What you need to know
- Nearly half a million Zoom accounts have been exposed and are being sold on the dark web.
- The exposed credentials are not the result of an attack on, or a breach of, Zoom's servers.
- Instead, they're the result of hackers trying credentials from previous leaks on users' Zoom accounts to see if they work.
If you were already concerned about the myriad security issues plaguing the incidental beneficiary of our combined desire for a video conferencing service in light of the pandemic currently ravaging the world, here's some more bad news: over 500,000 Zoom accounts are presently either on sale or being distributed on dark web hacker forums.
As Bleeping Computer reports, these are not the result of a breach of Zoom's servers. The cause of their exposure is much simpler: what's called a credential stuffing attack, a technique in which hackers aggregate exposed credentials from previous leaks from other vendors, and then try those leaked passwords on another app to see if it works. For the many people people who share passwords across platforms, this is a surprisingly effective tactic, and in Zoom's case, that amounts to at least half a million people.
These credentials have been circulating the dark web since the start of the month, and while some are being sold for pennies on the dollar, other hackers, it seems, are in a far more charitable mood and giving many of the accounts away for free.
One cybersecurity firm, Cyble, was, in fact, able to buy a 530,000-strong batch of such accounts off a dark web vendor, all for the very reasonable price of $0.002 per account. The information included user emails, passwords, meeting IDs, and host keys. Among those affected are several universities, as well as many major businesses, such as Citibank, Chase, and more.
This kind of attack does not apply to just Zoom, of course, as it can be used on any other service, as well, so long as the same credentials were used for multiple sites. It should, therefore, serve as a good reminder of the need for having different passwords for every service you use.
To check if any of your current accounts have been leaked as part of a breach, and thus susceptible to a credential stuffing attack, head over to Have I Been Pwned's extensive database of known breaches to see if one of your accounts might be affected, and change the passwords for any other services where you used the same email and password.
We may earn a commission for purchases using our links. Learn more.
One UI vs. OxygenOS: Which is the better Android version?
One UI and OxygeOS are arguably two of the best Android interfaces on the planet, but which one is truly supreme? Here's an in-depth look at both platforms and how they compare to each other!
Why software is infinitely more important than any other phone spec
There are a lot of factors that come into play when deciding to buy a new phone. Above all else, software stands out as the most important. Let me explain.
Every messaging app should steal Slack's sweet new UI
After having one of the worst experiences for users on Android 10 or with curved screens, Slack's latest update is a shining example of what all developers should do with their apps.
These apps make it easy to check the specs of your phone with ease
While the Settings app on your phone does a decent job at telling you some of the specs on your smartphone or tablet, it doesn't tell you everything. Luckily, there are a plethora of apps that allow you to not only check your phone's specs, but so much more.