A New Flaw In Zoom Could Have Let Fraudsters Mimic Organisations

In a report shared with The Hacker News, researchers at cybersecurity firm CheckPoint today disclosed details of a minor but easy-to-exploit flaw they reported in Zoom, the highly popular and widely used video conferencing software.

The latest Zoom flaw could have allowed attackers mimic an organization, tricking its employees or business partners into revealing personal or other confidential information using social engineering tricks.

We know, social engineering attacks may sound a bit boring, but someone used the same to put Twitter on fire just last night when hundreds of high-profile Twitter accounts were hacked to promote a cryptocurrency scam, all thanks to an employee’s compromised internal tooling account.

The said vulnerability resides in Zoom’s customizable URL feature dubbed Vanity URL, aiming to let companies create a custom URL on its subdomain and branded landing page, such as “yourcompany.zoom.us,” where the invitation link to a meeting then looks like https://organization_name.zoom.us/j/##########, instead of regular https://zoom.us/j/########## format.

CheckPoint team found that due to improper account validation, any meeting ID could have been launched using…