[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-135660-105":3,"detail-sidebar-cat-0-en-105":81,"doc-detail-135660-en":130},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","a-first-look-at-zoombombing-first-data-driven-analysis-of-social-media-calls-for-disruptive-online-meeting-attacks","A First Look at Zoombombing - First data-driven analysis of social media calls for disruptive online meeting attacks","","Online meeting platforms such as Zoom and Google Meet have enabled rapid communication while also creating new opportunities for large-scale harassment. The paper studies zoombombing, where attackers join meetings to disrupt and harass participants. It analyzes social-media posts from Twitter and 4chan, annotates calls for attacks, and performs thematic coding. Findings show most calls come from insiders with legitimate access, undermining password and waiting-room defenses.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/document/","Document",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/document/research-report/","Research & Report",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/document/a-first-look-at-zoombombing-first-data-driven-analysis-of-social-media-calls-for-disruptive-online-meeting-attacks/135660/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/a-first-look-at-zoombombing-first-data-driven-analysis-of-social-media-calls-for-disruptive-online-meeting-attacks/135660.png","ImageObject",300,407,{"name":42,"@type":43},"Jake","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-17","2026-08-21",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",10,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"What is zoombombing in the paper’s context?","Question",{"text":63,"@type":64},"Zoombombing is an attack where aggressors join online meetings to disrupt them and harass participants.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"Which platforms does the study analyze for calls to zoombombing?",{"text":68,"@type":64},"The study examines posts on Twitter (mainstream) and 4chan (fringe community known for coordinated attacks).",{"name":70,"@type":61,"acceptedAnswer":71},"Why do common defenses like passwords and waiting rooms fail, according to the findings?",{"text":72,"@type":64},"Most calls are made by insiders with legitimate access, and insiders may even instruct attackers to adopt names of legitimate participants, reducing the effectiveness of typical protections.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},135660,1787316834,{"code":4,"msg":82,"data":83},"success",[84,88,92,96,101,106,111,115,120,123,126],{"id":22,"doc_module":4,"doc_module_name":25,"category_name":85,"show_sort_weight":86,"slug":87},"Story & Novel",90,"story-novel",{"id":26,"doc_module":4,"doc_module_name":25,"category_name":89,"show_sort_weight":90,"slug":91},"Literature",80,"literature",{"id":33,"doc_module":4,"doc_module_name":25,"category_name":93,"show_sort_weight":94,"slug":95},"Exam",70,"exam",{"id":97,"doc_module":4,"doc_module_name":25,"category_name":98,"show_sort_weight":99,"slug":100},5,"Comic",60,"comic",{"id":102,"doc_module":4,"doc_module_name":25,"category_name":103,"show_sort_weight":104,"slug":105},6,"Technology",50,"technology",{"id":107,"doc_module":4,"doc_module_name":25,"category_name":108,"show_sort_weight":109,"slug":110},7,"Healthcare",40,"healthcare",{"id":112,"doc_module":4,"doc_module_name":25,"category_name":29,"show_sort_weight":113,"slug":114},8,30,"research-report",{"id":116,"doc_module":4,"doc_module_name":25,"category_name":117,"show_sort_weight":118,"slug":119},9,"Religion & Spirituality",20,"religion-spirituality",{"id":118,"doc_module":4,"doc_module_name":25,"category_name":121,"show_sort_weight":118,"slug":122},"World Cup","world-cup",{"id":55,"doc_module":4,"doc_module_name":25,"category_name":124,"show_sort_weight":55,"slug":125},"Lifestyle","lifestyle",{"id":127,"doc_module":4,"doc_module_name":25,"category_name":128,"show_sort_weight":97,"slug":129},19,"General","general",{"code":4,"msg":82,"data":131},{"doc_id":79,"user_id":132,"nickname":42,"user_avatar":133,"doc_module":4,"category_id":112,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":139,"language":140,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":12,"update_tm":80,"read_time":109},962084928904,"https://ap-avatar.wpscdn.com/davatar_155a257f0dc6eb9ab79c44ca47cae57d","A First Look at Zoombombing  \nChen Lingº􀂘 , Utkucan Balcı¶􀂘 , Jeremy Blackburn¶ , and Gianluca StringhiniººBoston University, ¶Binghamton University  \n[ccling@bu.edu](ccling@bu.edu), [ubalci1@binghamton.edu](ubalci1@binghamton.edu), [jblackbu@binghamton.edu](jblackbu@binghamton.edu), [gian@bu.edu](gian@bu.edu)  \nAbstract— Online meeting tools like Zoom and Google Meet have become central to our professional, educational, and personal lives. This has opened up new opportunities for large scale harassment. In particular, a phenomenon known as zoombombing has emerged, in which aggressors join online meetings with the goal of disrupting them and harassing their participants. In this paper, we conduct the first data-driven analysis of calls for zoombombing attacks on social media. We identify ten popular online meeting tools and extract posts containing meeting invitations to these platforms on a mainstream social network, Twitter, and on a fringe community known for organizing coordinated attacks against online users, 4chan. We then perform manual annotation to identify posts that are calling for zoombombing attacks, and apply thematic analysis to develop a codebook to better characterize the discussion surrounding calls for zoombombing. During the first seven months of 2020, we identify over 200 calls for zoombombing between Twitter and 4chan, and analyze these calls both quantitatively and qualitatively. Our findings indicate that the vast majority of calls for zoombombing are not made by attackers stumbling upon meeting invitations or bruteforcing their meeting ID, but rather by insiders who have legitimate access to these meetings, particularly students in high school and college classes. This has important security implications because it makes common protections against zoombombing, e.g., password protection, ineffective. We also find instances of insiders instructing attackers to adopt the names of legitimate participants in the class to avoid detection, making countermeasures like setting up a waiting room and vetting participants less effective. Based on these observations, we argue that the only effective defense against zoombombing is creating unique join links for each participant.  \nI. INTRODUCTION  \nOne of the earliest promises of the Internet was to enable quick, easy, and real-time communications, not just via text, but also audio and video. While it took some time, there are now numerous online meeting tools like Skype, Zoom, and Google Meet that are used in a variety of contexts, both personal and professional. In 2020, society has found itself increasingly reliant on these online meeting tools due to the COVID-19 pandemic, with many business meetings, online classes, and even social gatherings moving online. Unfortunately, the mass adoption of these services has also enabled a new kind of attack where perpetrators join and deliberately disrupt virtual meetings. This phenomenon has been dubbed zoombombing, after one of the most used online meeting platforms [6, 49] .  \nTo mitigate the threat of zoombombing, security practitioners have begun discussing best practices to prevent these attacks from happening or limit their effects. These include  \n􀂘  \nUtkucan Balcı and Chen Ling contributed equally to this work.  \nrequiring a password to join online meetings, setting up awaiting room and manually vetting participants before letting them in, and not sharing meeting links publicly [11, 55] . While helpful to keep out casual and unmotivated attackers, there is an inherent tension between tightening the security of online meeting rooms and the need for them to be easily accessible to a number of people, especially in the case of large public events [6] . Most importantly, devising effective security policies requires a good understanding of the capabilities of attackers and their modus operandi. To date, however, the research community lacks a good understanding of how zoombombing attacks are called for and how they are car","cbCaicqJdJ9Z3mNe","https://ap.wps.com/l/cbCaicqJdJ9Z3mNe","pdf",602334,16,"English","# Abstract\n# I. Introduction\n## Background and problem statement\n## Existing mitigations and research gap\n## Study approach and data sources\n## Summary of key findings","[{\"question\":\"What is zoombombing in the paper’s context?\",\"answer\":\"Zoombombing is an attack where aggressors join online meetings to disrupt them and harass participants.\"},{\"question\":\"Which platforms does the study analyze for calls to zoombombing?\",\"answer\":\"The study examines posts on Twitter (mainstream) and 4chan (fringe community known for coordinated attacks).\"},{\"question\":\"Why do common defenses like passwords and waiting rooms fail, according to the findings?\",\"answer\":\"Most calls are made by insiders with legitimate access, and insiders may even instruct attackers to adopt names of legitimate participants, reducing the effectiveness of typical protections.\"}]","A First Look at Zoombombing - First data-driven analysis of social media calls for disruptive online meeting attacks | PDF"]