Check Point Research, the Threat Intelligence arm of Check Point® Software Technologies Ltd. (NASDAQ: CHKP), recently helped to mitigate risk associated with a potential security issue in Zoom’s customizable ‘Vanity URLs’ feature that could have allowed hackers to send legitimate-looking Zoom business meeting invitations that appear as associated with a particular Zoom user with the aim of inserting malware and surreptitiously stealing data or credentials from that user. Previously, Check Point Research worked with Zoom this past January to fix a different potential vulnerability that could have allowed hackers to join a meeting uninvited.
Zoom usage has exploded during the global Covid-19 lockdowns, from 10 million daily meeting participants in December 2019 to over 300 million in April 2020. Cybercriminals are using this popularity as phishing lure for Zoom and other video communication platform users. According to Check Point, Zoom-related domain registrations and fake Zoom installation programs, in particular, have been the subject of a major increase.
The new potential Vanity URL security issue was found by researchers following up on the prior January collaboration. This potential security issue could have allowed a hacker to attempt to manipulate a Vanity URL (e.g., https://yourcompany.zoom.us) in two ways:
- Targeting via direct links: when setting up a meeting, the hacker could change the invitation URL to include a registered sub-domain of their choice. In other words, if the original link was https://zoom.us/j/##########, the attacker could change it to https://<organization’s name>.zoom.us/j/##########. Without particular cybersecurity training on how to recognize the appropriate URL, a user receiving this invitation may not recognize that the invitation was not genuine or issued from an actual or real organization.
- Targeting dedicated Zoom web interfaces: some organizations have their own Zoom web interface for conferences. A hacker could target such an interface and attempt to redirect a user to enter a meeting ID into the malicious Vanity URL rather than the actual or genuine Zoom web interface. As with the direct links attacks, without careful cybersecurity training, a victim of such attacks may not have been able to recognize the malicious URL and have fallen prey to the attack.
Using either method a hacker could attempt to pose as an employee of a potential victim organization via Zoom, and give the hacker a vector for stealing credentials or sensitive information.
Adi Ikan, Network Research & Protection Group Manager at Check Point said: “Because Zoom has become one of the world’s leading communication channels for businesses, governments and consumers, it’s critical that threat actors are prevented from exploiting Zoom for criminal purposes. Working together with Zoom’s security team, we have helped Zoom provide users globally with a safer, simpler and trusted communication experience so they can take full advantage of the service’s benefits.”
Check Point Research and Zoom worked together to resolve these issues. Zoom has addressed the issue and put additional safeguards in place for the protection of users.
“This was a joint-effort between Check Point and Zoom. Together, we’ve taken important steps to protect users of Zoom everywhere,” said Adi Ikan.
Read the technical details of the security issues in our research report.
Follow Check Point Research via:
Blog: https://research.checkpoint.com/
Twitter: https://twitter.com/_cpresearch_
Podcast: https://research.checkpoint.com/category/cpradio/
Facebook: https://www.facebook.com/checkpointresearch
About Check Point Research
Check Point Research provides leading cyber threat intelligence to Check Point Software customers and the greater intelligence community. The research team collects and analyzes global cyber-attack data stored on ThreatCloud AI to keep hackers at bay, while ensuring all Check Point products are updated with the latest protections. The research team consists of over 100 analysts and researchers cooperating with other security vendors, law enforcement and various CERTs.
About Check Point Software Technologies Ltd.
Check Point Software Technologies Ltd. (www.checkpoint.com) is a leading provider of cyber security solutions to governments and corporate enterprises globally. Its solutions protect customers from 5th generation cyber-attacks with an industry leading catch rate of malware, ransomware and other types of attacks. Check Point offers multilevel security architecture, “Infinity” Total Protection with Gen V advanced threat prevention, which defends enterprises’ cloud, network and mobile device held information. Check Point provides the most comprehensive and intuitive one point of control security management system. Check Point protects over 100,000 organizations of all sizes.
Opinião