4 ms·
"These credentials are gathered through credential stuffing attacks where threat actors attempt to login to Zoom using accounts leaked in older data breaches. T
by Twirrim 7y ago
"These credentials are gathered through credential stuffing attacks where threat actors attempt to login to Zoom using accounts leaked in older data breaches. The successful logins are compiled into lists that are sold to other hackers."
This feels like ridiculous piling on to Zoom. This comes down to the same old password reuse issue. You could almost certainly replace any other service provider with Zoom in that article and not reduce its accuracy. Pounds for pennies, other services have hundreds of thousands of accounts being sold courtesy of credential stuffing.
- ALittleLight 7y agoCan service providers not realize that someone is trying millions of different accounts with patterns of passwords and throttle or block them?
- samsquire 7y agoThis assumes that people have good monitoring over the login pages/endpoints.
- mandelbrotwurst 7y agoA company as large as Zoom should have this kind of monitoring over auth endpoints.
- bigiain 7y agoThere are many recent reports about things Zoom "should have" that they don't. The assumption of rank incompetence and/or irresponsible cowboy practices seems to be completely appropriate for them...
- weej 7y agoIt also assumes malicious request have same or similar signature attributes (ex: IP addr, http hdrs), which is not always the case.
- rad_gruchalski 7y agoThey probably could. Assuming that these attempts aren’t executed using a botnet with dozens of thousands of machines.
- aaronblohowiak 7y agoHow many logins/second from how many different IP addresses and browsers would you have to try in order to achieve this in a way that is hard to detect? How hard is it to rent a botnet that would mean IP-based filtering would have too large a blast radius?
- gruez 7y agoYou don't even need a botnet. There are companies that offer such service out in the open. eg. luminati
- judge2020 7y agoCred stuffing can often be done with 5 or less "known" passwords used by the victim. When the attackers have enough IPs (via proxies or cloud providers - remember that most cloud providers give out multiple ipv6 /64s no questions asked), It'll end up looking like any other login attempt from a consumer VPN where the user forgot their password and is trying 3 or 4 different ones.
- ALittleLight 7y agoI would think you alarm when login failure rate spikes. Realize what is going on, list the probably affected accounts, and lock those accounts until they change their passwords. Doesn't seem like an impossible to mitigate problem.
- majormajor 7y agoNot that easily. A sophisticated attacker is going to be using a lot of different throwaway IP addresses. One of the common ways to (try to) prevent this are often how you end up with stuff like "all IPs we think are AWS or data centers or [...] are blocked from our service."
- PureParadigm 7y agoAccording to NIST's memorized secret (aka password) guidelines [1]: > When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised. If Zoom had enforced that passwords can't be from a list of already compromised passwords as this guidance suggests, this attack wouldn't have been nearly as successful. This is just what happens when you don't have a decent security policy, and everyone that doesn't follow basic security best-practices should be called out for it. [1] https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html
- mandelbrotwurst 7y agoDoes that guidance get into how such a list should be sourced?
- PureParadigm 7y agoIt does not name specific sources, but it is not hard to find some. For example, in my programs I check passwords against the API provided by haveibeenpwned.com. More context from the guidance below from https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html > When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised. For example, the list MAY include, but is not limited to: - Passwords obtained from previous breach corpuses. - Dictionary words. - Repetitive or sequential characters (e.g. ‘aaaaaa’, ‘1234abcd’). - Context-specific words, such as the name of the service, the username, and derivatives thereof. If the chosen secret is found in the list, the CSP or verifier SHALL advise the subscriber that they need to select a different secret, SHALL provide the reason for rejection, and SHALL require the subscriber to choose a different value.
- thanksforfish 7y agoA minimal compliant implementation could likely be ["passw0rd"]. Hopefully most compliant systems try a little harder, but with time and budget pressures... Ideally a modern system should use haveibeenpwned or atleast one of the various lists you can find in password cracking forums.
- grecy 7y agoIt really is starting to feel like there's an anti-Zoom pres s campaign right now. Who would benefit the most? Skype, Google Voice, Facebook Mesenger ?
- unwoundmouse 7y agoMy bet is that there's a powerful short selling interest group
- noizejoy 7y agoSource?
- unwoundmouse 7y agoNo source. No proof. Sometimes it's worth considering the various incentives and perspectives.
- xiphias2 7y agoThat's actually a good thing. Zoom is a great tool, but mainly because it exposes how important video conferencing is, and if it's done well, there's a market for it. Still, it's not $40B great. MS, Facebook, Apple and Alphabet now has to think about improving their video conferencing protocol, and not just the next iteration of material design.
- noizejoy 7y agoThe top dog usually gets the most scrutiny. And so they should. I’d be more worried if that wasn’t the case.
- save_ferris 7y agoI think our internet behavior and metrics makes certain topics trendy for outlets. Most news outlets metric the crap out of their stories (journalists performance is often judged at least partially by clicks) and if pieces on Zoom get lots of clicks, they’re gonna keep writing them. I think this is the most likely reason with their explosion in usage due to COVID. Anecdotally, around 25-30% of news articles shared in my company Slack channels recently have been about Zoom. We saw the exact same phenomenon during the 2016 election.
- freezman 7y agoAs an example: "At the 2020 RSA Conference, Microsoft reported that in January 2020 480,000 Microsoft accounts were compromised because those customers had reused passwords that had leaked from somewhere else." [0] [0] https://jesperjo.com/f/intro-to-multi-factor-authentication https://jesperjo.com/f/intro-to-multi-factor-authentication
- thanksforfish 7y agoI'm very critical of how zoom handles security issues, but I agree this is mostly a non-story. The fixes zoom could implement seem limited to IP address rate limiting and checking passwords against haveibeenpwned (or similar).
- all_blue_chucks 7y agoService providers have an obligation to mitigate credential stuffing. Zoom failed to do so. They should use MFA but at the very least they should prohibit the use of leaked passwords.
- thanksforfish 7y agoEach service provider needs to balance security and convenience based on the market they serve. Forced MFA for a product designed to be an easy to use video conferencing tool feels incorrect.
- all_blue_chucks 7y agoI disagree. Even the weakest form of MFA (click this link sent to your email to set an authorization cookie) prevents stuffing attacks, and is still available to anyone.
- deleted 7y ago[deleted]
- sandworm101 7y agoExcept that at this moment Zoom is being used for all sorts of things. Guidelines or not, government and even military entities are hosting meetings via Zoom. Such leaks present a real risk of direct espionage, be it international or corporate. How many US senators are holding calls on Zoom? How many of those calls are about new spending? How useful might it be to be ahead of that curve?
- godelski 7y agoYou could make a counterargument that any official that is reusing passwords should be fired for gross incompetence and not following basic security protocols. I've seen people in the private sector get fired for less and they aren't working with sensitive data.
- exclusiv 7y agoI agree, but the US decided they didn't care about that for some reason. Several Secretaries of State as an example.
- godelski 7y agoWhich is a shame, because this reduces our national security. By a fair amount.
- wcoenen 7y agoCan you call a practice "gross incompetence" if everyone is doing it? The number of people using password managers is pretty close to zero. (I've recommended it to everybody for about a decade, and so far I think I managed to convince exactly one person.)
- drewbug 7y ago> Can you call a practice "gross incompetence" if everyone is doing it? I sure hope so
- 7y ago
- tgsovlerkhgsel 7y agoThere are defenses against credential stuffing - you can get lists of pwned passwords (e.g. from haveibeenpwned) and force users who use one to change it. You can run risk analysis on login and add CAPTCHAs to slow down attackers trying credentials, notify account owners on suspicious logins, possibly require confirmation via a link to an e-mail account if the login looks really phisy, make a different risk-convenience tradeoff (e.g. by enforcing 2FA), ... They won't prevent it completely, but you can make it harder. So I don't think (also) blaming the service for successful large-scale credential stuffing attacks is unreasonable.