Zello’s developers have revealed some flaws in their systems. On its blog, the start-up detailed the discovery of what they called “unusual activity” on one of its servers; after an internal investigation, some security mechanisms were implemented and the incident was notified to the authorities.
Zello is a set of applications to emulate the operation of a walkie-talkie using mobile networks. There are versions of this app for Android, iOS, Windows systems, among other operating systems. The Zello team discovered that a threat actor could have improperly accessed the email addresses used by users of this set of apps; encrypted passwords may also have been involved in the incident.
So far it has not been possible to check whether the person responsible for the attack accessed any of the compromised accounts, although the possibility is reduced due to password encryption, not to mention that the usernames were not involved in the incident (access to Zello’s accounts requires username and password). As an additional security measure, Zello asked its users to reset their passwords to access this platform and for any other online services linked to the compromised email accounts.
“The security of our users’ information is one of our priorities, we apologize for this incident. We will continue to strive to improve our staff’s processes, technologies and skills and prevent similar incidents from happening again,” Zello’s blog says. The developers also mentioned that Zello Work and Zello for First Responders were not involved in the incident.
Finally, the security team concluded by mentioning that users’ financial information has not been involved, as this data is stored in a location outside Zello’s servers.
This is a sign of the importance of hashing as an additional method of protection, as you always have to expect the worst in a cybersecurity incident. If threat actors gain access to servers that store the passwords of users of an online service, it is preferable that passwords be encrypted; storing passwords in plain text is one of the worst information security practices.
He is a cyber security and malware researcher. He studied Computer Science and started working as a cyber security analyst in 2006. He is actively working as an cyber security investigator. He also worked for different security companies. His everyday job includes researching about new cyber security incidents. Also he has deep level of knowledge in enterprise security implementation.