5 ms·

I attended a PhD defense yesterday that got zoom bombed. They quickly moved it to an actively managed call and the presenter did a fine job of keeping their com

by j-wags 7y ago

I attended a PhD defense yesterday that got zoom bombed. They quickly moved it to an actively managed call and the presenter did a fine job of keeping their composure and getting back on track. Now we're circulating guides about how to set up secure rooms and webinars, so I don't anticipate this will happen again. Normally I'd wave this off as a childish prank, but both the URL and loading screen prominently indicated the name of a major medical school, and the contents of the presentation were proteins and chemical structures. Bombing this meeting in particular seems to be in especially bad taste during a pandemic.

jchrisa 7y ago
This happened to a local political debate I was attending. Disturbing to say the least. It's not hard to defend against as a power-user host, but the default case might be better locked down. Maybe this preference should prominent in account setup.
Alupis 7y ago
> Bombing this meeting in particular seems to be in especially bad taste during a pandemic Either that... or it's a way to get high profile attention to blatant security issues in a commonly used business meeting tool where sometimes sensitive information is shared.
- tptacek 7y ago
  People are not trolling Zoom meetings as part of a high-minded awareness campaign.
  - Alupis 7y ago
    Maybe... maybe not. It sure is bringing about awareness though, isn't it?
    - edoceo 7y ago
      Ahh yes, the old ends justifying the means.
      - Alupis 7y ago
        Not going to defend a bunch of trolls, if that's what you're implying. However, if we don't secure our systems, what do we expect? If there were no bad-actors in the world, people like tptacek would be out of work. What a glorious world it would be, no need for locked doors, fences, passwords, pin codes and more - but that's not the world we live in. Instead, we're in a world where Zoom has laughable security for barging into potentially sensitive meetings being conducted by businesses and world leaders[1]. If it takes a few meetings getting trolled for Zoom to finally take action, I'm not going to feel much sympathy. Just be glad trolling is all they're doing right now. So, while I'm sorry your meeting got trolled, it will just continue to happen until you get mad at the people that made it possible - Zoom. [1] https://mobile.twitter.com/BorisJohnson/status/1244985949534199808 https://mobile.twitter.com/BorisJohnson/status/1244985949534...
        YarickR2 7y ago
        I hope you're wearing a hard hat at all times; if not - then it's your fault when complete stranger smashes you with a brick. Who you will be mad at after that ?
        c22 7y ago
        On the other hand, when I get smashed with a brick and the hard hat I'm wearing crumples like a paper bag I guess I'm still a little mad at the hard hat company?
        buzzkillington 7y ago
        When you walk into a crocodile pit do we blame the crocodiles for eating you?
        HarryHirsch 7y ago
        Come on, Adolf Hitler has participated in Kahoot games ever since Kahoot was invented.
    - tptacek 7y ago
      No, not maybe.
- anigbrowl 7y ago
  Trolling is not a security advisory. If it were intended that way it would be sufficient to hold up a sign saying 'warning, this meeting is not secure'. Instead people are using it abuse others. Stop making excuses for that behavior.
  - Alupis 7y ago
    Or we stop making excuses for companies that enable this behavior? Seriously, if people can troll, they'll troll. It doesn't matter how offended someone else is. Make it impossible to troll, and guess what happens? No trolls. It's really that simple. And with systems that apparently world leaders are conducting business with... It really ought to be impossible to troll! So while it might feel good to get mad at the trolls, you're misdirecting from the actual problem here: People can dial into unprotected meetings and listen into sensitive conversations that are assumed to be private! That's scary. Really scary. And we're pretty darn lucky it's just trolling for laughs so far.
  - mmhsieh 7y ago
    As a poor man's red team, the reward of being a jerk is the compensation paid to the troll.
    - anigbrowl 7y ago
      No.
      - mmhsieh 7y ago
        Yes.
        anigbrowl 7y ago
        No. That's an asshole's charter.
        deleted 7y ago
        [deleted]
roel_v 7y ago
"Now we're circulating guides about how to set up secure rooms and webinars, so I don't anticipate this will happen again." My sarcasm calibration is a bit off lately, you surely didn't mean this seriously (I mean, you don't really think this won't happen again)?
christianmann 7y ago
> Bombing this meeting in particular seems to be in especially bad taste during a pandemic. For what it's worth, it likely wasn't targeted. My understanding is that the search space is so short that you can just cycle through it until you find something.
woliveirajr 7y ago
In general PhD defenses are open to public, I mean, in some places it isn't even valid if it wasn't public announced (by a printed paper glued to some wall, for all it's worth) and the access is restricted to the public. Of course different times require different actions but I think that some challenges remain for the _formal_ part of it.

by j-wags 7y ago

jchrisa 7y ago

This happened to a local political debate I was attending. Disturbing to say the least. It's not hard to defend against as a power-user host, but the default case might be better locked down. Maybe this preference should prominent in account setup.

Alupis 7y ago

> Bombing this meeting in particular seems to be in especially bad taste during a pandemic Either that... or it's a way to get high profile attention to blatant security issues in a commonly used business meeting tool where sometimes sensitive information is shared.

tptacek 7y ago
People are not trolling Zoom meetings as part of a high-minded awareness campaign.
- Alupis 7y ago
  Maybe... maybe not. It sure is bringing about awareness though, isn't it?
  - edoceo 7y ago
    Ahh yes, the old ends justifying the means.
    - Alupis 7y ago
      Not going to defend a bunch of trolls, if that's what you're implying. However, if we don't secure our systems, what do we expect? If there were no bad-actors in the world, people like tptacek would be out of work. What a glorious world it would be, no need for locked doors, fences, passwords, pin codes and more - but that's not the world we live in. Instead, we're in a world where Zoom has laughable security for barging into potentially sensitive meetings being conducted by businesses and world leaders[1]. If it takes a few meetings getting trolled for Zoom to finally take action, I'm not going to feel much sympathy. Just be glad trolling is all they're doing right now. So, while I'm sorry your meeting got trolled, it will just continue to happen until you get mad at the people that made it possible - Zoom. [1] https://mobile.twitter.com/BorisJohnson/status/1244985949534199808 https://mobile.twitter.com/BorisJohnson/status/1244985949534...
      - YarickR2 7y ago
        I hope you're wearing a hard hat at all times; if not - then it's your fault when complete stranger smashes you with a brick. Who you will be mad at after that ?
        c22 7y ago
        On the other hand, when I get smashed with a brick and the hard hat I'm wearing crumples like a paper bag I guess I'm still a little mad at the hard hat company?
        buzzkillington 7y ago
        When you walk into a crocodile pit do we blame the crocodiles for eating you?
        HarryHirsch 7y ago
        Come on, Adolf Hitler has participated in Kahoot games ever since Kahoot was invented.
  - tptacek 7y ago
    No, not maybe.
anigbrowl 7y ago
Trolling is not a security advisory. If it were intended that way it would be sufficient to hold up a sign saying 'warning, this meeting is not secure'. Instead people are using it abuse others. Stop making excuses for that behavior.
- Alupis 7y ago
  Or we stop making excuses for companies that enable this behavior? Seriously, if people can troll, they'll troll. It doesn't matter how offended someone else is. Make it impossible to troll, and guess what happens? No trolls. It's really that simple. And with systems that apparently world leaders are conducting business with... It really ought to be impossible to troll! So while it might feel good to get mad at the trolls, you're misdirecting from the actual problem here: People can dial into unprotected meetings and listen into sensitive conversations that are assumed to be private! That's scary. Really scary. And we're pretty darn lucky it's just trolling for laughs so far.
- mmhsieh 7y ago
  As a poor man's red team, the reward of being a jerk is the compensation paid to the troll.
  - anigbrowl 7y ago
    No.
    - mmhsieh 7y ago
      Yes.
      - anigbrowl 7y ago
        No. That's an asshole's charter.
        deleted 7y ago
        [deleted]

roel_v 7y ago

"Now we're circulating guides about how to set up secure rooms and webinars, so I don't anticipate this will happen again." My sarcasm calibration is a bit off lately, you surely didn't mean this seriously (I mean, you don't really think this won't happen again)?

christianmann 7y ago

> Bombing this meeting in particular seems to be in especially bad taste during a pandemic. For what it's worth, it likely wasn't targeted. My understanding is that the search space is so short that you can just cycle through it until you find something.

woliveirajr 7y ago

In general PhD defenses are open to public, I mean, in some places it isn't even valid if it wasn't public announced (by a printed paper glued to some wall, for all it's worth) and the access is restricted to the public. Of course different times require different actions but I think that some challenges remain for the _formal_ part of it.