Zoom, a popular video call app, has just been seen participates in a new debate concerning the security of the platform. Despite the fact that the app, on its website and on its display, prides itself on providing end-to-end encryption, the reality is different.
Felix (@ c1truz_), chief malware scanner specialist VMRay, reports on his twitter account that Zoom for Mac installation uses fake documents to process system messages. Installation uses these scripts to activate the installation without asking the user permission and includes a fake message to get the rights to the program. As Felix notes: "the same tactics used by malware".
As published by The Intercept, a video compilation service it does not encrypt end-to-end conversations, so that the servers can unload any phone and see and hear all participants.
The end of the crucifixion?
A very short note about privacy. When we talk about encryption we talk about it arithmetic operations we use in information so that the representation of that information changes. For example, we may decide that we will go over a single position when writing and therefore go from "Apple" to "Eppli".
In the field of computer encryption, in brief, what we do is mathematical operations. Let's assume that the zeros and our other information multiply by 19 and then send the result. Someone split our submissions, I don't know if we used 19 to expand our data, you cannot understand it. In the meantime, our recipient will simply make an easy split and have all the information.
In the real world, performance is more complex and prices are more accessible, but the goal is the same.
Now who has the keys? This is a very important question when it comes to encryption. Who knows our number 19? In fact, once the post knows it, the situation changes. And that's the difference between encryption and end-encryption. When we secretly write from end to end we are sure that Only we and our sender can count the key needed to deliver the message. This means that it doesn't matter how secure our path may be. You're safe.
What is Zoom encryption?
Except that both on its website, such as in advertising, and in the app interface, there is talk of final encryption the truth is another, as confirmed by a Zoom spokesperson.
E2E (end-to-end) encryption is currently not enabled for zoom video conferencing. The zoom video conference uses a combination of TCP and UDP. TCP connections are made using TLS and UDP connections with AES encryption using the discussed key above the TLS connection.
The bottom line, that Zoom is talking they use the same encryption as the page you are reading.
What Zoom does is include a dialog between the sender and its servers, then the conversation is processed and the server interrupts it with the recipients. This means communication and information completely exposed to Zoom servers.
Does it involve an accident? Of course, the fact that a company has access to its users' conversations means two things if we don't take the company's beliefs for granted. First, that governments or intelligence agencies can legally request access to that data, and second, that an attacker can access the servers Zoom out of the company to even know and get all the information.
What can I do?
When we use Zoom for business meetings you have to find something else. FaceTime, Apple's video calling service, is slated for completion until the end of its 2018 launch. The signal, endorsed by Edward Snowden, allows for the same. Even the Telegraph, whenever we use confidential communication, provides final encryption.
If our use of Zoom is limited to talking to a group of friends and family and the discussion can be held at everyone's restaurant, it is up to everyone to choose a platform.
The recommendation is to use secure communication tools. Is there anything we can hide? Of course not almost any discussion can be excluded from the context. Fortunately, Apple puts in our hands all the tools needed to keep our digital communications secure.
Source | Intercept