Spreading Awareness: Messages Through Zoom Can Expose People To Cyberattacks

There is no denying that Zoom saw a soar in popularity during the early days of the pandemic. The videoconferencing platform became a staple for connection and communication. But just like anything else, it’s not without its faults or vulnerabilities. These vulnerabilities could be exploited to compromise users over chat by sending specifically crafted, extensible messaging and presence protocol messages and executing malicious code. As a team of IT consultants In Seattle, it’s a big part of our job to stay current on the latest in cybersecurity news, so that we can better assist our clients with similar issues. For today’s blog, let’s discuss spreading awareness-messages through Zoom can expose people to cyberattacks and zoom security issues.

What We Know About The Recent Zoom Security Issues

There were four vulnerabilities that were discovered by Ivan Fratric of Google Project Zero. Fratric tracked the flaws from CVE-2022-22784 through CVE-2022022787 and reported them in February 2022. The bugs included the following:

• Improper XML parsing in Zoom Client for meetings

• Improperly constrained session cookies in Zoom Client for meetings

• Update package downgrade in Zoom client for meetings

• Insufficient hostname validation during server switch in Zoom client for meetings

XMPP is the standard upon which Zoom’s chat feature is built. A cyber-attacker can moonlight as a regular user through exploitation of the previously-mentioned vulnerabilities. In turn, the person can connect to a suspicious server and download an update, leading to arbitrary code execution, stemming from a downgrade attack. The issues at the forefront of these weak points is the ability of a cyber attacker to find insufficiencies between the XML parsers in the software’s client and server. When this occurs, XMPP stanzas can be sent to the victim of the attack. This allows hackers to take advantage of software updates, weaponizing the process and delivering an outdated, less stable version of Zoom to potential targets through a malicious server, are the biggest reasons for zoom security issues.

Combatting These Zoom Security Issues and Cyber-Attacks: Advice From Our IT Consultants In Seattle

As a form of social engineering, attacks of this nature are rather arduous to prevent, with attackers using incredibly savvy methods to trick users into doing the wrong thing (e.g., clicking a bad link that downloads malware). Attackers are becoming more clever at deploying a myriad of tactics, such as supply chain attacks and social engineering, to target organizational issues with inherent hybrid work, human error, and shadow IT. We recommend deploying multi-factor authentication. When used correctly, it decreases the chances of becoming a victim to identify-first cyber-attacks. Here are some additional tips that we strongly believe will protect your business from these malicious threats.

Installing Antivirus Software And Endpoint Protection

It costs more to lose data than to prevent its loss. Antivirus software and endpoint protection services offer value for money by establishing a firewall to protect your network from viruses and forced attempts to access your systems. They will scan your devices and portable disks for malware, which prevents malicious actors from breaching your business’ online shield. 

Outsource Protection To Our IT Consultants In Seattle

Cybersecurity can be a difficult task for small businesses to undertake. They are probably working with smaller budgets for their IT departments, while others simply cannot afford a large team of in-house online security experts. By outsourcing the job to RHYNO Networks, you will always get a team of skilled and dedicated professionals who will monitor your network, check online threat exposure, and handle the many cyberattacks that are so prevalent in this day and age. In doing so, it frees you up to focus on the core responsibilities of your business. 

Teach Employees About Online Safety

Employees need to be upskilled on transferring information securely, preventing unauthorized access to company networks, going on dangerous websites, or falling for online scams. You have heard us talk about phishing scams before. This is when cyber criminals pretend to be legitimate organizations, in order to obtain personal info from employees. What does this look like? It should be a joint effort between our IT consultants in Seattle and your business, to create a cyber incident response plan that empowers employees to handle a data breach and report potential threats. Employees should be encouraged to think before sending out personal or sensitive information, especially if the request sounds suspicious. 

Spreading Awareness On Zoom Security Issues & Cybersecurity Threats: Guidance From Our IT Consultants In Seattle

We hope that you garnered some valuable insights on the dangers of cybersecurity threats! If your business is in need of assistance for creating a plan of protection from these threats, contact us today to discuss specifics!