Privacy and security issues shake up Zoom's success

FOLLOW

• Follow

A simple line of code has opened the Pandora box for the privacy and security of the Zoom video conferencing app. A line with which the company itself activated a software development kit - better known as the SDK for its Facebook acronym - that allowed both the social network and the application to collect certain data, such as IP, without the consent of the users. , the type of device, the operating system, and the location and time use of the connection. “It has only affected the Apple ecosystem. This Monday they already amended the error, but the damage has been done. They have amassed massive data whether you have a Facebook account or not. Now they can profile those who have connected, "says attorney Natalia Martos, founder of Legal Army.

These practices have prompted New York Attorney General Letitia James to open a judicial investigation. In a letter sent to the organization, it requests that it specify what kind of information it collects, for what purposes and to what other entities it provides consumer data. “It is a company that does not take privacy into account. Although difficult to prove, this is a full-blown data sale. It has taken a slice. No one sells information for free. More or less is what happened with Cambridge Analytica ”, argues Martos. But this lack of privacy only represents the tip of the iceberg of all the controversies that the coronavirus-imposed quarantine has uncovered in an application whose downloads have grown thanks to 86% confinement in a month, according to the Crunchbase portal.

An investigation by The New York Times revealed on Thursday that the application had a data mining function, as soon as they started the session, which automatically linked the names of users and email addresses with LinkedIn profiles. It didn't matter that during the call someone used a pseudonym or opted for anonymity. If a user activated the LinkedIn Sales Navigator service, they could access the profiles of this social network of other participants in the video call by clicking on an icon next to their names. The CEO of the company, Eric S. Yuan, has announced that for the next 90 days he will freeze these types of options to correct them and reverse the security and privacy problems detected.

Troll attacks, intrusion into third-party video calls, public links in the rooms, a default configuration for file sharing that allows malware to be sent… An excessive accumulation of vulnerabilities for the recent success. The use of Zoom has become popular during this crisis thanks to the arrival at forced marches of telework, video calls between friends and family, distance classes and all kinds of remote connections.

As the days go by, the controversies multiply. Some users have confirmed that it is relatively easy for someone to monitor their activity while using the application. For example, the One Zoom feature alerts the caller if a guest has been more than 30 seconds without the open program in the foreground. That way a boss could know if someone has followed a meeting with more or less attention. The management of emails has also generated controversy. The application automatically adds other people to a user's contact list if they register with an email that shares the same domain. It can help in the search for a specific partner, although the hidden face is that the company, by unifying them as if they worked for the same organization, exposes the personal information among everyone. "If this occurs in the European Union, the fine would be impressive," ditch Martos.

Zoom has defended itself against the allegations with an entry on its corporate blog. He argues that he does not sell any type of personal information; that it respects privacy laws such as the European Data Protection Regulation and the California regulations, known as CCPA; and that it does not control meetings or the content exchanged. The latter has raised a stir. It was advanced by the digital medium The Intercept by stating that there is no true end-to-end encryption in video calls, but one TLS. That is, third parties do not access audio and video, but the app can do so through the server through which the information runs. "We will continue to improve and evolve our privacy approach to ensure that we are doing the right thing for our users," says the company.

Getty Images

In the meantime, the cybercriminals take advantage of the moment to scam users. Despite being a free application, in mobile stores we can find it for about four euros. It is an obvious example of phishing - a set of techniques that chase a victim into cheating by earning their trust by posing as a trusted person, company, or service. They supplant the Zoom image with an identical one, as if they superimposed the false identity on the original one. “There are no magic recipes to detect it. You have to be very careful and check everything. If we look closely, companies often incorporate authenticity data, ”says Óscar Lage, a cybersecurity expert at Tecnalia.

Repairing part of the errors is already impossible. As Lage maintains, these problems are the result of products that simply focus on functionality. “Privacy and security are not included from the beginning. The only solution they have left is to patch the app . The ideal would be to use open source, community-maintained and auditable applications, ”he explains. There are more options to maintain digital contact or continue working from home. Each with its characteristics and limitations, but the success of Zoom has not monopolized video calls. "Google Hangouts and Skype would be good alternatives. They are subject to very strict privacy, "concludes Martos.