Zoom revamps video call security

Zoom has answered its critics by making large scale changes to its video conferencing platform.

Zoom head of Asia-Pacific, Michael Chetner, on a Zoom call today with The Australian, with a virtual background from northwestern Australia.

Video conferencing platform Zoom today has answered its critics, releasing a 90-day report on security measures designed to eradicate issues raised as the platform’s take-up skyrocketed during virus lockdowns.

Zoom has been used for family meetings, one-to-one catch-ups, business get-togethers, social gatherings and even virtual choirs, among other uses.

Zoom Head of APAC, Michael Chetner, in an interview with The Australian today, says the Silicon Valley-based service went from 10 million participants before COVID-19 to 300 million participants now.

However security issues saw Zoom suspend its general development program for three months to build extra security features into its platform.

The review was led by its CEO billionaire Eric Yuan, who more than a decade earlier worked for rival video conferencing platform Webex, where he was corporate vice president of engineering at the time Webex was acquired by CISCO in 2007.

His is a migrant rags-to-riches story. Mr Yuan told Thrive Global that he originally applied and was rejected for a US visa eight times over two and a half years before being granted one on the ninth attempt to work in the US.

“I first envisioned Zoom when I was a freshman in college in China and regularly took a ten-hour train ride to visit my girlfriend (who is now my wife),” he told the publication in 2017. “I detested those rides and used to imagine other ways I could visit my girlfriend without travelling — those daydreams eventually became the basis for Zoom.”

Today Mr Yuan released a promised 90-days report into the review which Zoom undertook from April through to June.

After public concerns surfaced about the security of Zoom and practices such as “Zoom bombing”, where uninvited guests could raid Zoom meetings and post obscenities, Zoom has beefed up security and given meeting hosts new controls over who attends meetings in a version newly rolled out called Zoom 5.0.

First, conference encryption is now AES 256 GCM, not AES 128. Mr Chetner says is “the highest industry level of encryption”.

He says all users will have access to end-to-end encryption with the launch of a new Beta version of Zoom in July.

Passwords are now mandatory and you won’t see meeting ID’s on screenshots. That will prevent meeting IDs being accidentally shared as screenshots and users by Zoom bombers, he says.

“You have to be in the meeting and select ‘meeting information’ to see it.

“If people want to show everyone that they‘re on a Zoom call, that’s great, but we needed to take the meeting ID off the actual frame.”

He says UK Prime Minister Boris Johnson got into trouble with Zoom when he shared his screen which included a meeting ID.

Hosts now have increased control of meetings. The host can stop users sharing screens and control when they use the chat function.

Guide Dogs staff and their “labradorable” team members held a Zoom puppy meeting in April to celebrate International Guide Dog Day. Picture: Supplied

“If you started sharing something inappropriate, I can quickly switch that off. I can also, as part of that, report you within the meeting itself. We can grab all of that information and follow up on that.”

Mr Chetner says Zoom has added a “waiting room” where participants are placed when they initially join meetings. “You as a host will have to admit them; it’s like knocking on the front door,” he says.

“You admit those one-by-one. If there‘s someone there that you don’t know, who wasn’t invited, they’re not allowed into the meeting. Once everyone is in the meeting, you can lock the meeting, so no one can enter after that.”

He says hosts can also control who can speak or not. And the one user can now only attend meetings on one device at a time.

He says Zoom will add an “end date” feature to optional meeting recordings so that they don’t exist in the cloud forever. Video recordings can be stored on your device or in the cloud.

Zoom also has enhanced its “bug bounty program” and repository which takes vulnerability reports from HackerOne, Bugcrowd, and via email to [e-mail]. New staff have been hired and there are now daily security meetings.

Zoom has launched a CISO (chief information security officer) council, partnering with industry to promote a dialogue on security and privacy best practices.

“For us, the focus on security and privacy is to be the leader around that and provide an example of what a secure and private meeting experience is.”

He says Zoom’s phone product where people dial into video meetings using a regular phone number will be available in more countries. It is available as iOS and Android apps.

He says Zoom Rooms continues to be rolled out as a product for conference rooms.

The US-headquartered firm has also addressed concern about some user data being routed through China. It says the issue was fixed in early April. Zoom says it uses cloud data centres globally. One of Zooms 17 data centres has been in China, a facility owned by Australian telco Telstra.

“Zoom’s systems are designed to maintain geo-fencing around China ensuring that users outside of China do not have their meeting data routed through servers in China,” it says in a statement. “The routing issues described in Citizen Lab’s research were a temporary issue caused when Zoom failed to fully implement its usual geo-fencing best practices. Zoom fixed the issue on April 3.”

It says paid Zoom customers can customise which data centre regions their account can use for real-time meeting traffic.

Zoom stock continues to rise of the NASDAQ from $US76.30 ($110.35) on January 31 to $US259.13 ($374.73) now.