A few weeks ago, specialists in a cyber security course reported that the Windows and macOS versions of the Zoom video conferencing app contained serious unfixed vulnerabilities. If exploited, these flaws would allow threat actors to spy on the sessions of affected users.
While no functional exploits have been identified for these vulnerabilities, there are already posts on hacking forums that offer a supposed code for exploiting these remote code execution flaws, for sale for $500,000 USD.
After investigating a little more, the cyber security course experts reported that these exploits are for sale on three different hacking sites, plus they are being offered to some specific hackers. Shortly thereafter it was reported that there are also various databases with Zoom user login credentials for sale on dark web.
As reports of multiple security omissions on the video conferencing platform accumulate, an incident caught the eye a few days ago, as cyber security specialists believe this could be the first case of exploiting these vulnerabilities in the wild.
Experts from the cybersecurity course mention that a woman in Los Angeles accuses them of allowing a hacker to remotely access her computer to steal about $64,000 USD from her bank account. LAPD and Zoom are investigating the allegation.
Marla Brown says she downloaded Zoom to participate in video conferences with her work colleagues during these isolation times. Two days after starting using this tool, Brown noticed something strange. The victim recounts that when he turned on his computer, there was a small light at the top of the desk, and when he looked closely, it seemed to be being operated from another location.
The woman was surprised when her bank statement later contained unauthorized transfers to unknown accounts amounting to the aforementioned amount. Brown immediately contacted his bank and police, although he has not obtained a definitive answer. In these cases, Zoom recommends carefully verifying the URL of the download of the tool, as there are dozens of illegitimate Zoom download sites.
So could it have been that Zoom, the popular video conferencing app, somehow allowed the hacker to enter? While the specialists of the International Institute of Cyber Security (IICS) consider it highly likely that these exploits actually exist, it is still necessary to conclude the investigation of this case in order to know the causes of the attack against this user, because many other possibilities must be ruled out.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
