Inside job: Why Zoombombing isnt as random as you might think – Digital Trends

OLIVIER DOULIERY/AFP via Getty Images

Last year wasnt exactly short of threats facing humanity, but Zoombombing was an especially 2020 kind of disruption, one that sought to hijack one of the most prominent means of communication by which people stayed in touch with everyone from co-workers to friends and family during lockdown.

Zoombombing, for those unfamiliar with it, works like this: An unwanted participant or participants access a Zoom call without being invited, against the wishes of the participants, and cause problems. One Massachusetts-based high schools Zoom session was hijacked by an individual who screamed profanities and then shouted the teachers home address. On social media, some users reported that their Zoom session had been taken over and used to show pornographic content.

Zoom, whose usage exploded during the pandemic, was suddenly at the center of what appeared to be a glaring vulnerability problem: It was as if the leading manufacturer of front door locks revealed a high failure rate during a home invasion epidemic.

But researchers from Binghamton University in New York say theres more to this story than meets the eye. According to a worlds-first study they have carried out, the majority of Zoombombing incidents are actually inside jobs. To draw an analogy with creepy campfire stories about terrified babysitters: The calls are coming from inside the house. Well, kind of.

There were a lot of people that thought that maybe this was some kind of clever hacking, or else [the result of attackers] finding people that would accidentally post Zoom links on social media or sending out email blasts, Jeremy Blackburn, an assistant professor of computer science at Binghamton University, told Digital Trends. [People figured it was] these outsiders who were randomly showing up, somehow finding a link to a meeting. It was an act of attack that the Zoombombers were perpetuating, just by themselves.

Blackburns major research interest, his university website profile notes, involves understanding jerks on the internet, from toxic behavior and hate speech to fringe and extremist web communities. He was intrigued by the rise of Zoombombing as a phenomenon, but also not entirely convinced by the theories.

How were they getting in? They could be brute-forcing the call IDs, but given the size of the search space, it seemed unlikely that they would be able to consistently find active calls to target. And while human error was certainly possible, in terms of people leaving Zoom links lying around, this also seemed improbable.

To quote Sherlock Holmes popular aphorism: When you have eliminated the impossible, whatever remains, must be the truth. Or, in this case, if people arent breaking into Zoom calls on their own, someone on the call must be willfully letting them in.

As it turns out, what we found is that Zoombombings were perpetuated by people that were legitimately in the call, Blackburn said. What would happen is that [a member of the call] would go ahead and share the meeting link on some fringe websites and say, Hey guys, show up and, you know, say the N-word or whatever in the call. Pretty much every time, it was a student asking people to come [and] Zoombomb lectures. They would also do things like say, Hey, use this name when you connect, because thats the name of somebody else in the class.'

To reach this conclusion, the researchers scoured tens of millions of social media posts, uncovering more than 200 calls for Zoombombing between Twitter and 4chan during the first seven months of 2020 alone. Between January and July that year, they identified 12,000 tweets and 434 4chan threads that discussed online meeting rooms, then used thematic qualitative analysis to identify the posts calling for Zoombombing. As Blackburn noted, the majority of the calls for Zoombombing in their dataset targeted online lectures, with evidence of both universities and high schools being the most heavily targeted groups.

In addition to Zoom, they also found evidence of similar bombing attacks on other popular communication platforms including Hangouts, Google Meet, Skype, Jitsi, GoToMeeting, Microsoft Teams, Cisco Webex, BlueJeans, and StarLeaf.

[For a company like Zoom], unless they perform the type of investigation we did, on their end it seems really difficult to detect this type of thing, Blackburn said. Because its not really a technical vulnerability. Its kind of a sociotechnical vulnerability If they were just looking at traffic [or whatever other] metrics they have, Im not sure it would be possible to purely detect this. You would need a study like ours that goes out and specifically tries to understand how this sociotechnical problem is unfolding.

(Digital Trends reached out to Zoom for comment, and we will update this story when we hear back.)

The results pose a challenge for communication platforms like Zoom. Their ease of use makes them appealing. Just click a link and youre suddenly talking to your friends or joining the morning huddle at work. But this also necessitates lowering security measures that could eradicate this behavior.

Anything involving security is always kind of a trade-off between ease of use and the robustness of the security, Blackburn said. I dont think people [would want to] go through a whole process of registering individual users and creating one-time links [in a more time-intensive manner]. Its much easier, and much more straightforward for non-tech-savvy people, to just have a link, click it, and it opens the program. That is certainly a big reason that Zoom gained the type of adoption it did. If it would have had a much more complicated, but secure, registration system, I would imagine something else would have [become] the dominant application.

Zoom does offer passwords as a login option. However, given the complicity of users, they would seem unlikely have to blocked Zoombombers with the right advanced knowledge. The same is true for waiting rooms, in which the host must manually approve people for entrance. While this would seem to be a more secure option, they are insufficient if the Zoombombers name themselves after people in a class in order to confuse the teacher or lecturer. (Thanks to a recent update, hosts can, however, pause their meetings to manually remove troublesome participants.)

Blackburn describes Zoombombing behavior as raiding, and says that it has always been a part of online life. Now, its using Zoom, but if you go back even to the IRC days (read: Internet Relay Chat, an early text-based chat protocol created in 1988), there were [online] wars where people would try and take over different channels, he said. Any time you have computer-mediated communication on the web [thats] instant and semi-anonymous, youre going to have people that get into conflict and attempt to disrupt things. In that sense, its not new, its the same basic sociotechnical problem with the internet. If theres an available mechanism to cause trouble, somebodys going to cause trouble.

In addition to Blackburn, other researchers on the project include Chen Ling, Utkucan Balc, and Gianluca Stringhini. A paper describing the work, titled A First Look at Zoombombing, is available to read online.

Link:
Inside job: Why Zoombombing isnt as random as you might think - Digital Trends