What you need to know
- Nearly half a million Zoom accounts have been exposed and are being sold on the dark web.
- The exposed credentials are not the result of an attack on, or a breach of, Zoom's servers.
- Instead, they're the result of hackers trying credentials from previous leaks on users' Zoom accounts to see if they work.
If you were already concerned about the myriad security issues plaguing the incidental beneficiary of our combined desire for a video conferencing service in light of the pandemic currently ravaging the world, here's some more bad news: over 500,000 Zoom accounts are presently either on sale or being distributed on dark web hacker forums.
As Bleeping Computer reports, these are not the result of a breach of Zoom's servers. The cause of their exposure is much simpler: what's called a credential stuffing attack, a technique in which hackers aggregate exposed credentials from previous leaks from other vendors, and then try those leaked passwords on another app to see if it works. For the many people people who share passwords across platforms, this is a surprisingly effective tactic, and in Zoom's case, that amounts to at least half a million people.
These credentials have been circulating the dark web since the start of the month, and while some are being sold for pennies on the dollar, other hackers, it seems, are in a far more charitable mood and giving many of the accounts away for free.
One cybersecurity firm, Cyble, was, in fact, able to buy a 530,000-strong batch of such accounts off a dark web vendor, all for the very reasonable price of $0.002 per account. The information included user emails, passwords, meeting IDs, and host keys. Among those affected are several universities, as well as many major businesses, such as Citibank, Chase, and more.
This kind of attack does not apply to just Zoom, of course, as it can be used on any other service, as well, so long as the same credentials were used for multiple sites. It should, therefore, serve as a good reminder of the need for having different passwords for every service you use.
To check if any of your current accounts have been leaked as part of a breach, and thus susceptible to a credential stuffing attack, head over to Have I Been Pwned's extensive database of known breaches to see if one of your accounts might be affected, and change the passwords for any other services where you used the same email and password.
We may earn a commission for purchases using our links. Learn more.
First Samsung Galaxy Watch 3 update enables blood oxygen detection feature
Samsung has started rolling out the first software update for its Galaxy Watch 3. The update adds support for blood oxygen monitoring, VO2max, sleep scores, and more.
What's your favorite color for the Galaxy Note 20?
There are five stunning colors available for the Galaxy Note 20 series, but which one is the best? Here's what some of our AC forum members have to say.
The Google Pixel 4a is all the phone I need right now
You can keep your $1,300+ Mystic Bronze Galaxy Note 20 Ultras and Z Fold 2s, I'm going to head on over to the new and improved mid-tier and park it. There's never been a better time to spend a reasonable amount of money on a quality smartphone like the Google Pixel 4a.
Time to dump Chrome: 8 alternative desktop web browsers
If you getting frustrated with the lack of privacy, slower speeds or difficulty using extensions in Chrome, it's time to switch to one of these web browsers.