Zoom client for Windows could allow hackers to steal users' password

The popular Zoom app is under scrutiny, experts have discovered a vulnerability that could be exploited to steal users’ Windows passwords.

Experts warn of a ‘UNC path injection’ flaw that could be exploited by remote attackers to steal login credentials from Windows systems.

Security experts and privacy advocates believe that the Zoom is an efficient online video communication platform, but evidently it has some serious privacy and security solutions.

The first expert to warn about the security flaw goes online with the handle Mitch (@_g0dmode).

#Zoom chat allows you to post links such as \x.x.x.xxyz to attempt to capture Net-NTLM hashes if clicked by other users.

— Mitch (@_g0dmode) March 23, 2020

The popular researchers Matthew Hickey (aka Hacker Fantastic) and Mohamed A. Baset also confirmed the existence of the flaw.

Hi @zoom_us & @NCSC – here is an example of exploiting the Zoom Windows client using UNC path injection to expose credentials for use in SMBRelay attacks. The screen shot below shows an example UNC path link and the credentials being exposed (redacted). pic.twitter.com/gjWXas7TMO

— hackerfantastic.x (@hackerfantastic) March 31, 2020

The latter also created a simple demo of the Zoom UNC path injection issue

I made a simple demo of the latest Zoom UNC Path Injection Vulnerability, Take care and don't click on ANY UNC Path hyperlinks!

P.S. I used putty as a payload.exe which could be ANY_THING_ELSE.exe

PoC: https://t.co/fatA6R7Kuq

— sym.btc (@SymbianSyMoh) April 1, 2020

The attack leverages the SMBRelay technique that provides username and NTLM password hashes to a remote SMB server when connecting to it.

The Zoom client for Windows supports remote Universal Naming Convention (UNC) paths and converts URLs into hyperlinks for recipients in a chat.

An attacker could steal the login credentials of a Zoom Windows user, by sending a crafted URL (i.e. \\x.x.x.x\zyz) to the victim via chat and trick the victim into clicking it.

The attack could allow capturing the hashed passwords that could be cracked using specific tools like John the Ripper.

The experts reported the issue to Zoom, but the vulnerability has yet to be fixed.

In January, experts discovered another flaw in the popular video conferencing software that could be exploited to join meetings and view all content shared by participants.

The issue allowed anyone to remotely eavesdrop on unprotected active meetings, potentially exposing private audio, video, and documents shared throughout the session.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – video communication, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]

---

---