What you need to know
- Nearly half a million Zoom accounts have been exposed and are being sold on the dark web.
- The exposed credentials are not the result of an attack on, or a breach of, Zoom's servers.
- Instead, they're the result of hackers trying credentials from previous leaks on users' Zoom accounts to see if they work.
If you were already concerned about the myriad security issues plaguing the incidental beneficiary of our combined desire for a video conferencing service in light of the pandemic currently ravaging the world, here's some more bad news: over 500,000 Zoom accounts are presently either on sale or being distributed on dark web hacker forums.
As Bleeping Computer reports, these are not the result of a breach of Zoom's servers. The cause of their exposure is much simpler: what's called a credential stuffing attack, a technique in which hackers aggregate exposed credentials from previous leaks from other vendors, and then try those leaked passwords on another app to see if it works. For the many people people who share passwords across platforms, this is a surprisingly effective tactic, and in Zoom's case, that amounts to at least half a million people.
These credentials have been circulating the dark web since the start of the month, and while some are being sold for pennies on the dollar, other hackers, it seems, are in a far more charitable mood and giving many of the accounts away for free.
One cybersecurity firm, Cyble, was, in fact, able to buy a 530,000-strong batch of such accounts off a dark web vendor, all for the very reasonable price of $0.002 per account. The information included user emails, passwords, meeting IDs, and host keys. Among those affected are several universities, as well as many major businesses, such as Citibank, Chase, and more.
This kind of attack does not apply to just Zoom, of course, as it can be used on any other service, as well, so long as the same credentials were used for multiple sites. It should, therefore, serve as a good reminder of the need for having different passwords for every service you use.
To check if any of your current accounts have been leaked as part of a breach, and thus susceptible to a credential stuffing attack, head over to Have I Been Pwned's extensive database of known breaches to see if one of your accounts might be affected, and change the passwords for any other services where you used the same email and password.
We may earn a commission for purchases using our links. Learn more.
One UI 2.5 tracker: When will my Samsung Galaxy be updated?
Samsung's next update for One UI is rolling out. Find out which phones are getting it and when!
What do you think about the leaked Galaxy S21 renders?
Thanks to a massive leak over the weekend, we now know what the Galaxy S21 and S21 Ultra look like. What's your take on how the phones are shaping up?
OnePlus has lost the one thing that made it unique — and that's a problem
The new OnePlus 8T looks like a great phone — but not a unique one. With fierce competition from Samsung, Google, and others, OnePlus is losing its one unique edge that it used to rely on.
Here are the best phone stands for Zoom & Google Meet in 2020
A stand can come in handy when conducting a virtual meeting over Zoom, Google Meet, or other video calling services. And the right one needs to have specific features that meet your needs. We found a few worth considering.