“Zoom login details available on the Dark Web are not for sale because of a Zoom vulnerability or technology problem, but because people are using the same passwords across multiple sites. ” says Anna Collard, Managing Director at KnowBe4 Africa.
Using a technique called “credential stuffing”, hackers try logging into Zoom using account details obtained from older data breaches. This attack is highly popular because there are automated tools available that can sift through billions of stolen usernames and passwords without requiring any special skills. They then compile lists of any successful Zoom logins and sell them to anyone who’s interested.
Passwords are painful. I get it. But using the same password over and over again puts you at risk. And in times like these where most of us are at home and using applications like Zoom for both work, school and personal lives, we need to raise more awareness on the importance of keeping our online identities safe:
Protect yourself:
- Wherever possible, use multi-factor authentication. This is combining your password with something that you have, like a One Time Password app on your phone. Zoom does offer this functionality.
- Use a password manager for all your personal accounts. This means you only have to remember one very strong password, and the password manager takes care of all the other ones. For example LastPass or 1Password.
- Check if your account has been leaked before: Go to haveibeenpwned.com, type in your email address and see what happens. Change your passwords on any sites where you may have used that email address and password.
- Keep your Zoom software and apps updated.
- Be aware of phishing attacks using fake lookalike “Zoom” domains with the objective of distributing malware: only trust the legitimate zoom.us domain and verify any Zoom links forwarded to you by the sender.
- Prevent unauthorized people from crashing your Zoom meetings by enabling waiting rooms, not sharing your personal meeting ID in the public domain, controlling screen sharing and locking your meetings when everybody has arrived.