Thus, a bad actor will not be able to quickly narrow the pool of meetings to attempt to join. For each attempt, the page will load and attempt to join the meeting.

Meeting ID validation: Zoom will no longer automatically indicate if a meeting ID is valid or invalid.

Account and group level password enforcement: Password settings are enforceable at the account level and group level by the account admin.

Password additions by user: Users can add a password to already-scheduled future meetings.

Default passwords: Passwords are added by default to all future scheduled meetings.

Zoom's security changesĪs a result of Check Point's disclosure, Zoom introduced the following security features and functionalities into its technology:

Quickly validate the existence of each Zoom Meeting IDĬheck Point first contacted Zoom on Jand shared these findings as part of its standard responsible disclosure process.Ĭheck Point subsequently worked with Zoom to issue out a series of fixes and new functionality to fully patch the security flaws Check Point discovered.

In summary, a hacker could eavesdrop into a Zoom meeting by following three easy steps: Researchers found that around 4% of their randomly-generated meeting IDs led to a genuine Zoom meeting ID. Researchers at Check Point learned that a hacker could pre-generate a long list of Zoom Meeting ID numbers, use automation techniques to quickly verify if a respective Zoom Meeting ID was valid or not, and then gain entry into Zoom meetings that were not password protected.

Typically, these ID numbers comprise of 9, 10 and 11-digit numbers.

Zoom meeting IDs are access points for Zoom meeting participants. Check Point Research identified a major security flaw in Zoom, the video conferencing service used by over 60% of the Fortune 500.Ĭheck Point's researchers were able to prove that hackers could easily generate and verify Zoom Meeting IDs to target victims, enabling a hacker to eavesdrop on Zoom meetings, giving them intrusive access to all audio, video and documents shared throughout the duration of the meeting.

Zoom meeting id password