Zoom Fixes a Vanity URL Issue to Prevent Potential Phishing Attacks

If users had clicked on the malicious vanity URL, attackers could've possibly injected malware into the device.

Zoom Fixes a Vanity URL Issue to Prevent Potential Phishing Attacks

Zoom had worked with Check Point on vanity URL issue

  • Check Point says Zoom Vanity URL could've been manipulated in two ways
  • Both the methods could've led to potential phishing attacks
  • Zoom had earlier fixed a Zoomboming issue with Check Point's help

Zoom along with the cybersecurity company Check Point has fixed an issue with its vanity URLs that could have potentially allowed hackers to manipulate meeting ID links for phishing purposes. If users had accepted or clicked on the particular malicious vanity URL, attackers could've possibly injected malware into the device to carry out a phishing attack. A vanity URL is described as a custom URL used by brands for marketing purposes. It essentially allows users to remember or find a specific page within the website, such as "http://[yourcompany.zoom.com].zoom.com." According to Check Point, this vulnerability could've been manipulated in two ways.

The details about Zoom's Vanity URL vulnerability fix were shared by Check Point in blog post on Thursday.

"This was a joint effort between Check Point and Zoom. Together, we've taken important steps to protect users of Zoom everywhere," Network Research & Protection Group Manager at Check Point, Adi Ikan stated in the blog post.

Vanity URL vulnerability

As mentioned, the vulnerability could have allowed hackers to manipulate a vanity URL in two ways. The first way of targeting was via direct links. Check Point states that this would have allowed a hacker to directly change the Zoom invitation link that might be difficult to recognise by a person without "particular cyber-security training."

The second way of targeting Zoom users was through dedicated Zoom Web interfaces. Some organisations have their own Zoom Web interface for conferences.

"A hacker could target such an interface and attempt to redirect a user to enter a meeting ID into the malicious Vanity URL rather than the actual or genuine Zoom web interface," Check Point noted.

These two methods of manipulating vanity URLs would have allowed hackers to steal Zoom users' data. The issue has been fixed by Zoom, according to Check Point.

Notably, the cybersecurity firm had worked with Zoom earlier in January to fix another potential vulnerability that could have allowed hackers to join a meeting uninvited (also known as Zoombombing). After Check Point pointed out the issue, Zoom introduced passwords by default for all future scheduled meetings.

In 2020, will WhatsApp get the killer feature that every Indian is waiting for? We discussed this on Orbital, our weekly technology podcast, which you can subscribe to via Apple Podcasts or RSS, download the episode, or just hit the play button below.


For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel.

Further reading: Zoom, Zoom app, Check Point, Vanity URL
Microsoft Xbox One X, Xbox One S All-Digital Edition Production Stopped in Preparation of the Series X: Report
Leica M10-R Rangefinder Camera Launched in India at Rs. 6,95,000
Share on Facebook Gadgets360 Twitter Share Tweet Snapchat Share Reddit Comment google-newsGoogle News


Follow Us


© Copyright Red Pixels Ventures Limited 2023. All rights reserved.
Trending Products »
Latest Tech News »