Jessica Goodfellow
Apr 15, 2020

Thousands of Zoom accounts are being sold on the dark web

TECH BITES: More than half a million Zoom accounts are being sold or shared on the dark web.

Thousands of Zoom accounts are being sold on the dark web

A cybersecurity firm has discovered huge volumes of Zoom account details and passwords being sold to hackers on the dark web—which helps explain why there have been so many reports of 'Zoombombing' recently.

Cybersecurity intelligence firm Cyble told publisher BleepingComputer that it was able to purchase approximately 530,000 Zoom credentials—that includes stolen email addresses, passwords, personal meeting URLs, and HostKeys—on the dark web for less than a penny each. It purchased the stolen credentials to warn its customers of a security breach. Cyble said the stolen accounts include ones for well-known companies such as Chase and Citibank, and educational institutions.

The company has also noticed account details being shared for free on hacker forums since the beginning of April.

It is believed that the stolen account details were gathered from past data breaches and linked to Zoom accounts that use the same email address and password combinations—a technique known a credential stuffing.

In a statement sent to Campaign, Zoom said they have already hired intelligence firms to help find these "password dumps" so that they can reset affected users' passwords. Here's the full statement:

It is common for web services that serve consumers to be targeted by this type of activity, which typically involves bad actors testing large numbers of already compromised credentials from other platforms to see if users have reused them elsewhere. This kind of attack generally does not affect our large enterprise customers that use their own single sign-on systems. We have already hired multiple intelligence firms to find these password dumps and the tools used to create them, as well as a firm that has shut down thousands of websites attempting to trick users into downloading malware or giving up their credentials. We continue to investigate, are locking accounts we have found to be compromised, asking users to change their passwords to something more secure, and are looking at implementing additional technology solutions to bolster our efforts.

This is the latest in a string of privacy and security concerns surrounding Zoom, which has shot up in popularity as many countries around the world have entered lockdown. This includes privacy violations that apparently put Zoom in breach of GDPR until recently.

The availability of stolen logins on the dark web could help explain why there have been so many reports of 'Zoombombing' over the past few months, in which a hacker breaks into a private meeting to cause disruption. A recent incident in Singapore saw hackers intercept a school lesson and broadcast obscene pictures to some students, leading the government to temporarily ban schools from using the video-conferencing tool. The Ministry of Education is now allowing schools to progressively resume the use of Zoom after having introducing additional layers of defence.

This article is filed under...
Tech Bites: Brief adtech and martech news items

Have a tech or media tidbit that could be included in this column? Email us at: [email protected]

 

Related Articles

Just Published

1 day ago

Purpose, laughs, and boppable tunes: Spikes jury ...

SPIKES ASIA X CAMPAIGN: Presidents and members of several Spikes Asia juries share the top trends they spotted in the jury Zoom rooms, with video examples.

1 day ago

Crash Course: How to tell engaging short-form stories

To round off a week of creativity-themed content during Spikes Asia X Campaign festival, this Crash Course provides useful tips on how to build story arcs and create thumb-stopping campaigns for short-form.

1 day ago

Lessons from Tesla, Apple and yoga (yes, yoga) in ...

SPIKES ASIA X CAMPAIGN: Creatives need to drive relevance for sustainable options, instead of virtue-signalling about sustainability, argues Gulshan Singh of FCB Interface.

1 day ago

Spikes Asia Awards 2021: Campaign's contenders 3

As the juries make their final selections ahead of the March 1 winners announcement, Campaign Asia-Pacific's editorial team has once again scoured through the 2021 shortlist to pick out the work we expect to win.