Zoom is a free-to-use tool that has been used for years to make group video calls, both personally and for work meetings. It has many benefits: no registration required to attend a virtual meeting, video calls can be made with up to 100 people, and default backgrounds can be included so you don’t have to worry about clutter in the room you’re speaking from.
However, in a very short time, as a result of the demand for global social isolation, Zoom has gone from having around ten million users to two hundred million. An unexpected success that has led to numerous security problems, some very serious: calls that were not fully encrypted, sending data from Apple devices to Facebook and even a failure that allowed Windows passwords to be stolen.
Although there are many free applications for making group video calls, if you want to continue using Zoom, here are some tips to fix security flaws.
Update to the latest version of Zoom
The latest version of Zoom solves the vulnerability mentioned above for the Windows version: a link was sent to the victim who, if clicked, would send their username and the hash of their Windows password (a unique code automatically generated to starting from the password) to the attacker.
Therefore, the Internet Security Office recommends that, if you were using versions prior to 4.6.9. for Windows, please update it as soon as possible. You can do it from the Zoom download center.
How to set up meetings
ESET Latin America, a company specialized in cyber threat detection, offers some tips to organize Zoom video calls without endangering your safety or that of the participants:
To get started, always use the auto-generation option. This way, each meeting will have a different ‘Meeting ID’. If a meeting ID is compromised, it will only work for a single meeting and not all the ones you host.
Another simple option is to personally admit each participant to the conference room . This will prevent unexpected ‘intruders’ from sneaking in. It is also a good idea to limit screen sharing options so that only certain participants can do it (cases of ‘intruders’ projecting pornography in work meetings have been reported). You can also activate the ‘waiting room’ so that users must pass through an entrance filter before accessing the meeting.
It is also important to prevent sensitive data from being displayed in the task switcher, specifically for Apple iOS devices that take screenshots of open applications. To do this you have to choose the option “Blur snapshot on iOS task switcher” (all these options are found in the ‘Personal’ section in ‘Settings’).
If you set a password to access the meeting (it’s their thing), avoid embedding the password in the meeting link. This means that each participant will have to enter the password manually to join the meeting.
In general, we recommend that you review all the advanced configuration options one by one to adapt the meetings to your security requirements.
