14 ms·

In 2020 a rash of anti-zoom propaganda that I'm almost certain was driven by Microsoft led to a company-wide prohibition on using anything other than Teams "for

by pydry 5y ago

In 2020 a rash of anti-zoom propaganda that I'm almost certain was driven by Microsoft led to a company-wide prohibition on using anything other than Teams "for security reasons" where i worked. This was, I am almost certain, inspired by Microsoft corporate sales getting their hooks into management. This was largely because of news stories like "end to end encryption doesnt really work as advertised" and "if you leave a room password unprotected bad people will enter". The level of press coverage was off the scale compared to what Teams got for far worse issues. The vulnerabilities werent nothing but they werent even in the same ballpark as the MS teams vulnerabilities foisted on us for "security reasons" like this howler they tried to cover up https://www.techradar.com/news/microsoft-may-have-downplayed-a-disastrous-teams-security-issue https://www.techradar.com/news/microsoft-may-have-downplayed...

JumpCrisscross 5y ago
> a rash of anti-zoom propaganda that I'm almost certain was driven by Microsoft Zoom had and continues to have a significant developer presence in China. Those individuals are subject to CCP coercion. There was also a time when they routed American calls through the mainland [1]. That has been fixed. But it remains excessive to cast all past criticism of Zoom as Microsoft's work. [1] https://techcrunch.com/2020/04/03/zoom-calls-routed-china/ https://techcrunch.com/2020/04/03/zoom-calls-routed-china/
- drcongo 5y ago
  Don't forget the directory traversal vulnerability too!
  - bitexploder 5y ago
    What’s remarkable, to me, is how publicized these issues in Zoom became vs other software. Google also seems to have pointed their vulnerability researchers at it. I remember thinking at the time they were getting a lot more scrutiny than most software in that realm, which has the same types of issues. Maybe it just entered the public Zeitgeist and it’s all a coincidence, but as a long time infosec consultant that does vulnerability research I found it curious at least.
    - drcongo 5y ago
      My take on it at the time was that while technically more knowledgable people were all happily having video calls in-browser for free, less tech savvy people were, by the millions, excitedly installing a pretty ropey app with root privileges and a whole bunch of vulnerabilities. It felt like a very necessary step when the normies thought they were entering the matrix.
- feldrim 5y ago
  I was thinking of posting the "end-to-end encryption that wasn't" but it was already mentioned in the article. Security flaws in a product are part of the life cycle, unavoidable and might be accepted as long as proper and timely response is taken. That's due diligence. But lying about security? That's not even negligence.
- pydry 5y ago
  I remember when they stories came out they were released in a suspiciously coordinated way. Once one died off another was released to build up momentum again and keep the idea humming in the public consciousness. I figured that it was done by a big party that had a trusted relationship with tech journalists because they bigged up vulnerabilities that were relatively minor to journalists who didnt seem to be aware of it. It's possible it wasnt Microsoft but the pattern of stories indicated Zoom was a public relations target of someone who freaked out after seeing how fast they were growing and MS certainly took full advantage.
  - detaro 5y ago
    The pattern of stories indicated that it was a thing that got attention, so people went digging for whatever they could find and push. You don't need a conspiracy for something to get way more attention than others.
    - newjersey 5y ago
      I am not trying to say Microsoft did anything unlawful. However, I am suspicious that these events in 2020 were coordinated. I remember we knew about Zoom vulnerabilities in 2018 as well but I rarely used video conferencing and definitely not for "daily stand ups" however, I wouldn't discount Microsoft tried its best to "educate" reporters. http://paulgraham.com/submarine.html http://paulgraham.com/submarine.html
    - luckylion 5y ago
      Would they drip-feed what they found though? Sounds like you need some form of coordination for that at least.
      - detaro 5y ago
        The "drip-feed" of people finding things not all at the same time, and basing their search on previous findings?
    - spoonjim 5y ago
- skinkestek 5y ago
  Exactly. For all my harsh criticism of both Microsoft and Google I wish them well: I want them to tidy up and become trustworthy. Because the alternative where China becomes world leading is actually worse. For all their warts Americans and American companies have done much good and gotten way more criticism for their faults compared to others. That doesn't however mean that they should get off the hook easily, only that we should work to put them in an position were we can actually trust each other.
  - pokepim 5y ago
    - skinkestek 5y ago
      I don't see how you got from my post to that conclusion. Did I forget a word or write something extremely unclear?
      - AnimalMuppet 5y ago
        No, you didn't. pokepim either misread, jumped to conclusions, or just saw a chance to grind an axe that they were just itching to grind.
- shitlord 5y ago
  Don't forget about the time a Zoom software engineer conspired with China's intelligence service to identify and harass dissidents residing in the US. The engineer is currently wanted by the FBI: https://www.justice.gov/opa/pr/china-based-executive-us-telecommunications-company-charged-disrupting-video-meetings https://www.justice.gov/opa/pr/china-based-executive-us-tele...
- ClumsyPilot 5y ago
  "Zoom had and continues to have a significant developer presence in China." So whats worse: a backdoor for China, or a giant hole for anyone interested? I guess the latter gives us esual opportunity...
  - nick__m 5y ago
    A link preview vulnerability in Teams vs a backdoor for China. I choose the vulnerability! At work we were briefed in detail by spy from CSIS to avoid Zoom. I trust the Canadian spy before a trust I company with CCP ties. The only thing I can add from that briefing is avoid Zoom, Huawei and product from Facebook, use Telegram if you can and Teams or Google current messaging solution if you can't.
    - homarp 5y ago
      > use Telegram also from CSIS briefing?
      - nick__m 5y ago
        I guess I misremebered it migth have been signal or matrix ... I am sure about the informal recommendation of things to avoid but I'm not so sure anymore about the informally recommanded list of things to use ...
    - FreezerburnV 5y ago
      Why Telegram specifically? Wouldn't Signal be considered a more private/secure messenger?
      - LordDragonfang 5y ago
        As a daily user of Signal, it still has a long way to go before it can be considered a user-friendly cross-platform solution.
  - einszwei 5y ago
    One of them can be fixed with a software update.
- More-nitors 5y ago
  > when they routed American calls through the mainland what about zoom-calls in other countries?
winter_squirrel 5y ago
> I'm almost certain was driven by Microsoft Would you happen to have any actual evidence to back this up with?
polote 5y ago
So you are blaming Zoom security issues coverage on Microsoft without any proof and the comment asking for evidence is flagged. What's going on HN ?
- bitcharmer 5y ago
  This is a plausible scenario, definitely worth considering especially given Microsoft's track record.
  - rndgermandude 5y ago
    Possible scenario, yes. Plausible? Maybe. But there was no evidence presented, so I can see why somebody would ask for some. Why that comment asking for some got flagged is beyond me. Another plausible explanation, at least in my humble opinion, but one without evidence either: Everybody and their kids (for school) were using some kind of video conferencing software for the first time in this kind of professional/educational setting and Zoom led the pack, which led to more interest by white hat researchers (and probably blackhats) as well as journalists. This newfound scrutiny lead to some first stories, and then people kept digging, because "Man exposes himself in virtual class room"[0] or "Does China spy on your business" or "New security problem uncovered. Is your kid safe in the virtual class room?" kind of stories generate a lot of impressions, and zoom had a lot of problems to uncover. Maybe it took some time to uncover the various problems, leading to a continuous stream of stories, maybe some outlets delayed publishing some stories, so they could milk a story at a time before coming out with the next one. Maybe Microsoft tried to capitalize on it, but that doesn't mean they were driving the news. [0] https://www.bbc.com/news/uk-england-south-yorkshire-55998557 https://www.bbc.com/news/uk-england-south-yorkshire-55998557
- oefrha 5y ago
  > the comment asking for evidence is flagged The comment came from a banned account whose comments are dead by default and need to be vouched. Discussing that is as off-topic as discussing voting, and not surprisingly it’s just noise now.
- politelemon 5y ago
ygra 5y ago
At least in Germany the most common reason not to use Zoom has been privacy and data protection, not so much security. Haven't heard the security reason yet.
- deleted 5y ago
  [deleted]
- moonchild 5y ago
  I believe that, at one point, it was possible for people to get into password-protected zoom rooms.
AshamedCaptain 5y ago
As an anecdote I know of a certain top-100 company that ditched their in-house competitor to Teams because MS made them a sweeter O365 deal. For a time management forced them to use Teams even though they were still developing AND licensing the in-house competitor to other companies. MS is really aggressive with Teams marketing (specially for large bureaucratic enterprise) and I could totally see them doing what you mention.
- deadbunny 5y ago
  The problem is that Slack (paid for) is hard to argue for vs. Teams when Teams is basically free if you already use o365. Management just see that chat app X is costing us XXk/year when Teams is "free". Easy savings.
- rapsey 5y ago
  And this is why MS is the king of enterprise.
  - wayoutthere 5y ago
    Yeah I’ve always maintained that MS is an enterprise software company that cosplays a consumer software company from time to time. They don’t make a ton of money outside their enterprise software division; the rest of the company more or less breaks even.
    - deleted 5y ago
      [deleted]
- jevoten 5y ago
  Discounting a different product to kill competition? I'm no antitrust expert, but isn't that illegal? If not, it should be.
  - AshamedCaptain 5y ago
    No, it would be abuse of dominant position; it is illegal only if you are in a dominant position to begin with.
rob74 5y ago
Honestly I fail to understand why Zoom seems to have so many fans. I find the UI confusing, on my Linux machine having a call with video will lead to the CPU cooler going into overdrive, I often have to leave and re-enter calls because audio output isn't working, etc. etc.
- ssharp 5y ago
  I think people like(d) Zoom because its core features were pretty simple to use. Yes, they do really weird stuff like having app settings that you can change in the app but account settings that you have to log in to your web account to change, but most of those features are more marginal. Google Meet, and this may have changed recently, lacked basic features like being able to quickly identify what window you are sharing. I've also seen far more call issues with Google and Teams than I have Zoom. As for Teams, I don't have a ton of quarrels with the video meeting system itself but it's desire to jam 20 other critical workflow pieces into the software made it a huge mess, at least from my experience with it on Mac: 1) The calendar sort of works, but not really, and most features you'd expect to accomplish with a calendar actually need to be done in Outlook and not teams. 2) The chat UI is really cumbersome compared to Slack and it quickly becomes difficult to find anything if you interact with a lot of people 3) The document file system is a total cluster. Let's say someone chats me a file to look at. I click the link and the file opens in my Teams window. I review it partially and have a question for the person who sent it. I go back to chat, send a message, and then try and go back to my document. Guess what? It's gone and I have to load it again. What fun! You just have to get into the habit of forcing the files to open in their native app or load them in a browser. I'm sure there is a way to prevent this from happening but what I've found with Microsoft applications (at least on Mac) is that basic functionality like this is completely unintuitive compared to any other productivity software I've seen.
- paavohtl 5y ago
  Of all the bad solutions, Zoom is the best one. It is the only one with a native (= not a glorified web browser) client, which you can definitely feel. Both Slack's and Teams' calls bring my top-end (Intel) MBP to its knees, while Zoom is the smoothest (though absolutely not without faults).
- 5y ago
albertopv 5y ago
What I know is that almost every company I have to deal with use Office 365, so they use Teams, and almost every school in my area use Google Suite (BigG got quite good at being the new Microsoft), so they use Google Meet. Almost no one use Zoom anymore simply becase it's not integrated with anything.
- extra88 5y ago
  Zoom integrates with a number of things pretty well (e.g. "Add Zoom to Meeting" button in Outlook create appointment interface) but it's not bundled with systems organizations already have, like O365 and Google Workspace (or whatever they're calling it these days). I'm sure Google Meet is used in most of K-12, I don't know about higher ed. The university I work for licensed Zoom pre-pandemic because it was superior to other videoconferencing systems like WebEx and GoToMeeting. The city council uses Zoom and my impression online is a lot of other local government functions that are now at least partially online do too. Don't Teams and Google Meet both require everyone to have an account just to join a meeting? Being able to join a Zoom meeting just by clicking a link, no account needed, is very good for user experience.
  - albertopv 5y ago
    Yeah, bundled is a more correct word, that's what I meant. AFAIK, Teams doesn't need an account, but I have used it only in a business context, so I'm not sure.
hoseja 5y ago
Airtight hatchway indeed.
christophilus 5y ago
It’s because Zoom was a joke from a security perspective, and the Chinese angle was a bad look, too. I use Zoom only via the browser. It doesn’t solve the potential spy problem, but it does solve the “not installing malware on my machine” problem.
blahblah12 5y ago
Um, just think of what you're suggesting. At MS some department (marketing, sales, product managers, devs?) somehow coordinated a bunch of press leaks (not sure how these were even determined to be 'leaks'), made sure that media outlets collectively believed that they were problematic, and then used those leaks to influence sales? It's a stretch to attribute to malice what can be attributable to other environmental factors. Could it be that Zoom was/is the dominant player in the video conferencing space in 2020/2021, so media outlets were keen to cover stories around Zoom? WebEx and Google Hangouts vulnerabilities have also not received as much coverage as Zoom.
- paulcole 5y ago
  > At MS some department (marketing, sales, product managers, devs?) somehow coordinated a bunch of press leaks (not sure how these were even determined to be 'leaks'), made sure that media outlets collectively believed that they were problematic, and then used those leaks to influence sales? You’re literally describing a thing that exists which is called public relations. I’ll admit it is unlikely for the call to be coming from inside the house, but this would be the exact kind of thing done by an agency contracted by Microsoft — for among other reasons, plausible deniability should anything become public. “Microsoft would never badmouth Zoom.” > media outlets were keen to cover stories around Zoom Hmmm, I wonder if there’s a field of professionals who make media outlets more keen to cover stories around a certain topic?
  - blahblah12 5y ago
    So we’re suggesting a 3rd-party PR firm likely coordinated public criticism about Zoom, an app that was undergoing hyper growth and entered the public consciousness in 2020 due to WFH and COVID. We don’t think media outlets would likely have wanted to voraciously cover Zoom stories because Zoom became one of the most widely used apps out of nowhere? The logic appears to be: I saw a lot of news stories about X, therefore X was caused by Y, without recognizing that Z is just as likely a cause for X.
    - paulcole 5y ago
sebow 5y ago
miles 5y ago
> In 2020 a rash of anti-zoom propaganda that I'm almost certain was driven by Microsoft... Perhaps it was driven by Zoom's poor security and privacy record? Zoom banned from New York City schools due to privacy and security flaws https://www.fastcompany.com/90486586/zoom-banned-from-new-york-city-schools-due-to-privacy-and-security-flaws https://www.fastcompany.com/90486586/zoom-banned-from-new-yo... Google Told Its Workers That They Can’t Use Zoom On Their Laptops Anymore https://www.buzzfeednews.com/article/pranavdixit/google-bans-zoom https://www.buzzfeednews.com/article/pranavdixit/google-bans... Elon Musk's SpaceX bans Zoom over privacy concerns https://www.reuters.com/article/us-spacex-zoom-video-commn/elon-musks-spacex-bans-zoom-over-privacy-concerns-memo-idUSKBN21J71H https://www.reuters.com/article/us-spacex-zoom-video-commn/e... Apple pushes silent macOS update to remove web server secretly installed by Zoom https://9to5mac.com/2019/07/10/zoom-apple-macos-update/ https://9to5mac.com/2019/07/10/zoom-apple-macos-update/ Taiwan joins Canada in banning Zoom for government video conferencing https://www.cbc.ca/news/science/taiwan-zoom-video-conference-1.5524384 https://www.cbc.ca/news/science/taiwan-zoom-video-conference... Is Zoom the Next Huawei? ‘Puppet of Chinese,’ Say Critics https://securityboulevard.com/2020/06/is-zoom-the-next-huawei-puppet-of-chinese-say-critics/ https://securityboulevard.com/2020/06/is-zoom-the-next-huawe... Zoom lied to users about end-to-end encryption for years, FTC says https://arstechnica.com/tech-policy/2020/11/zoom-lied-to-users-about-end-to-end-encryption-for-years-ftc-says/ https://arstechnica.com/tech-policy/2020/11/zoom-lied-to-use... DOJ charges highlight Zoom's China problem https://www.axios.com/china-zoom-charges-influence-1906e8e5-4ede-4a0b-b768-5fee1b8ad07c.html https://www.axios.com/china-zoom-charges-influence-1906e8e5-... Zoom needs to clean up its privacy act https://blogs.harvard.edu/doc/2020/03/27/zoom/ https://blogs.harvard.edu/doc/2020/03/27/zoom/ Zoom security issues: Here's everything that's gone wrong (so far) https://www.tomsguide.com/news/zoom-security-privacy-woes https://www.tomsguide.com/news/zoom-security-privacy-woes Mass move to work from home in coronavirus crisis creates opening for hackers: cyber experts https://www.reuters.com/article/us-health-coronavirus-cyber/mass-move-to-work-from-home-in-coronavirus-crisis-creates-opening-for-hackers-cyber-experts-idUSKBN2153YC https://www.reuters.com/article/us-health-coronavirus-cyber/... Security and Privacy Implications of Zoom https://www.schneier.com/blog/archives/2020/04/security_and_pr_1.html https://www.schneier.com/blog/archives/2020/04/security_and_... ‘Zoom is malware’: why experts worry about the video conferencing platform https://www.theguardian.com/technology/2020/apr/02/zoom-technology-security-coronavirus-video-conferencing https://www.theguardian.com/technology/2020/apr/02/zoom-tech... Ex-NSA hacker drops new zero-day doom for Zoom https://finance.yahoo.com/news/ex-nsa-hacker-drops-zero-140020837.html https://finance.yahoo.com/news/ex-nsa-hacker-drops-zero-1400... Maybe we shouldn’t use Zoom after all https://techcrunch.com/2020/03/31/zoom-at-your-own-risk/ https://techcrunch.com/2020/03/31/zoom-at-your-own-risk/ Attackers can use Zoom to steal users’ Windows credentials with no warning https://arstechnica.com/information-technology/2020/04/unpatched-zoom-bug-lets-attackers-steal-windows-credentials-with-no-warning/ https://arstechnica.com/information-technology/2020/04/unpat... The Zoom Privacy Backlash Is Only Getting Started https://www.wired.com/story/zoom-backlash-zero-days/ https://www.wired.com/story/zoom-backlash-zero-days/ Hackers Are Selling a Critical Zoom Zero-Day Exploit for $500,000 https://www.vice.com/en_us/article/qjdqgv/hackers-selling-critical-zoom-zero-day-exploit-for-500000 https://www.vice.com/en_us/article/qjdqgv/hackers-selling-cr... Researchers found and bought more than 500,000 Zoom passwords on the dark web for less than a cent each https://www.businessinsider.com/500000-zoom-accounts-sale-dark-web-2020-4 https://www.businessinsider.com/500000-zoom-accounts-sale-da... Beware of ‘ZoomBombing:’ screensharing filth to video calls https://techcrunch.com/2020/03/17/zoombombing/ https://techcrunch.com/2020/03/17/zoombombing/
jacquesm 5y ago
It wasn't propaganda, Zoom was about as insecure as they come. Teams is a pile of junk as well. The only one that seems to work reasonably well is Google 'Meet', and that's super frustrating because this was a solved problem in ... 1995.
dspillett 5y ago
> In 2020 a rash of anti-zoom propaganda The security issues like end-to-end encryption not actually being end-to-end encryption (unless you consider the man in the middle to be two ends, forwarding messages between the other two ends) were not propaganda - they really existed. It isn't even propaganda to say Zoom published very questionable statements (or if I allow myself to be slightly less charitable: the occasional outright lie) about those issues, because it is demonstrably true that this happened. > that I'm almost certain was driven by Microsoft You might need to present some evidence for that rather bold claim. > [comparison with past MS security issues] Teams is far from perfect, I am not a fan of it at all, and that security issue was real too IIRC, but you are using some very selective reasoning bringing it up at the same time as downplaying the serious flaws present in Zoom in the same period.
- eli 5y ago
  Zoom’s statements were in fact found by a jury to be false and misleading. If you used Zoom prior to last summer you are entitled to a (small) cash settlement https://www.zoommeetingsclassaction.com/ https://www.zoommeetingsclassaction.com/
  - dspillett 5y ago
    > If you used Zoom prior to last summer you are entitled to… Assuming you are a US citizen and were using zoom from a US location at the time.
    - eli 5y ago
      If it's bad enough to violate US false advertising law, I imagine it violates that of most countries.
      - dspillett 5y ago
        As far as I know there has been no similar court case outside the US, so the “you are entitled to” part doesn't count elsewhere. But yes, that is still a good indicator of how egregious the attempted misinforming was.
michaelcampbell 5y ago
I worked at Cisco, and the same arguments were made to use only WebEx and associated apps.
da_chicken 5y ago
> In 2020 a rash of anti-zoom propaganda that I'm almost certain was driven by Microsoft led to a company-wide prohibition on using anything other than Teams "for security reasons" where i worked. It was not propaganda. There was no privacy protection. I work for a K-12 and there was literally no way to configure Zoom such that it wasn't a massive FERPA violation waiting to happen. There was originally no way to gatekeep entrants to a virtual Zoom classroom. It even earned it's own term: Zoombombing [0]. It was completely unsuitable for use. It's like it was designed for the Internet of the 1990s. The only way we figure that so many districts were using it was: 1. It was free when basically nothing else was. 2. There was no time to evaluate alternatives when the pandemic started. 3. They were hoping nobody was looking too closely. 4. They didn't properly evaluate Zoom or they just didn't tell anyone how Zoom didn't ensure privacy. [0]: https://en.wikipedia.org/wiki/Zoombombing https://en.wikipedia.org/wiki/Zoombombing
- tinus_hn 5y ago
  It was the only accessible solution that supports a large number of participants and features easy enough installation. Teams was far more limited than Zoom and might still be.
  - aksss 5y ago
    Yeah, people at start of pandemic needed something easy and quick. Many of those people were relatively new to VC as an everyday part of the toolset. Zoom was focused on engaging people over VC quickly and easily, whereas Teams was/is like a Swiss army knife buried in a deep toolbox that you can only access through a subscription plan to the toolbox, so I imagine for non-tech teachers and whatnot, Zoom's approachability alone was a god-send. Also Teams/SfB, despite years and years of their users complaining about the limit to concurrent video feeds, never progressed past about four until Zoom came on the scene. They didn't just exceed Teams by a few, but like an order of magnitude. I use Teams every day but thank God for Zoom driving improvement. Just underscores the value of market competition.
albertopv 5y ago
Is this the propaganda you are talking about? https://twitter.com/campuscodi/status/1473642105633488899 https://twitter.com/campuscodi/status/1473642105633488899
mathattack 5y ago
At my prior employer, the MSFT rep lied so much about Teams that he created a rebellion costing them 8-9 figures in current and future deals. As a firm their ethics seem to have improved since the 90s but a few bad apples…
Fnoord 5y ago
You're almost certain given which evidence? You provide none.
GekkePrutser 5y ago
No it was not just that. Zoom put a backdoor (like, a full web server) in their Mac version and didn't even remove it when outed until Apple pushed an update that killed it for them. Which was a big unprecedented step. Mistakes happen. Total lack of action when it happens shows at the very least a total disinterest. They definitely did lack a focus on security and privacy at that time. I agree Microsoft is pretty aggressive and teams is a pig of an app in my opinion (slow and bloated) but zoom really dug their own grave too IMO. For what it's worth I find Jitsi delightful and super performant. I use teams a lot with work and Jitsi with our makerspace and it's just so much better at the video conferencing role.
rPlayer6554 5y ago
To be fair, Zoom had some issues even before it came to the spotlight. At one point when you installed the desktop client it also installed a hidden webserver for some reason. [0] [0] https://www.theverge.com/2019/7/10/20689644/apple-zoom-web-server-automatic-removal-silent-update-webcam-vulnerability https://www.theverge.com/2019/7/10/20689644/apple-zoom-web-s...
addicted 5y ago
The idea that it was MS Teams’s sales team behind the anti Zoom “propaganda” (lets accept that it was propaganda for now) doesn’t make much sense because it was never obvious that MS would be the beneficiary of people moving away from Zoom. Teams was half baked at best, and lacked a vast majority of the features that made Zoom useful. For example, it was only well into the pandemic that Teams gained the ability to have virtual backgrounds. You couldn’t have meetings with more than 10 or so people until very recently. Pretty much none of the features that made Zoom popular were even possible on Teams. The real beneficiary should have been Google Hangouts, but Google moved too slowly (actually, it would probably be more accurate to say that Google didn’t move at all…or if they did they moved backwards).

by pydry 5y ago

JumpCrisscross 5y ago

> a rash of anti-zoom propaganda that I'm almost certain was driven by Microsoft Zoom had and continues to have a significant developer presence in China. Those individuals are subject to CCP coercion. There was also a time when they routed American calls through the mainland [1]. That has been fixed. But it remains excessive to cast all past criticism of Zoom as Microsoft's work. [1] https://techcrunch.com/2020/04/03/zoom-calls-routed-china/ https://techcrunch.com/2020/04/03/zoom-calls-routed-china/

drcongo 5y ago
Don't forget the directory traversal vulnerability too!
- bitexploder 5y ago
  What’s remarkable, to me, is how publicized these issues in Zoom became vs other software. Google also seems to have pointed their vulnerability researchers at it. I remember thinking at the time they were getting a lot more scrutiny than most software in that realm, which has the same types of issues. Maybe it just entered the public Zeitgeist and it’s all a coincidence, but as a long time infosec consultant that does vulnerability research I found it curious at least.
  - drcongo 5y ago
    My take on it at the time was that while technically more knowledgable people were all happily having video calls in-browser for free, less tech savvy people were, by the millions, excitedly installing a pretty ropey app with root privileges and a whole bunch of vulnerabilities. It felt like a very necessary step when the normies thought they were entering the matrix.
feldrim 5y ago
I was thinking of posting the "end-to-end encryption that wasn't" but it was already mentioned in the article. Security flaws in a product are part of the life cycle, unavoidable and might be accepted as long as proper and timely response is taken. That's due diligence. But lying about security? That's not even negligence.
pydry 5y ago
I remember when they stories came out they were released in a suspiciously coordinated way. Once one died off another was released to build up momentum again and keep the idea humming in the public consciousness. I figured that it was done by a big party that had a trusted relationship with tech journalists because they bigged up vulnerabilities that were relatively minor to journalists who didnt seem to be aware of it. It's possible it wasnt Microsoft but the pattern of stories indicated Zoom was a public relations target of someone who freaked out after seeing how fast they were growing and MS certainly took full advantage.
- detaro 5y ago
  The pattern of stories indicated that it was a thing that got attention, so people went digging for whatever they could find and push. You don't need a conspiracy for something to get way more attention than others.
  - newjersey 5y ago
    I am not trying to say Microsoft did anything unlawful. However, I am suspicious that these events in 2020 were coordinated. I remember we knew about Zoom vulnerabilities in 2018 as well but I rarely used video conferencing and definitely not for "daily stand ups" however, I wouldn't discount Microsoft tried its best to "educate" reporters. http://paulgraham.com/submarine.html http://paulgraham.com/submarine.html
  - luckylion 5y ago
    Would they drip-feed what they found though? Sounds like you need some form of coordination for that at least.
    - detaro 5y ago
      The "drip-feed" of people finding things not all at the same time, and basing their search on previous findings?
  - spoonjim 5y ago
skinkestek 5y ago
Exactly. For all my harsh criticism of both Microsoft and Google I wish them well: I want them to tidy up and become trustworthy. Because the alternative where China becomes world leading is actually worse. For all their warts Americans and American companies have done much good and gotten way more criticism for their faults compared to others. That doesn't however mean that they should get off the hook easily, only that we should work to put them in an position were we can actually trust each other.
- pokepim 5y ago
  - skinkestek 5y ago
    I don't see how you got from my post to that conclusion. Did I forget a word or write something extremely unclear?
    - AnimalMuppet 5y ago
      No, you didn't. pokepim either misread, jumped to conclusions, or just saw a chance to grind an axe that they were just itching to grind.
shitlord 5y ago
Don't forget about the time a Zoom software engineer conspired with China's intelligence service to identify and harass dissidents residing in the US. The engineer is currently wanted by the FBI: https://www.justice.gov/opa/pr/china-based-executive-us-telecommunications-company-charged-disrupting-video-meetings https://www.justice.gov/opa/pr/china-based-executive-us-tele...
ClumsyPilot 5y ago
"Zoom had and continues to have a significant developer presence in China." So whats worse: a backdoor for China, or a giant hole for anyone interested? I guess the latter gives us esual opportunity...
- nick__m 5y ago
  A link preview vulnerability in Teams vs a backdoor for China. I choose the vulnerability! At work we were briefed in detail by spy from CSIS to avoid Zoom. I trust the Canadian spy before a trust I company with CCP ties. The only thing I can add from that briefing is avoid Zoom, Huawei and product from Facebook, use Telegram if you can and Teams or Google current messaging solution if you can't.
  - homarp 5y ago
    > use Telegram also from CSIS briefing?
    - nick__m 5y ago
      I guess I misremebered it migth have been signal or matrix ... I am sure about the informal recommendation of things to avoid but I'm not so sure anymore about the informally recommanded list of things to use ...
  - FreezerburnV 5y ago
    Why Telegram specifically? Wouldn't Signal be considered a more private/secure messenger?
    - LordDragonfang 5y ago
      As a daily user of Signal, it still has a long way to go before it can be considered a user-friendly cross-platform solution.
- einszwei 5y ago
  One of them can be fixed with a software update.
More-nitors 5y ago
> when they routed American calls through the mainland what about zoom-calls in other countries?

winter_squirrel 5y ago

> I'm almost certain was driven by Microsoft Would you happen to have any actual evidence to back this up with?

polote 5y ago

So you are blaming Zoom security issues coverage on Microsoft without any proof and the comment asking for evidence is flagged. What's going on HN ?

bitcharmer 5y ago
This is a plausible scenario, definitely worth considering especially given Microsoft's track record.
- rndgermandude 5y ago
  Possible scenario, yes. Plausible? Maybe. But there was no evidence presented, so I can see why somebody would ask for some. Why that comment asking for some got flagged is beyond me. Another plausible explanation, at least in my humble opinion, but one without evidence either: Everybody and their kids (for school) were using some kind of video conferencing software for the first time in this kind of professional/educational setting and Zoom led the pack, which led to more interest by white hat researchers (and probably blackhats) as well as journalists. This newfound scrutiny lead to some first stories, and then people kept digging, because "Man exposes himself in virtual class room"[0] or "Does China spy on your business" or "New security problem uncovered. Is your kid safe in the virtual class room?" kind of stories generate a lot of impressions, and zoom had a lot of problems to uncover. Maybe it took some time to uncover the various problems, leading to a continuous stream of stories, maybe some outlets delayed publishing some stories, so they could milk a story at a time before coming out with the next one. Maybe Microsoft tried to capitalize on it, but that doesn't mean they were driving the news. [0] https://www.bbc.com/news/uk-england-south-yorkshire-55998557 https://www.bbc.com/news/uk-england-south-yorkshire-55998557
oefrha 5y ago
> the comment asking for evidence is flagged The comment came from a banned account whose comments are dead by default and need to be vouched. Discussing that is as off-topic as discussing voting, and not surprisingly it’s just noise now.
politelemon 5y ago

ygra 5y ago

At least in Germany the most common reason not to use Zoom has been privacy and data protection, not so much security. Haven't heard the security reason yet.

deleted 5y ago
[deleted]
moonchild 5y ago
I believe that, at one point, it was possible for people to get into password-protected zoom rooms.

AshamedCaptain 5y ago

As an anecdote I know of a certain top-100 company that ditched their in-house competitor to Teams because MS made them a sweeter O365 deal. For a time management forced them to use Teams even though they were still developing AND licensing the in-house competitor to other companies. MS is really aggressive with Teams marketing (specially for large bureaucratic enterprise) and I could totally see them doing what you mention.

deadbunny 5y ago
The problem is that Slack (paid for) is hard to argue for vs. Teams when Teams is basically free if you already use o365. Management just see that chat app X is costing us XXk/year when Teams is "free". Easy savings.
rapsey 5y ago
And this is why MS is the king of enterprise.
- wayoutthere 5y ago
  Yeah I’ve always maintained that MS is an enterprise software company that cosplays a consumer software company from time to time. They don’t make a ton of money outside their enterprise software division; the rest of the company more or less breaks even.
  - deleted 5y ago
    [deleted]
jevoten 5y ago
Discounting a different product to kill competition? I'm no antitrust expert, but isn't that illegal? If not, it should be.
- AshamedCaptain 5y ago
  No, it would be abuse of dominant position; it is illegal only if you are in a dominant position to begin with.

rob74 5y ago

Honestly I fail to understand why Zoom seems to have so many fans. I find the UI confusing, on my Linux machine having a call with video will lead to the CPU cooler going into overdrive, I often have to leave and re-enter calls because audio output isn't working, etc. etc.

ssharp 5y ago
I think people like(d) Zoom because its core features were pretty simple to use. Yes, they do really weird stuff like having app settings that you can change in the app but account settings that you have to log in to your web account to change, but most of those features are more marginal. Google Meet, and this may have changed recently, lacked basic features like being able to quickly identify what window you are sharing. I've also seen far more call issues with Google and Teams than I have Zoom. As for Teams, I don't have a ton of quarrels with the video meeting system itself but it's desire to jam 20 other critical workflow pieces into the software made it a huge mess, at least from my experience with it on Mac: 1) The calendar sort of works, but not really, and most features you'd expect to accomplish with a calendar actually need to be done in Outlook and not teams. 2) The chat UI is really cumbersome compared to Slack and it quickly becomes difficult to find anything if you interact with a lot of people 3) The document file system is a total cluster. Let's say someone chats me a file to look at. I click the link and the file opens in my Teams window. I review it partially and have a question for the person who sent it. I go back to chat, send a message, and then try and go back to my document. Guess what? It's gone and I have to load it again. What fun! You just have to get into the habit of forcing the files to open in their native app or load them in a browser. I'm sure there is a way to prevent this from happening but what I've found with Microsoft applications (at least on Mac) is that basic functionality like this is completely unintuitive compared to any other productivity software I've seen.
paavohtl 5y ago
Of all the bad solutions, Zoom is the best one. It is the only one with a native (= not a glorified web browser) client, which you can definitely feel. Both Slack's and Teams' calls bring my top-end (Intel) MBP to its knees, while Zoom is the smoothest (though absolutely not without faults).
5y ago

albertopv 5y ago

What I know is that almost every company I have to deal with use Office 365, so they use Teams, and almost every school in my area use Google Suite (BigG got quite good at being the new Microsoft), so they use Google Meet. Almost no one use Zoom anymore simply becase it's not integrated with anything.

extra88 5y ago
Zoom integrates with a number of things pretty well (e.g. "Add Zoom to Meeting" button in Outlook create appointment interface) but it's not bundled with systems organizations already have, like O365 and Google Workspace (or whatever they're calling it these days). I'm sure Google Meet is used in most of K-12, I don't know about higher ed. The university I work for licensed Zoom pre-pandemic because it was superior to other videoconferencing systems like WebEx and GoToMeeting. The city council uses Zoom and my impression online is a lot of other local government functions that are now at least partially online do too. Don't Teams and Google Meet both require everyone to have an account just to join a meeting? Being able to join a Zoom meeting just by clicking a link, no account needed, is very good for user experience.
- albertopv 5y ago
  Yeah, bundled is a more correct word, that's what I meant. AFAIK, Teams doesn't need an account, but I have used it only in a business context, so I'm not sure.

hoseja 5y ago

Airtight hatchway indeed.

christophilus 5y ago

It’s because Zoom was a joke from a security perspective, and the Chinese angle was a bad look, too. I use Zoom only via the browser. It doesn’t solve the potential spy problem, but it does solve the “not installing malware on my machine” problem.

blahblah12 5y ago

Um, just think of what you're suggesting. At MS some department (marketing, sales, product managers, devs?) somehow coordinated a bunch of press leaks (not sure how these were even determined to be 'leaks'), made sure that media outlets collectively believed that they were problematic, and then used those leaks to influence sales? It's a stretch to attribute to malice what can be attributable to other environmental factors. Could it be that Zoom was/is the dominant player in the video conferencing space in 2020/2021, so media outlets were keen to cover stories around Zoom? WebEx and Google Hangouts vulnerabilities have also not received as much coverage as Zoom.

paulcole 5y ago
> At MS some department (marketing, sales, product managers, devs?) somehow coordinated a bunch of press leaks (not sure how these were even determined to be 'leaks'), made sure that media outlets collectively believed that they were problematic, and then used those leaks to influence sales? You’re literally describing a thing that exists which is called public relations. I’ll admit it is unlikely for the call to be coming from inside the house, but this would be the exact kind of thing done by an agency contracted by Microsoft — for among other reasons, plausible deniability should anything become public. “Microsoft would never badmouth Zoom.” > media outlets were keen to cover stories around Zoom Hmmm, I wonder if there’s a field of professionals who make media outlets more keen to cover stories around a certain topic?
- blahblah12 5y ago
  So we’re suggesting a 3rd-party PR firm likely coordinated public criticism about Zoom, an app that was undergoing hyper growth and entered the public consciousness in 2020 due to WFH and COVID. We don’t think media outlets would likely have wanted to voraciously cover Zoom stories because Zoom became one of the most widely used apps out of nowhere? The logic appears to be: I saw a lot of news stories about X, therefore X was caused by Y, without recognizing that Z is just as likely a cause for X.
  - paulcole 5y ago

sebow 5y ago

miles 5y ago

> In 2020 a rash of anti-zoom propaganda that I'm almost certain was driven by Microsoft... Perhaps it was driven by Zoom's poor security and privacy record? Zoom banned from New York City schools due to privacy and security flaws https://www.fastcompany.com/90486586/zoom-banned-from-new-york-city-schools-due-to-privacy-and-security-flaws https://www.fastcompany.com/90486586/zoom-banned-from-new-yo... Google Told Its Workers That They Can’t Use Zoom On Their Laptops Anymore https://www.buzzfeednews.com/article/pranavdixit/google-bans-zoom https://www.buzzfeednews.com/article/pranavdixit/google-bans... Elon Musk's SpaceX bans Zoom over privacy concerns https://www.reuters.com/article/us-spacex-zoom-video-commn/elon-musks-spacex-bans-zoom-over-privacy-concerns-memo-idUSKBN21J71H https://www.reuters.com/article/us-spacex-zoom-video-commn/e... Apple pushes silent macOS update to remove web server secretly installed by Zoom https://9to5mac.com/2019/07/10/zoom-apple-macos-update/ https://9to5mac.com/2019/07/10/zoom-apple-macos-update/ Taiwan joins Canada in banning Zoom for government video conferencing https://www.cbc.ca/news/science/taiwan-zoom-video-conference-1.5524384 https://www.cbc.ca/news/science/taiwan-zoom-video-conference... Is Zoom the Next Huawei? ‘Puppet of Chinese,’ Say Critics https://securityboulevard.com/2020/06/is-zoom-the-next-huawei-puppet-of-chinese-say-critics/ https://securityboulevard.com/2020/06/is-zoom-the-next-huawe... Zoom lied to users about end-to-end encryption for years, FTC says https://arstechnica.com/tech-policy/2020/11/zoom-lied-to-users-about-end-to-end-encryption-for-years-ftc-says/ https://arstechnica.com/tech-policy/2020/11/zoom-lied-to-use... DOJ charges highlight Zoom's China problem https://www.axios.com/china-zoom-charges-influence-1906e8e5-4ede-4a0b-b768-5fee1b8ad07c.html https://www.axios.com/china-zoom-charges-influence-1906e8e5-... Zoom needs to clean up its privacy act https://blogs.harvard.edu/doc/2020/03/27/zoom/ https://blogs.harvard.edu/doc/2020/03/27/zoom/ Zoom security issues: Here's everything that's gone wrong (so far) https://www.tomsguide.com/news/zoom-security-privacy-woes https://www.tomsguide.com/news/zoom-security-privacy-woes Mass move to work from home in coronavirus crisis creates opening for hackers: cyber experts https://www.reuters.com/article/us-health-coronavirus-cyber/mass-move-to-work-from-home-in-coronavirus-crisis-creates-opening-for-hackers-cyber-experts-idUSKBN2153YC https://www.reuters.com/article/us-health-coronavirus-cyber/... Security and Privacy Implications of Zoom https://www.schneier.com/blog/archives/2020/04/security_and_pr_1.html https://www.schneier.com/blog/archives/2020/04/security_and_... ‘Zoom is malware’: why experts worry about the video conferencing platform https://www.theguardian.com/technology/2020/apr/02/zoom-technology-security-coronavirus-video-conferencing https://www.theguardian.com/technology/2020/apr/02/zoom-tech... Ex-NSA hacker drops new zero-day doom for Zoom https://finance.yahoo.com/news/ex-nsa-hacker-drops-zero-140020837.html https://finance.yahoo.com/news/ex-nsa-hacker-drops-zero-1400... Maybe we shouldn’t use Zoom after all https://techcrunch.com/2020/03/31/zoom-at-your-own-risk/ https://techcrunch.com/2020/03/31/zoom-at-your-own-risk/ Attackers can use Zoom to steal users’ Windows credentials with no warning https://arstechnica.com/information-technology/2020/04/unpatched-zoom-bug-lets-attackers-steal-windows-credentials-with-no-warning/ https://arstechnica.com/information-technology/2020/04/unpat... The Zoom Privacy Backlash Is Only Getting Started https://www.wired.com/story/zoom-backlash-zero-days/ https://www.wired.com/story/zoom-backlash-zero-days/ Hackers Are Selling a Critical Zoom Zero-Day Exploit for $500,000 https://www.vice.com/en_us/article/qjdqgv/hackers-selling-critical-zoom-zero-day-exploit-for-500000 https://www.vice.com/en_us/article/qjdqgv/hackers-selling-cr... Researchers found and bought more than 500,000 Zoom passwords on the dark web for less than a cent each https://www.businessinsider.com/500000-zoom-accounts-sale-dark-web-2020-4 https://www.businessinsider.com/500000-zoom-accounts-sale-da... Beware of ‘ZoomBombing:’ screensharing filth to video calls https://techcrunch.com/2020/03/17/zoombombing/ https://techcrunch.com/2020/03/17/zoombombing/

jacquesm 5y ago

It wasn't propaganda, Zoom was about as insecure as they come. Teams is a pile of junk as well. The only one that seems to work reasonably well is Google 'Meet', and that's super frustrating because this was a solved problem in ... 1995.

dspillett 5y ago

> In 2020 a rash of anti-zoom propaganda The security issues like end-to-end encryption not actually being end-to-end encryption (unless you consider the man in the middle to be two ends, forwarding messages between the other two ends) were not propaganda - they really existed. It isn't even propaganda to say Zoom published very questionable statements (or if I allow myself to be slightly less charitable: the occasional outright lie) about those issues, because it is demonstrably true that this happened. > that I'm almost certain was driven by Microsoft You might need to present some evidence for that rather bold claim. > [comparison with past MS security issues] Teams is far from perfect, I am not a fan of it at all, and that security issue was real too IIRC, but you are using some very selective reasoning bringing it up at the same time as downplaying the serious flaws present in Zoom in the same period.

eli 5y ago
Zoom’s statements were in fact found by a jury to be false and misleading. If you used Zoom prior to last summer you are entitled to a (small) cash settlement https://www.zoommeetingsclassaction.com/ https://www.zoommeetingsclassaction.com/
- dspillett 5y ago
  > If you used Zoom prior to last summer you are entitled to… Assuming you are a US citizen and were using zoom from a US location at the time.
  - eli 5y ago
    If it's bad enough to violate US false advertising law, I imagine it violates that of most countries.
    - dspillett 5y ago
      As far as I know there has been no similar court case outside the US, so the “you are entitled to” part doesn't count elsewhere. But yes, that is still a good indicator of how egregious the attempted misinforming was.

michaelcampbell 5y ago

I worked at Cisco, and the same arguments were made to use only WebEx and associated apps.

da_chicken 5y ago

> In 2020 a rash of anti-zoom propaganda that I'm almost certain was driven by Microsoft led to a company-wide prohibition on using anything other than Teams "for security reasons" where i worked. It was not propaganda. There was no privacy protection. I work for a K-12 and there was literally no way to configure Zoom such that it wasn't a massive FERPA violation waiting to happen. There was originally no way to gatekeep entrants to a virtual Zoom classroom. It even earned it's own term: Zoombombing [0]. It was completely unsuitable for use. It's like it was designed for the Internet of the 1990s. The only way we figure that so many districts were using it was: 1. It was free when basically nothing else was. 2. There was no time to evaluate alternatives when the pandemic started. 3. They were hoping nobody was looking too closely. 4. They didn't properly evaluate Zoom or they just didn't tell anyone how Zoom didn't ensure privacy. [0]: https://en.wikipedia.org/wiki/Zoombombing https://en.wikipedia.org/wiki/Zoombombing

tinus_hn 5y ago
It was the only accessible solution that supports a large number of participants and features easy enough installation. Teams was far more limited than Zoom and might still be.
- aksss 5y ago
  Yeah, people at start of pandemic needed something easy and quick. Many of those people were relatively new to VC as an everyday part of the toolset. Zoom was focused on engaging people over VC quickly and easily, whereas Teams was/is like a Swiss army knife buried in a deep toolbox that you can only access through a subscription plan to the toolbox, so I imagine for non-tech teachers and whatnot, Zoom's approachability alone was a god-send. Also Teams/SfB, despite years and years of their users complaining about the limit to concurrent video feeds, never progressed past about four until Zoom came on the scene. They didn't just exceed Teams by a few, but like an order of magnitude. I use Teams every day but thank God for Zoom driving improvement. Just underscores the value of market competition.

albertopv 5y ago

Is this the propaganda you are talking about? https://twitter.com/campuscodi/status/1473642105633488899 https://twitter.com/campuscodi/status/1473642105633488899

mathattack 5y ago

At my prior employer, the MSFT rep lied so much about Teams that he created a rebellion costing them 8-9 figures in current and future deals. As a firm their ethics seem to have improved since the 90s but a few bad apples…

Fnoord 5y ago

You're almost certain given which evidence? You provide none.

GekkePrutser 5y ago

No it was not just that. Zoom put a backdoor (like, a full web server) in their Mac version and didn't even remove it when outed until Apple pushed an update that killed it for them. Which was a big unprecedented step. Mistakes happen. Total lack of action when it happens shows at the very least a total disinterest. They definitely did lack a focus on security and privacy at that time. I agree Microsoft is pretty aggressive and teams is a pig of an app in my opinion (slow and bloated) but zoom really dug their own grave too IMO. For what it's worth I find Jitsi delightful and super performant. I use teams a lot with work and Jitsi with our makerspace and it's just so much better at the video conferencing role.

rPlayer6554 5y ago

To be fair, Zoom had some issues even before it came to the spotlight. At one point when you installed the desktop client it also installed a hidden webserver for some reason. [0] [0] https://www.theverge.com/2019/7/10/20689644/apple-zoom-web-server-automatic-removal-silent-update-webcam-vulnerability https://www.theverge.com/2019/7/10/20689644/apple-zoom-web-s...

addicted 5y ago

The idea that it was MS Teams’s sales team behind the anti Zoom “propaganda” (lets accept that it was propaganda for now) doesn’t make much sense because it was never obvious that MS would be the beneficiary of people moving away from Zoom. Teams was half baked at best, and lacked a vast majority of the features that made Zoom useful. For example, it was only well into the pandemic that Teams gained the ability to have virtual backgrounds. You couldn’t have meetings with more than 10 or so people until very recently. Pretty much none of the features that made Zoom popular were even possible on Teams. The real beneficiary should have been Google Hangouts, but Google moved too slowly (actually, it would probably be more accurate to say that Google didn’t move at all…or if they did they moved backwards).