April 2020 - ttf - lists.iana.org

WEBINAR INVITE: Understanding DNS over TLS (DoT) and DNS over HTTPS (DoH)
by Evin Erdogdu April 26, 2020

April 26, 2020

?Dear TTF and CPWG Members, Sharing the below invite regarding DoT and DoH technology. The technology was noted as a topic of interest for At-Large during ICANN67. Please do attend and share with those who may be interested. Best, Evin ________________________________ From: NA-Discuss <na-discuss-bounces(a)atlarge-lists.icann.org> on behalf of Joe Catapano <joe.catapano(a)icann.org> Sent: Friday, April 24, 2020 2:36 PM To: NARALO Subject: [NA-Discuss] WEBINAR INVITE: Understanding DNS over TLS (DoT) and DNS over HTTPS (DoH) Dear stakeholders, I wanted to alert you to a webinar being hosted by ICANN's Middle East team. Full details are below, the time is friendly to North America. If you have any questions, you can ask me or Fahd Batayneh, who is copied here. Have a good weekend, Joe You are cordially invited to attend a webinar entitled "Understanding DNS over TLS (DoT) and DNS over HTTPS (DoH)". The webinar takes place on Monday 27 April 2020 at 13.00 - 14.00 UTC. Kindly register your interest to attend the webinar here >> https://icann.zoom.us/meeting/register/tJYofu6qpzIjGdZxe8nKSLUUBa20siKttOAy [icann.zoom.us]<https://urldefense.proofpoint.com/v2/url?u=https-3A__icann.zoom.us_meeting_…>. Once you register, you will receive instructions on how to join the call. More on the agenda and other details here >> https://features.icann.org/event/icann-speaking-events/webinar-middle-east-… [features.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__features.icann.org_eve…>. -- Joseph Catapano Manager, Stakeholder Engagement, North America ICANN Direct: +1.202.249.7544 Mobile: +1.202.550.6018 Skype: joe.catapano.icann Twitter: @JosephCatapano

2 1

ZOOM 90-Day Security Plan Progress Report: April 15
by Alfredo Calderon-Serrano April 20, 2020

April 20, 2020

https://blog.zoom.us/wordpress/2020/04/15/90-day-security-plan-progress-rep… The newly released Security icon in the toolbar provides Zoom Meetings hosts and co-hosts with one-click access to a number of existing Zoom security features, including Lock Meeting and Enable the Waiting Room. Changes to Zoom’s default settings We’ve made changes to Zoom’s default meeting settings to improve security before a meeting starts. Both meeting passwords and Waiting Rooms are enabled by default for our free Basic users and single Pro users, while those in our K-12 education program need a password to join a meeting. Waiting Rooms also are on by default for those K-12 users. Enhanced meeting password complexity Account owners and admins can now configure minimum meeting password requirements to include numbers, letters, and special characters, or allow only numeric passwords. Free Basic account users will now use alphanumeric passwords by default instead of numeric passwords. Changes to data center routing Starting April 18, account admins will have the ability to choose whether or not their data is routed through specific data center regions, giving users more control of their interactions with Zoom’s global network. Learn more about the process in our blog post. Bug bounty program with Katie Moussouris of Luta Security Zoom will be working with Luta Security to reboot our bug bounty program. Luta Security was founded by Katie Moussouris, who created some of the most important vulnerability programs still running today. She started Microsoft Vulnerability Research and Symantec Vulnerability Research, and also started Microsoft’s and the Pentagon’s bug bounty programs. Luta Security will be assessing Zoom’s program holistically with a 90-day “get well” plan, which will cover all internal vulnerability handling processes. Read more in Katie’s blog post. Alfredo Calderón Sent from my iPad

8 10

Re: [technology taskforce] ZOOM 90-Day Security Plan Progress Report: April 15
by Alan Greenberg April 18, 2020

April 18, 2020

Daniel, you have been involved in technology long enough to know that there are never any real guarantees. All we can do is identify systems that SEEM to be good, and then do our best to avoid/bypass/fix problems as they are discovered. As Olivier implies, the folks at Zoom seem to be taking this seriously, and that is a MAJOR asset. I recall many decades ago (in a universe far far away?) a new product was delivered (it was a text editor). Within weeks of its delivery, there we an enormous number of bugs reported. Management almost killed the product before they were made to realize that bugs are normal in any new product (even one like this editor which had been subject to a large amount of pre-shipment usage and testing). What was unique in this case was that the product was SO GOOD (both powerful and easy to use) compared to other editors out there, that it was quickly adopted by many users and was being subject to unusually heavy use so soon after shipment. And bugs were discovered (and incidentally fixed in record time by the development team). I think that what we are seeing with Zoom at the moment is quite comparable. Alan At 2020-04-18 05:33 PM, DANIEL NANGHAKA wrote: >Are we still safe with zoom amidst all the flaws that have been identified? > >There was a time when a simple flaw was discover >during an ICANN meeting, and Adobe Connect was >shutdown. Is there an analysis of the effects. >What is the security guarantee that we have on zoom? > >Daniel KN >á§ > >On Sat, 18 Apr 2020 at 17:17, Alfredo >Calderon-Serrano via ttf ><<mailto:ttf@atlarge-lists.icann.org>ttf(a)atlarge-lists.icann.org> wrote: ><https://blog.zoom.us/wordpress/2020/04/15/90-day-security-plan-progress-rep…>https://blog.zoom.us/wordpress/2020/04/15/90-day-security-plan-progress-rep… > >[] > > >[] > > >The newly released ><https://blog.zoom.us/wordpress/2020/04/08/zoom-product-updates-new-security…>Security >icon in the toolbar provides Zoom Meetings hosts >and co-hosts with one-click access to a number >of existing Zoom security features, including >Lock Meeting and Enable the Waiting Room. > >Changes to Zoomâs default settings > >Weâve made changes to Zoomâs default meeting >settings to improve security before a meeting >starts. Both meeting passwords and Waiting Rooms >are enabled by default for our free Basic users >and single Pro users, while those in our K-12 >education program need a password to join a >meeting. Waiting Rooms also are on by default for those K-12 users. > >Enhanced meeting password complexity > >Account owners and admins can now configure >minimum meeting password requirements to include >numbers, letters, and special characters, or >allow only numeric passwords. Free Basic account >users will now use alphanumeric passwords by >default instead of numeric passwords. > >Changes to data center routing > >Starting April 18, account admins will have the >ability to choose whether or not their data is >routed through specific data center regions, >giving users more control of their interactions >with Zoomâs global network. Learn more about >the process in our ><https://blog.zoom.us/wordpress/2020/04/13/coming-april-18-control-your-zoom…>blog >post. > >Bug bounty program with Katie Moussouris of Luta Security > >Zoom will be working with Luta Security to >reboot our bug bounty program. Luta Security was >founded by Katie Moussouris, who created some of >the most important vulnerability programs still >running today. She started Microsoft >Vulnerability Research and Symantec >Vulnerability Research, and also started >Microsoftâs and the Pentagonâs bug bounty >programs. Luta Security will be assessing >Zoomâs program holistically with a 90-day >âget wellâ plan, which will cover all >internal vulnerability handling processes. Read >more in Katieâs ><https://www.lutasecurity.com/post/luta-security-and-zoom>blog post. > >Alfredo CalderÃ³n > >Sent from my iPad >_______________________________________________ >ttf mailing list ><mailto:ttf@atlarge-lists.icann.org>ttf(a)atlarge-lists.icann.org >https://mm.icann.org/mailman/listinfo/ttf > >_______________________________________________ >By submitting your personal data, you consent to >the processing of your personal data for >purposes of subscribing to this mailing list >accordance with the ICANN Privacy Policy >(<https://www.icann.org/privacy/policy>https://www.icann.org/privacy/policy) >and the website Terms of Service >(<https://www.icann.org/privacy/tos>https://www.icann.org/privacy/tos) >You can visit the Mailman link above to change >your membership status or configuration, >including unsubscribing, setting digest-style >delivery or disabling delivery altogether (e.g., for a vacation), and so on. > >Content-Type: image/png; name="past-week.png" >Content-Disposition: inline; filename="past-week.png" >Content-ID: <1718f340ff6c282b48a1> >X-Attachment-Id: 1718f340ff6c282b48a1 > >Content-Type: image/png; name="next-week.png" >Content-Disposition: inline; filename="next-week.png" >Content-ID: <1718f340ff6ecbabac92> >X-Attachment-Id: 1718f340ff6ecbabac92 > > >_______________________________________________ >ttf mailing list >ttf(a)atlarge-lists.icann.org >https://mm.icann.org/mailman/listinfo/ttf > >_______________________________________________ >By submitting your personal data, you consent to >the processing of your personal data for >purposes of subscribing to this mailing list >accordance with the ICANN Privacy Policy >(https://www.icann.org/privacy/policy) and the >website Terms of Service >(https://www.icann.org/privacy/tos) You can >visit the Mailman link above to change your >membership status or configuration, including >unsubscribing, setting digest-style delivery or >disabling delivery altogether (e.g., for a vacation), and so on.

1 0

Zoom Security
by Lutz Donnerhacke April 17, 2020

April 17, 2020

I've been quite during the latest discussions of Zoom insecurity, because I do not consider the issues to be that serious. Most of the issues were social engineering, insecure credential handling by clients, misconfiguration by users etc. pp. Zoom has respond in an appropriate way, so I'm fine this those. But now the zoom client is inspected professionally, and it shakes my grounds. Please have a look at https://dev.io/posts/zoomzoo/ Horrible is the wrong word. Lutz Donnerhacke

2 1

Infogram comparison of conference tools by DIPLO
by Glenn McKnight April 15, 2020

April 15, 2020

https://infogram.com/survey-of-online-platforms-1h984wd5yjxd2p3 Glenn McKnight ICANN NOMCOM 2019-2021 mcknight.glenn(a)gmail.com Curator for Internet Governance Hub Blog www.internetgovernancehub.blog <http://www.internetgovernancehub.blog> http://toronto.ieee.ca/ IEEE Toronto SIGHT Chair glenn.mcknight(a)ieee.org skype gmcknight twitter gmcknight 289-830 6259 .

2 1

Zoom Product Updates: New Security Toolbar Icon for Hosts, Meeting ID No Longer Displayed - Zoom Blog
by Alfredo Calderón April 12, 2020

April 12, 2020

4 3

Fwd: Zoom Meetings Security Enhancements - Coming April 5th
by Olivier MJ Crépin-Leblond April 3, 2020

April 3, 2020

FYI --- there's been a lot of Press in the past 48H about security problems regarding Zoom. A quick fix for defaults looks likely from Monday. Kindest regards, Olivier -------- Forwarded Message -------- Subject: Zoom Meetings Security Enhancements - Coming April 5th Date: Fri, 03 Apr 2020 13:25:56 -0600 From: Zoom Video Communications <support(a)zoom.us> To: ocl(a)gih.com We’re always striving to continue to deliver you a secure virtual meeting environment. Based on feedback from our community, we’ve chosen to enable passwords on your meetings and turn on Waiting Rooms by default starting April 5th, as additional security enhancements to protect your privacy. Header Logo <http://click.zoom.us/e/84442/2020-04-03/bjwp6h/1500135842?h=dzrpS3nK9bJPPQ8…> Sign In <http://click.zoom.us/e/84442/signin/bjwp6k/1500135842?h=dzrpS3nK9bJPPQ8kNS3…> Dear Valued Customer, We’re always striving to deliver you a secure virtual meeting environment. *S**tarting April 5th, *we’ve chosen to enable passwords on your meetings and turn on Waiting Rooms by default as additional security enhancements to protect your privacy. *Meeting Passwords Enabled “On”* Going forward, your previously scheduled meetings (including those scheduled via your Personal Meeting ID) will have passwords enabled. If your attendees are*joining via a meeting link, there will be no change to their joining experience.* For attendees who join meetings by manually entering a Meeting ID, they will need to enter a password to access the meeting. For attendees joining manually, *we highly recommend re-sharing the updated meeting invitation <http://click.zoom.us/e/84442/fhZk1tUtto8/bjwp6m/1500135842?h=dzrpS3nK9bJPPQ…>*<http://click.zoom.us/e/84442/fhZk1tUtto8/bjwp6m/1500135842?h=dzrpS3nK9bJPPQ…>*before your workweek begins.* Here’s how you can do that: Log in to your account, visit your *Meetings <http://click.zoom.us/e/84442/meeting/bjwp5t/1500135842?h=dzrpS3nK9bJPPQ8kNS…>* tab, select your upcoming meeting by name, and copy the new meeting invitation to share with your attendees. For step-by-step instructions, please watch this *2-minute video <http://click.zoom.us/e/84442/t6W3XZ2KAqo/bjwp5w/1500135842?h=dzrpS3nK9bJPPQ…>*or *read this FAQ <http://click.zoom.us/e/84442/hc-en-us-articles-360041408732/bjwp5y/15001358…>*. For meetings scheduled moving forward, the meeting password can be found in the invitation. For instant meetings, the password will be displayed in the Zoom client. The password can also be found in the meeting join URL. *Virtual Waiting Room Turned on by Default* Going forward, the*virtual waiting room feature *will be automatically turned on by default. The *Waiting Room <http://click.zoom.us/e/84442/cles-115000332726-Waiting-Room/bjwp63/15001358…>* is just like it sounds: It’s a virtual staging area that prevents people from joining a meeting until the host is ready. *How do I admit participants into my meeting? * It’s simple. As the host, once you’ve joined, you’ll begin to see the number of participants in your waiting room within the *Manage Participants* icon. Select*Manage Participants *to view the full list of participants*, *then,**you’ll have the option to admit individually by selecting the blue *Admit *button or all at once with the *Admit All* option on the top right-hand side of your screen. For step-by-step instructions, please watch this *2-minute video <http://click.zoom.us/e/84442/ySas2Rgi6yA/bjwp61/1500135842?h=dzrpS3nK9bJPPQ…>*. Check out these resources to learn *How to Manage Your Waiting Room* <http://click.zoom.us/e/84442/cles-115000332726-Waiting-Room/bjwp63/15001358…>**and***Secure Your Meetings with Virtual Waiting Rooms <http://click.zoom.us/e/84442/r-meetings-zoom-waiting-rooms-/bjwp65/15001358…>.* For more information on how to leverage passwords and Waiting Rooms to secure your meetings, please visit our *Knowledge Center <http://click.zoom.us/e/84442/hc-en-us-articles-360041408732/bjwp5y/15001358…>*, attend a *daily live demo <http://click.zoom.us/e/84442/ebinar-register-weeklylivedemo/bjwp67/15001358…>*, or visit our *Blog <http://click.zoom.us/e/84442/2020-04-03/bjwp69/1500135842?h=dzrpS3nK9bJPPQ8…>*. Please reach out to our Support Team if you have any questions at *support(a)zoom.us <mailto:support@zoom.us>.* Thank You! Team Zoom Twitter <http://click.zoom.us/e/84442/zoom-us/bjwp6c/1500135842?h=dzrpS3nK9bJPPQ8kNS…> LinkedIn <http://click.zoom.us/e/84442/oom-video-communications-inc--/bjwp6f/15001358…> Pinterest <http://click.zoom.us/e/84442/2020-04-03/bjwp69/1500135842?h=dzrpS3nK9bJPPQ8…> +1.888.799.9666 <tel:1-888-799-9666> © 2020 Zoom - All Rights Reserved Visit zoom.us <http://click.zoom.us/e/84442/2020-04-03/bjwp6h/1500135842?h=dzrpS3nK9bJPPQ8…> 55 Almaden Blvd San Jose, CA 95113 <http://click.zoom.us/e/84442/38m23d37-33285414d-121-8949083/bjwp6p/15001358…>

2 1

Krebs on Security : ‘War Dialing’ Tool Exposes Zoom’s Password Problems
by Dev Anand Teelucksingh April 3, 2020

April 3, 2020

As the Coronavirus pandemic continues to force people to work from home, countless companies are now holding daily meetings using videoconferencing services from *Zoom*. But without the protection of a password, there’s a decent chance your next Zoom meeting could be “Zoom bombed” — attended or disrupted by someone who doesn’t belong. And according to data gathered by a new automated Zoom meeting discovery tool dubbed “*zWarDial*,” a crazy number of meetings at major corporations are not being protected by a password. https://krebsonsecurity.com/2020/04/war-dialing-tool-exposes-zooms-password… Also https://www.zdnet.com/article/the-internet-is-now-rife-with-places-where-yo… The internet is rife with online communities where users can go and share Zoom conference codes and request that pranksters connect and hurl insults, play pornographic material, or make death threats against other participants -- in a practice called Zoom-bombing or a Zoom raid.

1 0

The Intercept : Zoom Meetings Aren’t End-to-End Encrypted, Despite Misleading Marketing
by Dev Anand Teelucksingh April 1, 2020

April 1, 2020

Zoom, the video conferencing service whose use has spiked amid the Covid-19 pandemic, claims to implement end-to-end encryption, widely understood as the most private form of internet communication, protecting conversations from all outside parties. In fact, Zoom is using its own definition of the term, one that lets Zoom itself access unencrypted video and audio from meetings. https://theintercept.com/2020/03/31/zoom-meeting-encryption/

3 4