers.
Cyble purchased more than 500,000 Zoom accounts on an underground hacking forum, including credentials, personal meeting URLs and Zoom host keys. The security reached out to the original users and confirmed that the credentials were indeed valid.
According to Cyble, many of the accounts sold on the forum belonged to well-known companies such as Chase, Citibank, educational institutions, and more. Bleeping Computer also got in touch with some of the compromised account owners and were told that the passwords were correct.
Zoom's security issues
Zoom's security has come under increased scrutiny recently with private companies around the world, including Google and SpaceX, as well as national governments have banned the use of the video-calling tool due to security breaches. Not only has Zoom been banned in workplaces around the world, but the company is also facing multiple lawsuits over its security flaws.
"Zoombombing" has also become a common occurrence on the platform due to its lack of end-to-end encryption during live sessions, which allows unwanted strangers hijack Zoom calls and disrupt meetings. The dangerous trend even prompted the US Department of Justice to declare it as a federal offence that is punishable by imprisonment, as previously reported.
