Sources: Zoom's business partner Dropbox privately paid hackers to find bugs in Zoom's code and pressed the company to fix them, fearing vulnerabilities
Dropbox privately paid top hackers to find bugs in software by the videoconferencing company Zoom, then pressed it to fix them. Tweets: @kimzetter , @natashanyt , @kimzetter , @racheldonadio , and @shiraovide Tweets: Kim Zetter / @kimzetter : “The hackers soon uncovered a major security vulnerability in Zoom's software that could have allowed attackers to covertly control certain users' Mac computers. It was precisely the type of bug that security engineers at Dropbox had come to dread from Zoom” Natasha Singer / @natashanyt : Many companies have bug-bounty programs that pay hackers to find security flaws in their own software. Dropbox had a program that offered hackers rewards to find security problems with software from Zoom. https://www.nytimes.com/... Kim Zetter / @kimzetter : “Dropbox grew so concerned that vulnerabilities in [Zoom] might compromise its own..security that..[it] began privately offering rewards to top hackers to find holes in Zoom's software..they were stunned by the volume & severity of the security flaws” https://www.nytimes.com/... Rachel Donadio / @racheldonadio : Unsettling story on @zoom_us security flaws Also, very weird metaphor: “I don't think a lot of these things were predictable,” said Alex Stamos (ex-Facebook, now a security adviser to Zoom). “It's like everyone decided to drive their cars on water.” 🤔 https://www.nytimes.com/... Shira Ovide / @shiraovide : I'm sympathetic to Zoom, because there are tradeoffs to balancing security and privacy. But when your customers warn you about risks to Zoomboming, and you don't do anything... https://www.nytimes.com/... https://twitter.com/...
Context & Ripple Effects
Dropbox's decision to fund its own hunt through Zoom's code is the sharpest data point yet in Zoom's run of security trouble: last summer Zoom initially refused to fix a flaw that let a malicious link activate the Mac camera and only patched it after backlash, and this month New York's attorney general sent Zoom a letter raising concerns about vulnerabilities and privacy practices as sensitive work migrated onto the service.
The report also lands in the middle of an unresolved argument about how bugs get found and disclosed at all — critics have charged that bug bounty programs can buy researcher silence when they are closed and wrapped in NDAs. Dropbox going outside any formal program, then pressing Zoom directly, reads as a customer losing patience with the vendor's own process.
First-order effects
- Zoom now has to remediate a vulnerability that reportedly could let attackers covertly control certain Mac users' computers — disclosed not by its own bounty but by a business partner's hired researchers.
- Dropbox, whose product integrates with Zoom, gets the fix it demanded, but the disclosure exposes that it trusted outside hackers over Zoom's internal security engineering to vet code its own users run.
Second-order effects
- Other enterprise customers of Zoom face pressure to demand equivalent assurance — audit rights, private findings channels, or their own paid reviews — turning security verification into a procurement term rather than a vendor promise.
- The episode feeds the critique that closed, NDA-bound bounty arrangements suppress disclosure: had Dropbox's hackers worked under a standard program, the Mac control flaw might have surfaced publicly instead of through a partner's private channel.
Third-order effects
- If large customers routinely bankroll independent audits of their suppliers' code, security assurance shifts from vendor-run programs toward buyer-driven verification — a structural change in who pays for and controls vulnerability discovery across interconnected software stacks.
- For regulators already scrutinizing Zoom's practices, the pattern suggests market discipline alone lags: companies dependent on each other's code may need formalized disclosure norms rather than ad hoc private pressure.
The trend: As enterprise software becomes deeply interoperable, major customers are increasingly funding their own security research into vendors' products rather than relying on vendor-run bug bounty programs.