Zoom's Security Track Record: From Zoombombing to Zero-Day Exploits
A history of security vulnerabilities has repeatedly put users at risk, with patch timelines drawing criticism from researchers
Zoom's rapid rise to ubiquity during the pandemic was accompanied by a series of security vulnerabilities that exposed the platform's inadequate security architecture and raised questions about the company's commitment to protecting its users. From the early days of Zoombombing to more recent zero-day exploits, Zoom's security track record reveals a pattern of reactive rather than proactive security practices that has put millions of users at risk.
Zoombombing—the practice of uninvited participants joining and disrupting Zoom meetings—became a widespread problem in early 2020 as schools, businesses, and individuals adopted the platform en masse. The attacks exploited Zoom's default settings, which did not require meeting passwords and allowed participants to join with a simple meeting ID.
Key Takeaways
- Zoombombing exploited insecure default settings that did not require meeting passwords
- A hidden web server in Zoom's Mac client could activate cameras without consent, prompting Apple to issue a removal update
- A zero-click vulnerability demonstrated at Pwn2Own allowed remote code execution without any user interaction
