In recent days the web application security audit specialist Jonathan Leitschuh revealed the existence of zero-day vulnerability in Zoom, the popular video conferencing software. Threat actors can abuse the “click-to-join” feature, which allows Mac users to join a Zoom session through a browser link, by installing a local server that executes requests from unconventional browsers.
If exploited, this vulnerability would allow hackers to hijack Zoom sessions, forcing Mac users to join a call without requesting their permission, in addition to activating the callers’ webcams.
The web application security audit specialist claims that the local server persists on the compromised system even if the user removes the Zoom application from their computer; Leitschuh even claims that video conferencing software can be installed again automatically. “The company has done little to correct this flaw,” he says.
Leitschuh released a demo of the attack after revealing the flaw; using a link, the expert redirected Mac users who had ever used Zoom right to a video conferencing session, even activated the webcams of users who clicked on the link. “It is possible to embed such a link on any website, as well as in advertisements or as part of phishing campaigns”.
Redirecting Mac users to a Zoom session arbitrarily is not the only way hackers can abuse this service. According to web application security audit experts from the International Institute of Cyber Security (IICS) the presence of this web server on the compromised Mac computers could generate denial of service (DoS) conditions on the device by making ping multiple times on the web server.
The specialist contacted the company last March; on the other hand, Zoom released a security patch that disabled the ability to enter a video conference automatically. However, this is not a complete solution to the vulnerability, so the expert publicly disclosed it after the company’s deadline for correcting the flaw was met.
For now, Mac users will need to implement some manual settings as a temporary protection measure until Zoom definitively corrects the vulnerability.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
