Check Point works with Zoom to fix 'Vanity URL' vulnerability

Researchers at Check Point have been working with Zoom to to fix a security issue that would have allowed hackers to manipulate organizations’ customizable Zoom 'Vanity URLs'.

The vulnerability would allow attackers to send legitimate-looking meeting invitations, with the aim of inserting malware and stealing data or credentials from unsuspecting victims.

Zoom use has soared during the COVID-19 pandemic, growing from 10 million daily meeting participants in December 2019 to over 300 million in April 2020, making it a tempting target for cybercriminals. In January, Check Point Research worked with Zoom to fix a vulnerability that would have allowed threat actors to join meetings they weren't invited to. The new potential Vanity URL security issue was found by researchers following up on the January collaboration.

The URLs could be manipulated to either change the invitation URL to include a registered sub-domain of their choice, or to target organizations that have their own Zoom web interface to attempt to redirect a user to enter a meeting ID into the malicious Vanity URL rather than the genuine Zoom web interface.

"Because Zoom has become one of the world’s leading communication channels for businesses, governments and consumers, it's critical that threat actors are prevented from exploiting Zoom for criminal purpose," says Adi Ikan, network research and protection group manager at Check Point. "Working together with Zoom’s security team, we have helped Zoom provide users globally with a safer, simpler and trusted communication experience so they can take full advantage of the service’s benefits."

Check Point Research and Zoom have worked together to resolve these issues. Zoom has put additional safeguards in place for the protection of users. "This was a joint-effort between Check Point and Zoom. Together, we've taken important steps to protect users of Zoom everywhere," adds Ikan.

A spokesperson for Zoom says, "Zoom has addressed the issue reported by Check Point and put additional safeguards in place for the protection of its users. Zoom encourages its users to thoroughly review the details of any meeting they plan to attend prior to joining, and to only join meetings from users they trust. We appreciate Check Point notifying us of this issue. If you think you've found a security issue with Zoom products, please send a detailed report to [email protected]."

You can read more on the Check Point blog.

Image credit: Sergey Nivens / Shutterstock