April 13, 2020 by Tim
Zoom Meetings has been on a roller-coaster ride lately. As workers moved home due to COVID-19, the company saw usage skyrocket and became a household name overnight. Unfortunately, just a couple weeks later people were talking about Zoom again, this time for all the wrong reasons. Two serious security flaws were found in Zoom, one which could leak the user’s Windows password, and another that allowed malicious attacks against Mac computers running Zoom. And let’s not forget Zoom bombing, the new trend in which pranksters (and perhaps hackers) simply enter random meeting numbers until they succeed in joining a conference as uninvited guests.
The good news is that Zoom did release patches fairly quickly to resolve the issues. However, that doesn’t mean that other exploits aren’t still lurking. There could be additional security issues that have yet to be discovered, or even worse, exploits that attackers have discovered but not revealed publicly.
Beyond security, there are also serious privacy concerns in using a product like Zoom. Like most online services, Zoom is closed-source software, meaning that the underlying computer code is not revealed by the company. This is in contrast to open-source software, where the code is freely available for anyone to analyze. Due to Zoom being closed-source, no one can say for sure exactly what’s happening behind the scenes. This is especially unsettling considering Zoom’s close links to China, where software companies are required to share certain data with the authoritarian Chinese government. While Zoom is technically an American company, it appears to be worthy of the Made in China tag. As Telecoms.com reporter Jamie Davies noted in a recent article, Zoom “is listed in the US on the NASDAQ, but the software appears to be developed by three companies in China.”
Then there’s Zoom’s price tag, which for many users is zero. The product is free to use for meetings shorter than 40 minutes. As with any free online service, users need to realize that their personal data is probably being collected and sold to help turn a profit.
It depends. For the most sensitive conversations, it’s impossible to guarantee security in any online meeting, including Zoom. Even for more mundane exchanges, there is always a chance that a new security issue could emerge and compromise the platform. Whether you use Zoom or not comes down to how sensitive the information being discussed is, as well how much you personally value privacy.
A useful analogy is to think of Zoom as the local coffee shop: you can have a fairly private meeting at your table in the cafe, but it’s probably not the best place for businesses to chat about payroll information, share personal data, or remind staff of the ingredients in the original Coca Cola recipe.
Probably the most well-known competitor to Zoom is Microsoft Teams. Teams is also free to use, and premium features are included in the Microsoft 365 plans many businesses already have. However, some less tech-savvy users may find Teams difficult to use, and it suffers from some of the same problems as Zoom: it’s closed source, and at least some user data is being collected. However, Teams is still probably more secure than Zoom. It’s true that Microsoft has also suffered serious security issues in the past, but its products are generally more secure and better tested than smaller and cheaper competitors. Microsoft is also (mostly) based in the US, meaning it is subject to American privacy laws, which may be weak but are still better than places like China.
Don’t get me wrong: in spite of its flaws, using Zoom is not the worst thing in the world from a security perspective, as long as you are aware of the risks. If you do decide to use Zoom, be sure to:
Thanks for reading the Green Mountain IT Solutions blog! If you enjoy our articles, please fill out the subscribe form at the top right of the page to have new posts sent to your email weekly.
