Zoomcrashers – Keep your Zoom Sessions Safe

Zoom has become the most widely used video conferencing platform in the world. It’s simple, accessible from a computer, tablet or phone and takes one click to enter a meeting with all your day drunk friends. Thanks to the n-CoV-2 pandemic, more people than ever before are zooming in. It is the most affordable and user-friendly method of connecting with others while you go bonkers in self-isolation. From professional meetings to book clubs; family dinners and yoga classes; almost everyone in isolation is getting Zoomed right out.

Zoom for the win

Zooming this, zooming that. The platform crushed Skype; another simple platform for video conferencing. Between December 2019 and March 2020, Zoom has seen a 1900% increase in users. Is that even a percentage? Over 200 million people are using Zoom.

There has been a recent cyber outbreak of what I will call Zoomcrashers (also called Zoombombing); people who either hack in or simply guess a meeting number and zoom right into your session. They can share their screen, take over as the host, access your webcam and private information stored in your computer. Zoomcrashers range from innocent, bored people trying to have some fun after eating too many gummy bears all the way to people sharing pornography or recording your meeting without your knowledge.

The security breach arc runs all the way through Insanely Bored Basement Dwellers to Insidious Creepers with Decent Hacking Skills. Keeping your Zoom sessions safe from Zoomcrashers will prevent your Easter dinner from being interrupted by Joe Boredom forcing you to watch him play Minecraft.

Zoom forgiveness

We should begin by forgiving Zoom, the company, for any wrongdoing in this area. Yes, it is now widely known they have security breaches and privacy grey zones. CEO Eric Yuan apologized for the challenges and provided a list of what the company has already done, as well as how they plan to address the continued obstacles. I want to take a moment in this article to acknowledge the incredible feat that Zoom has taken on.

Imagine having a company of customer support employees and a team of computer engineers. They developed a platform that was intended for a specific use. Resources and personnel are distributed evenly, customer support is 24/7 and at a reasonable capacity; most importantly, the actual infrastructure of the platform (servers, database) has been developed for a particular number of users. Almost overnight, we’re in a worldwide quarantine. The team of engineers are likely a brilliant group of overworked, highly intelligent nerds who are sleeping at the office and deploying constant patches and updates in an effort to maintain services for 200 million people.

Zoomcrashers

Amidst the criticism about Zooms security breaches, Zoomcrashers and encryption issues, I really have to hand it to the entire team at Zoom. What an endeavour. I’d say that’s an example of true technological innovation during a crisis that is likely impacting their internal teams as well. Talk about business continuity. You win Zoom, you win.

I’m truly impressed and astounded that the platform hasn’t crashed completely; with an increase of that magnitude in such a short period of time, I would have expected the servers to self-implode, start on fire, blow up and rain down acid data on all of us.

Zoom is going to be making changes over the next few months so anyone who has the app on their computer, phone or tablet should watch for these updates. As the situation stands right now, we’re entering a long weekend of Zoomers from all over the globe. I have already scheduled a yoga class that I’m doing, a breakfast club, Easter dinner and a meditation class that I am teaching. Four Zoom sessions; I’ll probably add to that as well as I slowly transform into Joe Boredom.

Zoomers. Keep it safe!

Well Baby boomers, move over because your time is up. The new generation of Zoomers has arrived. Shortly, we will announce the birth of the next, next generation – Coronials. Coronials won’t be Zoomers because by the time they are ten, we will live in a world of 6G technology, artificial intelligence and Zoom with either be a relic or holographic. So congrats to the Zoomers! We comprise a small demographic. Small, but mighty.

If you begin digging into Zoom security options, you’ll find there are many ways to protect your privacy. The platform is available for free or at a small cost for additional features. If you’re using Zoom for top secret meetings, I would recommend diving into the documentation that Zoom has provided on their website.

A part of the security problems we’re facing is the default settings aren’t as people expected and they don’t know how to change them. For the average wine club user, we will discuss simple security options that will enable you to continue your isolation parties with only a few small changes made to your settings.

Zoom kicks it off with security

When you initially sign up for a Zoom account (a free account), you are asked for your work email address. This is likely overlooked by most people; it’s clear you need to put in an email address. Simple as that. Looking more deeply, you can see right off the hop that the platform was designed for enterprises and professionals; it asks for a ‘work’ email address specifically.

Often a work email address is more secure than, let’s say, a Gmail or Hotmail account. This level of security was the first layer of protection prior to the whole 1900% user increase thing. Work email addresses typically indicate what agency or company you work for, ensuring that you are truly who you say you are. Being given a work email address is a layer of security in and of itself. Generic email addresses, such as Gmail and Hotmail, do not provide any user information.

Default settings

Zoom is already implementing changes to their default settings; they’ve turned on passwords and Waiting Rooms. That means participants can’t enter the meeting before the host. It also brings me to the most important Zoom tip – create a meeting password! You can easily create a single click meeting; no password, participants don’t even need a Zoom account. In order to add security, create a meeting password and send it out in your meeting invitation.

Meeting invitation? Like a birthday party?

Yes. Just like that. In Comic Sans font too. Create a meeting invitation! If you publish your meeting link anywhere, anyone can join (especially if you don’t have a password). For safety, create an invite-only meeting. If you’re running a large class or conference that you want to keep open (no specific invites), ensure you’ve taken additional steps to protect the users and yourself.

When you sign in to your Zoom account from a browser (not the app), you see many features and options. Zoom is a very powerful platform. The Admin console allows you to control user roles, meeting rooms and integration with third-party platforms. Thankfully, Zoom also offers training in multiple ways. Live training, documentation, a blog and regular webinars are offered to users. To maximum usage of Zoom, training is recommended for such an agile platform.

Let’s focus on Joe Basement

For the average Joe Basement, a password and invite-only meeting is recommended and is perhaps all the security needed. Send the meeting number to your friends, wine club, book club, knitting class, etc. and in a separate email (or message or carrier dove), send the password.

There are many options to take a look at before you start a meeting (yes, I’m talking to you Joe). When you sign in to your account, you will see Profile, Meetings, Recordings, Settings and other options on the left side menu. This is your motherboard of control. Get in there. These basic options are CRITICAL for security. Here are a few key options to think about.

Zoom tips and tricks

In your Profile, you’ll find your meeting number. It is completely free to host a video conference for 100 people using Zoom. When I signed up, Zoom integrated automatically with Facebook and Google. That connection happened when I put in a Gmail address (exactly what I reminded you was a security breach right off the hop). I’ve already got a profile that is connected to two other platforms and all I did was sign in through Google. As in, I clicked a button. That’s it. Even my Facebook profile picture arrived. Integration is already there; that’s why a professional email address is a good security feature. You probably don’t use it for your Facebook account.

You can use your own meeting number (found under profile) or generate a new one for a meeting. If you have a large meeting/party, use a unique ID. Zoom can generate one automatically and that provides greater protection from Zoomcrashers.

You can do all the things

Let’s say you’ve created a new meeting (with a unique meeting ID), it’s invite-only and you have a password. You’re off to a great start! Check your Recording settings. Zoom meetings can be recorded by local users or even to a cloud account. Do you want your meeting recorded? Some of us have been in isolation for weeks with no pants. I’m going to guess you don’t want your video conference to be the next Zoom blooper on Youtube.

Once your session has started, you’ll see ‘Manage Participants’ at the bottom of the screen (assuming you’re the host). Select this option and you’ll be able to find your way to Lock Meeting. This will prevent anyone else from joining. Lock that shit down!

Check your settings

You will also notice in your Settings that by default, anyone can share their screen during the meeting. You can disable this so that only the host can share the screen. There is a File Transfer option that is automatically turned on (unless you disable it).

That means Insidious Creeper could potentially transfer malware or a computer virus through the Chat section of the meeting. Everyone in the meeting clicks on it and then we’re dealing with yet another viral outbreak. Under your Settings, you can choose if you want Chat, File Sharing, Screen Sharing, Recording, Muting or Unmuting and how much control participants have.

Basic steps for Basic Joes

1. Use a unique ID (PMI – Personal Meeting ID). This way it is less likely your meeting will have unwelcomed visitors.
2. Invite your participants. Don’t post your meeting link as your Facebook status. Send it directly to your fellow isolationists.
3. Create and send out a meeting password (part of the process – very simple).
4. Lock the meeting once you begin. Also, create a waiting room if you’d like so that you can approve all users joining the meeting/conference/party.

Zooming in on a perfect metaphor

Here is another way of saying exactly what I just listed. The example below is to illustrate what the Zoom platform is and how we can use a comparable example to understand it.

1. You are a top secret, intelligence operative who’s been on a mission for twenty years and if you compromise your objective or release any information, you will be forced to live with Joe Exotic for life. You need to set up a meeting with the two other operatives working with you who are currently disguised as NHL hockey players. In order to ensure you can meet in a private setting, you book a boardroom for your discussion. The boardroom isn’t a regular boardroom that someone might stumble upon. It’s a unique boardroom that would be most difficult to find. The boardroom is hidden underground and accessible only by a secret, invisible elevator hidden in an abandoned airport hanger in the middle of Saskatchewan.
2. You release the meeting invitation to only your two other operatives. Email is insecure; any type of messaging service is a shitstorm of publicity. You attach a coded note to a goose and plan to receive confirmation through the same means, except a different goose of course (the first one will be killed. For safety).
3. You obtain a third goose and send a decoy password. This is not the real password; it is assumed that the geese have been compromised. To ensure safety of your meeting, the decoy goose is sent to other NHL players. They remain a hockey stick’s distance apart. For safety. You then shotgun a Pilsner (we’re in Saskatchewan here). After chiseling your mega secret password, which is “Pas$word”, to the inside of the beer can, you weld the can back together and fill it with water. The water will not degrade the password and your operatives will recognize a previously shotgunned beer immediately when it fails on them. That failure will be their signal and they will obtain the password. Confirmation to you is not needed because you know they will have ordered the beer and had it delivered.
4. The operatives arrive in the fields of Saskatchewan wearing their NHL uniforms and carrying their hockey bag. It’s stinky and so are they in order to remain undercover. You identify them using a blood sample and then open the door to the airport hanger, secret elevator and underground boardroom. Once inside, you lock the door to the meeting with a stolen, Las Vegas casino vault lock and allow everyone to remove their disguises. The meeting commences. Once it finishes, you go completely nuclear and blow the entire airport hanger so that it can never be found or used again.

Zoom back out

I hope this has transformed cyber security into a picture of physical security using a near-identical, realistic example.

Zoom is an amazing platform and the team behind it is truly remarkable. It’s clear they’re doing all they can to increase security and privacy for their users. This only works if the users are educated on these options. The company has default settings that are meant for 200 million people; that could be 200 million different scenarios. It is in our hands to ensure our own meetings have proper security settings; the options won’t be helpful unless you know about them.

Stay safe while Zooming!

As I mentioned before, Zoom has online training for anyone interested in gaining a more in-depth understanding of platform usage. For Joe Basement, I hope this article has given you enough tools to stay safe, have Zoom parties and control access to your much needed wine club discussions.

A password a day keeps the creepers away.

Happy Zooming everyone!