Zoom security feature let unapproved users view meetings, researchers find

Zoom, the videoconferencing service that has exploded into the vacuum created by the COVID-19 outbreak, has endured the revelation of a string of privacy and security flaws in recent weeks. Zoom said Wednesday it had fixed a vulnerability with its Waiting Room feature. As users have encountered problems with “zoombombing” — whereby participants interrupt and derail meetings, often by using offensive imagery or racist slurs — the company has pointed to the waiting room feature as a way to protect from this type of intrusion. But security researchers examining the desktop client for vulnerabilities found that Zoom servers would automatically send a live video data to users in the meeting’s waiting room, even if they had not yet been approved to join by the person holding the meeting. On Wednesday, Zoom Chief Executive Eric Yuan mentioned during a webinar held to address privacy concerns that Zoom had fixed an issue with its waiting room feature.