Recently I pointed out in a blog post that the Zoom CEO was the VP of Engineering at Cisco who left to start a direct competitor because, according to him, he was unhappy about the speed he could operate at.

Being secure, to be frank, is about flaw management practices such as transparency and handling much more than being devoid of flaws. How one educates users about a serious bug should be in the spotlight right now and Zoom is failing catastrophically.

Reading between the lines it looks a bit like the CEO didn’t like being told to do the right thing (follow safety processes) by Cisco management, and he allegedly saw it as an opportunity to exit and do a much easier thing — get rich doing what’s wrong, then apologize and hope for no accountability.

So let’s put this business management theory to a simple product security management test.

Here is a 2020 WebEx security vulnerability advisory:

I’d rate that security page and overall site as excellent and extremely useful to keeping everyone safe.

It stems from the main cisco.com/security page, where you can easily query and sort on WebEx vulnerabilities.

Let’s now compare that level of transparency and operational excellence to the Zoom outfit, run by the celebrated billionaire CEO.

First, the zoom.com/security page is a lot of marketing material fluff. We know already that these marketing materials are deceptive (e.g. end-to-end encryption is claimed, yet in reality it’s client server using a shared key that’s half the strength claimed and distributed in China…but I digress).

You have to scroll all the way to the bottom (it’s long) to find anything about security practices, like patches and advisories. Even then, security practices appear at first glance to be severely lacking, hosted at this oddly complicated US support URL.

https://support.zoom.us/hc/en-us/sections/201728933-Security

Second, I will test this support page using Patrick Wardle’s announcement (“The ‘S’ in Zoom, Stands for Security: uncovering [local] security flaws in Zoom’s latest macOS client“) from March 30, 2020.

Patrick kindly has updated his own announcement page in April that “Zoom has patched both bugs in Version 4.6.9 (19273.0402)”. Was the Zoom response well done? No.

Look very closely and very carefully at the Zoom security practices page:

A huge security news story, details about the vulnerability, announcement of the patch… none of it, nothing at all can be found anywhere in this support page or the top-level security page.

How would you know to update for a security flaw or even who it affects and how bad it is when it doesn’t appear anywhere except an obscure security researcher’s personal blog page?

I’d rate that as awful, and way below industry practices (again, look above at WebEx). This company supposedly obsessed with technology being “easy and fast to use” has a terribly convoluted hidden security site with CVE tossed in like a mixed bag among some random thoughts by their support team that hasn’t been updated in half a year.

It’s April 2020 and given the news so far this year there should be far more CVE on this page (even if only placeholders, we’ve seen one for Windows and one for OSX).

That’s just to begin with, as this really should elevate to a zoom.com/security URL and be easily sorted and searched as well as linked to product release/fix notes. I would imagine a truly sorry CEO would put up a giant box on the top level security page that says the industry standard WARNING: SECURITY FLAW.

Do it now Zoom, if you really are interested in moving fast.

Third, pop over to the release notes for the version Patrick mentions, which aren’t even linked from this page, you won’t find the word security mentioned anywhere.

This is unbelievable levels of bad management practice. Both the security page and the release page are far below acceptable. The practices are truly below baseline and should fail regulations and audits.

Please, anyone, someone explain to me why these release notes don’t use the word security anywhere, let alone don’t have a CVE with details and aren’t connected to the security advisory page.

There’s really not a need at this point for me to get into interesting and messy details of CVE, CWE, CVSS, etc when it’s obvious just how far below a safe baseline Zoom is operating.

I’ve shown enough already how Zoom practices may be a danger to society.

My take on this is the CEO has not enabled his security team (buried in US support), is not listening to his security critics (2020 vulnerabilities not listed), and does not yet take security seriously (sends out apologies to get sympathy without making necessary changes).

I may be forced to look further.

It’s like watching a dumpster burning and hard for me to take my eyes off at this point. Ok, ok let’s go just a little bit onward.

Fourth, I drop down into Security: CVE-2019-13450 shows Zoom has a severity score of 3.1 out of 10 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N):

HOLD ON TO YOUR HATS everyone because… wait for it… NIST shows this vulnerability officially filed as 6.5 out of 10 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), more than double what Zoom wrote on their security support pages!

Here are the calculations side-by-side, which shows how Zoom ended up publishing a false score in their useless security page (Attack Complexity High, Confidentiality Low) while everyone in the world will pull an official higher risk number from NIST’s database:

Zoom: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
NIST: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Look, I’ve spent a lot, and I mean a lot, of time inside the sausage factories called software development working on CVSS scores like these. There can be endless debates and fights and it isn’t always easy. I get that, trust me. I even established one of the first 70 CVE Numbering Authority (CNA) in the world for a major software vendor to pump out vulnerabilities that had been obscured.

But I will tell you right now that Zoom claiming complexity is high and confidentiality is low is completely and utterly wrong. It’s deceptive and it’s harmful. Here is the excellent NIST text explaining a CVSS score of 6.5:

…attackers can force a user to join a video call with the video camera active. This occurs because any web site can interact with the Zoom web server on localhost port 19421 or 19424. NOTE: a machine remains vulnerable if the Zoom Client was installed in the past and then uninstalled…

That is a text book case of high confidentiality loss. Does it really get any higher than to be spied on from your camera? And it has a reliable service (text book case of low complexity) that remains vulnerable even after a user tries to remove it? Come on Zoom people.

From there I drop into another CVE they have listed and another, and see problems everywhere…

Their last update on vulnerabilities is from six months ago called “Security: 2019-11 Zoom Connector for Cisco, Poly, and Lifesize” which has a CVSS of 8.1 and no CVE number assigned. I get that they might not be a CNA, or have trouble getting a CVE, but it doesn’t say anything at all.

In the meantime, with no CVE and no advisories page and no links from the main security pages, who exactly is expected to know they need to patch a CVSS 8.1 from October 2019?

There are a million more examples I could give but honestly it’s just so bad I think people need to understand that a major product security and safety overhaul is overdue at Zoom.

I’m not saying anyone should use WebEx, but at least take a look at what they’re doing right to understand just how far off the mark Zoom is. I do not see anything approaching a safe product with proper management practices at Zoom.

And I don’t know if any of this yet means the CEO has to go, or that the AG and FTC should be breathing fire.

However, I can tell you as a long-time product security leader that so far everything I’m looking at from my perspective shows very broken software lifecycle; it’s substantial evidence of misleading and deceptive practices, which clearly harm customers.

Only YOU can prevent video conferencing fires.

It’s pretty clear from a series of rapid and unfortunate missteps by Zoom that there’s something fundamentally wrong with the company.

We already knew the origin story didn’t sound great.

A VP of Engineering at WebEx, after being acquired by Cisco, didn’t like working for the parent company and left to start a direct competitor to move faster. The new company also was funded by an one of the WebEx founders using money from the Cisco acquisition.

…he knew how to write computer code, and he landed an engineering job with the videoconferencing software company WebEx. WebEx sold to Cisco for $3.2 billion a decade later (the platform is now known as Cisco Webex). Yuan became the tech giant’s vice president of engineering, earning compensation in the “very high six-figures.” But he was unhappy. […] In Yuan’s opinion, the product didn’t evolve quickly enough, making it a chore for customers to use. (In fact, Yuan told CNBC earlier this year that Cisco was still using the same buggy code he wrote for WebEx roughly two decades ago.)

The article goes on to say that claim by Yuan about WebEx is false, a lie.

…senior vice president and general manager of Cisco’s team collaboration group, says the company has “redesigned Webex from the ground up” since Yuan’s tenure…

It’s very weird for Zoom’s CEO to suggest WebEx is bad code because he wrote it. Does that make you want to use his new product when he’s shaming his old product? I mean it really opens the door to people (like me) pointing out this guy is willfully allowing bad code into production because that’s “his way” of doing things.

Is it time yet to use one of the safer alternatives to Zoom?

Clearly something seems off kilter in Zoom executive management ethics related to product safety. Security appears to have been treated as a non-feature and afterthought. Just look at these recent examples:

• Zoom security flaw exposes email addresses, full names and profile photos, as well as allowing non-invited attendees to initiate a chat
• Zoom security flaws in OSX allow (local) installer priv-esc vulnerability to root, (local) injection flaw allowing access to mic & camera
• Zoom security flaws of weak encryption and suspicious key traffic to China
• Zoom security flaw of disclosing Windows user passwords and local file execution
• Zoom security flaw in meeting identification facilitated unauthorized access
• Zoom security flaw allows any website to enable your camera without your permission
• Zoom security flaw allowed unauthorized command execution on Windows, Mac and Linux
• Zoom security architecture allows interception of traffic, opposite of marketing materials claiming end-to-end encryption
• Zoom weak security default left private recordings exposed to the public
• Zoom secretly was recording user information without authorization
• Zoom secretly was recording device information without authorization and forwarding to Facebook

I’ll stop to point out, perhaps for those who haven’t worked in product security, that this kind of “scientists crapping all over Zoom” list (also known as audit findings) is exactly the kind of pressure that helps an internal team fight more effectively for safety fixes earlier in the development lifecycle.

For example, the cryptography analysis found this:

Zoom documentation claims that the app uses “AES-256” encryption for meetings where possible. However, we find that in each Zoom meeting, a single AES-128 key is used in ECB mode by all participants to encrypt and decrypt audio and video.

That’s just straight up deceptive practices and delivering a known unsafe product to market. The centralized management of a single key by Zoom, and decryption capability of meeting traffic by Zoom, violates both the spirit and letter of end-to-end encryption.

And if I understand the Zoom architecture correctly, any time someone uses a mobile device to dial into a video chat (which is basically all the time) Zoom is decrypting the meeting on their servers. The very thing that Zoom’s CEO said he started a new company to solve, by moving faster than he was allowed to at WebEx, is this mobile device compatibility architecture decision that undermines privacy while deceptively marketing it as safe.

And on top of weak key management, that key is routed through China even when nobody in a meeting is in China.

With this kind of obviously bad decision-making, deceiving customers about encryption (calling it end-to-end when it is not), it brings front and center the fact that Zoom has issued no transparency report (PDF) about who is in fact getting access to the data.

A lack of transparency or access to internal data, coupled with a lack of external pressure to force it, allowed Zoom to run far afoul of basic security principles.

New transparency from researchers is bringing external pressure that should have been applied internally all along. One can hope late is better than never, yet experience suggests all these flaws are mere symptoms.

Zoom has said they will now stop feature development to focus on privacy, which is just another symptom. Remember the CEO comment about WebEx running his buggy code? He went into this knowing right from wrong and developed code the wrong way anyway. Privacy is a feature just like usability, so to see it called something that stops feature development… is part of a wider leadership ethics problem.

It goes back to that questionable origin story. A company was founded on impatience and greed (masked as usability from highly responsive user-focused engineering), which typically doesn’t mix well with safety values.

Making “Zoom bombing” a crime may help dissuade some abusers taking advantage of the safety weaknesses inherent to Zoom. However, that doesn’t fix the problem of Zoom itself being an untrusted company.

Right now shifting to a different product may be the easiest and most secure measure relative to Zoom’s problems. Consider the many options that may be in a better position right now, including of course WebEx:

• WebEx
• Jitsi
• BigBlueButton
• GoToMeeting
• Avaya Spaces
• Microsoft Teams
• Apple Facetime
• Google Meet
• Skype
• UberConference
• Wire
• Wickr Pro
• Join.me
• Discord

Also a quick caveat about Zoom’s buggy code because it found its way into the hands of a lot of people. Here are some of the major brands who run it under the covers and also tend to be vulnerable to security exploits:

RingCentral, Telus Meetings, BT Cloud Phone Meetings, Office Suite HD Meeting, AT&T Video Meetings, BizConf, Huihui, UMeeting, Zhumu, Zoom CN, EarthLink Meeting Room, Video Conferencia Telmex, & Accession Meeting

One of the most interesting options is Jitsi because it is open source (like BigBlueButton) and allows you to run your own server for meetings. While end-to-end encryption is difficult to implement given the nature of video conferencing protocols and features, moving to a hosted server means you can have more confidence that any necessary decryption is done within a trusted zone.

Update April 6: a serious security issue was just reported in Jitsi: https://github.com/jitsi/jitsi-meet/issues/5720

TL;DR – meeting password protection can be bypassed by simply showing up in a meeting room before the host arrives

A benefit of open source over proprietary projects is how security flaws like this can be so easily raised and monitored. That being said, this is a pretty awful bug. No software is devoid of flaws so it really comes down to how this entered the product (e.g. how symptomatic is it of wider issues), how the response goes and how it is communicated.

I give more details on the Zoom handling of flaws by comparing them to WebEx in a new post.

Nearly a decade ago I wrote about the increase in bicycle sales after disasters.

I won’t go into why people moved away from these logical options for transportation and to the illogical gasoline automobile. Kunstler does a good job of that in The Geography of Nowhere. Instead, I want to point out here that the recent tsunami devastation in Japan is showing a sudden uptick in two-wheeled commuters.

At no point in that post or since have I thought about the use of bicycles during a pandemic. I suppose my assumption was breathing would be elevated, increasing risk of infection or spreading the virus faster somehow.

I’ve also more recently written about the ridiculous state of bicycling in NYC, according to the data, ranking them near the bottom of America.

The city has a pollution-loving history with a huge “we’re busy trying to get rich/famous, leave us alone” lobby that claims doing the right thing for “others” is economically unfeasible in their list of priorities.

Color me completely surprised, therefore, when I read that NYC in pandemic disaster mode is accelerating bike lanes and recommending people cycle.

In early March, de Blasio encouraged commuters to “bike or walk” to reduce the spread of COVID-19 if they had to travel, and New Yorkers listened: According to the city’s Department of Transportation, bike traffic over its bridges has dramatically increased this month compared to the same time last year. Citi Bike also saw demand surge 67 percent in early March.

Very few cars are on the road, streets are mostly empty. Thus the risk of being hit and killed has suddenly evaporated. On top of that the air is incredibly clean now. And if that wasn’t enough, studies show cycling boosts your immune system.

Since cyclists tend to use physical distancing measures anyway when they ride, now that I think about it, the pandemic shelter in place instructions (keep 6 feet separation) are natural and easy to abide.

With all that in mind, the Big Apple is really ramping up their bike infrastructure right now.

DOT spokesperson Brian Zumhagen says the agency is looking at “using cones or movable barriers” to create temporary bike paths with space from traffic lanes, and may designate new parking for bikes on sidewalks and in pedestrian plazas. DOT is also working with Citi Bike to add more docks in parts of Manhattan.

On March 20, de Blasio announced that the city is rolling out new, temporary bike lanes on Second Avenue in Manhattan between 34th and 42nd streets and on parts of Smith Street in Brooklyn that doesn’t already have a bike lane.

“We’ll be looking for other areas all over the city that need them,” de Blasio told reporters at a Friday press conference announcing the new lanes. “Certainly want to encourage people to use bikes as much as they can at this moment…

Amazing. In just a week, due to the shift from selfish to societal impact values, NYC has flipped from dangerously car-heavy bottom-ranked streets for cycling to a Mayor encouraging bikes as much as possible.

Add pandemics to the list of disasters that lead to increased bicycle sales.

And yes, bike stores in NYC are staying open as some make the wise claim that repair shops qualify as “essential” (given that automotive repair is listed).

I’ve written several times about big data and visualization issues for the COVID-19 pandemic.

• March 3: Visualizing Coronavirus Spread: Many Tools, Results Vary Widely
• March 8: America Admits to Cooking its Numbers on Coronavirus
• March 11: Why Big Data Missed Early Warning Signs of COVID-19

As a long-time researcher of big data security, the most important problem space always has been one of data integrity, no matter how many times the market tries to shift everyone’s focus onto confidentiality (encryption, encryption, encryption).

Why do we care about data integrity here, or more specifically about test results on a dashboard? A recent Guardian article explains the significance with a simple metaphor to tell us how badly the White House is mismanaging security science:

Trying to combat the disease without testing is like running through a forest blindfolded – it’s not going to end well.

I would only add to that we’re entering a situation where we don’t control the running part, a virus does. The speed of movement is more like being caught in an avalanche and there’s a quote that always runs through my mind when I’m on steep terrain in deep snow:

…sparse trees do nothing but provide things for you to hit as you’re swept away.

First, the Worst.

America’s CDC has one of the worst, if not the worst, dashboard in the world. I’m embarrassed to even post it here. Don’t look. It’s pointless. Until they figure out that Alaska is part of the US, I’ve given up even trying to rationalize how badly CDC is doing.

Instead, I offer you a visualization by Buzzfeed News of small data about the White House itself, which shows spread of the virus due to obvious failure in leadership (lack of proactive distancing and testing).

Next, an honorable mention in this worst category is the much celebrated Johns Hopkins University dashboard. A good attempt, yet perhaps a dangerous lesson in failures.

It sadly appears to be broken and untrustworthy while being heavily cited as a success. In the three links at the start of this blog I’ve warned about their issues before (e.g. with everyone predicting NYC being a hot spot yet their map failing to represent growing cases). I also just noticed there’s a site that depends heavily on the dashboard, which now carries a very disturbing warning at the top.

Johns Hopkins university, the source of almost all of the charts, maps and tables below, is currently experiencing technical issues. The visualizations that show cases in the US, in China and worldwide over time are therefore incorrect. If you’re using them in your articles, please inform your readers about the issue.

Dear reader (hi mom!) consider yourself informed… again.

To be fair it’s a little unfair to call it the John’s Hopkins University dashboard when a graduate student (Ensheng Dong) built it for (or with) Lauren Gardner, Professor of civil and systems engineering.

Also I have to give a shout out to Splunk. They tend to be known for over-priced proprietary data quicksand, yet they’ve very nicely announced removing their usual red flags by offering an app via github for COVID-19 data.

While we will continue to expand our app and add features, we understand that others have their own ideas of how to visualize this data. Feel free to clone this app and create your own version, or get in touch with us… to collaborate and submit data and visualizations that you think others may find useful in the publicly available app.

There’s just a little problem. Can you understand this chart?

It reminds me of this old National Geographic chart of “Vaccine Victories” but gone completely wrong.

Hate to be cynical in the face of a gift horse, yet that default visualization for a flagship dashboard is so illegible… no wonder they’re giving it away and asking for community to do better. It just maybe is why they’re pushing the general public to post ideas so they can then commercialize it and make money off pandemic volunteers. I know, too cynical.

By the way, does anyone really want to use “Day 62.5” in a chart?

Second, the Best.

Singapore is unquestionably the best national site. It baffles me why the US federal government couldn’t grab Kibana and put this together in a week at most.

The first cases come around January 20th and growth is contained. It’s all very easy to see, and they offer numerous ways to pivot the data by demographics and region over time. It’s so good, I just imagine a competent White House would have had a same or better one by end of January at the latest.

On a more local level, and also in the US, Washington State Hospital Association has posted a fascinating new map by Albert Froling using Tableau.

The “testings” donut on the lower right is my favorite widget, although it tells us 8% of tests are positive when we really should want to know what percentage of the total population has been tested and when. Anyway, the whole thing feels masterful after playing with so many bad examples.

Meanwhile the White House is attacking Washington state leaders using cheap name-calling and jealous taunts.

In remarks that many found confounding and frightening, [White House occupant] described the governor of Washington state as a “snake”, praised his own expertise and falsely claimed that anyone who wants a coronavirus test can get one. Pence was later forced to correct this.

It only stands to reason that the federal and Washington state visualizations of virus test results are complete opposite ends of the spectrum.

Third, the Tactical.

Washington Post has done a great job capturing and applying the classic contagion lessons of big data visualizations.

They’ve taken the vaccination simulations, everyone knows all too well in visualization templates and games to learn from, and made an extremely useful point about why social distancing action was needed immediately after the first cases were confirmed.

Perhaps even more importantly the above illustration shows why quarantines aren’t as effective as social distancing.

The same article shows Jan 21 was the first confirmed case and distancing wasn’t started, tests were not being done at scale, due to sheer incompetence of US government leadership. Hundreds of thousands of Americans are likely to die based on unnecessary delays and indecision by the White House.

Let’s be honest here, it’s March 14 and tests still are not done at scale. The White House only started to actually pay attention after financial markets reacted to the White House lack of reaction and everything crashed; by then it was far too late to turn back the clock and start effective early virus response. It’s such a tragedy to see very clearly in the visualization here how an easily predictable and well known exponential curve was ignored until too late.

The Washington Post sends a warning simply and clearly:

If the number of cases would continue to double every three days, there would be about a hundred million cases in the United States by May. That is math, not prophecy.

China is right now counting about 81,000 cases, for perspective.

Now let’s go back up and marvel again at how math is driving the Singapore dashboard, and the very clear and transparent fact that they have a flat line instead of an exponential curve.

Update March 15: I’ve been asked to list some of the other sites considered, beyond those already mentioned in the previous blog posts (e.g. NYT, Hong Kong). Here is a short-list for review. Let me know if you agree or disagree with my worst/best results.

• ArcGIS
  • World Health Organization (WHO) map of EU
  • United Nations World Food Program (UN-WFP) map of Italy
  • J.A.G map of Japan
  • Thailand Ministry of Public Health
  • UK Dept of Health and Social Care
  • ESRI maps of Germany, Korea, Portugal and Spain
• ESRI map of Macau
• Philippines Dept of Public Health
• Tableau “quick start dashboard“