More than half a million Zoom accounts are being sold over the dark web

The exposed credentials are not the result of a breach but, rather, of what’s called a credential stuffing attack.

What you need to know

• Nearly half a million Zoom accounts have been exposed and are being sold on the dark web.
• The exposed credentials are not the result of an attack on, or a breach of, Zoom’s servers.
• Instead, they’re the result of hackers trying credentials from previous leaks on users’ Zoom accounts to see if they work.

If you were already concerned about the myriad security issues plaguing the incidental beneficiary of our combined desire for a video conferencing service in light of the pandemic currently ravaging the world, here’s some more bad news: over 500,000 Zoom accounts are presently either on sale or being distributed on dark web hacker forums.

As Bleeping Computer reports, these are not the result of a breach of Zoom’s servers. The cause of their exposure is much simpler: what’s called a credential stuffing attack, a technique in which hackers aggregate exposed credentials from previous leaks from other vendors, and then try those leaked passwords on another app to see if it works. For the many people people who share passwords across platforms, this is a surprisingly effective tactic, and in Zoom’s case, that amounts to at least half a million people.

These credentials have been circulating the dark web since the start of the month, and while some are being sold for pennies on the dollar, other hackers, it seems, are in a far more charitable mood and giving many of the accounts away for free.

One cybersecurity firm, Cyble, was, in fact, able to buy a 530,000-strong batch of such accounts off a dark web vendor, all for the very reasonable price of $0.002 per account. The information included user emails, passwords, meeting IDs, and host keys. Among those affected are several universities, as well as many major businesses, such as Citibank, Chase, and more.

This kind of attack does not apply to just Zoom, of course, as it can be used on any other service, as well, so long as the same credentials were used for multiple sites. It should, therefore, serve as a good reminder of the need for having different passwords for every service you use.

To check if any of your current accounts have been leaked as part of a breach, and thus susceptible to a credential stuffing attack, head over to Have I Been Pwned’s extensive database of known breaches to see if one of your accounts might be affected, and change the passwords for any other services where you used the same email and password.

Zoom announces collaboration with security experts from Netflix, Uber, EA and more