Zoom flaw could enable hackers to activate Mac webcams without permission

The security issues speak to the risk associated with default settings on popular applications that a user might overlook.

A vulnerability in the Mac version of Zoom, the popular video conferencing application, could allow a hacker to turn on a user’s video camera without their authorization or disrupt their computer via a denial-of-service attack, according to research published Monday.

The vulnerability, found by security researcher Jonathan Leitschuh, exists in a Zoom feature that lets a user send a meeting invite via a web link. By clicking the link, a user is launched into a video call. But a phishing campaign or a website laced with malicious advertisements could take advantage of those links, Leitschuh said.

Leitschuh, a software engineer at the engineering organization Gradle, published his findings Monday on the blogging platform Medium after Zoom failed to fix the problem within 90 days.

“An organization of this profile and with such a large user base should have been more proactive in protecting their users from attack,” he wrote.

Asked how many Zoom Mac users there were, a company spokesperson said Zoom doesn’t disclose such figures, but said the vulnerability affects a significant portion of its customer base.

Zoom, which claimed 40 million users as of 2015, has patched the denial-of-service (DOS) vulnerability. It plans to update the application Friday to make it easier for users to keep their web cameras off by default. There haven’t been any reported cases of the vulnerability being abused, the San Jose, California-based company said.

Zoom chief information security officer Richard Farley said it would be “readily apparent” to users if they had unintentionally joined a meeting, and that they could immediately leave the meeting or change their video settings.

“Our determination was that both the DOS issue and meeting join with camera on concern were both low risk because, in the case of DOS, no user information was at risk, and in the case of meeting join, users have the ability to choose their camera settings,” Farley wrote in a blog post.

The company required Leitschuh to sign a non-disclosure agreement (NDA) before receiving a bounty for the vulnerability. Leitschuh declined, saying he wanted to make the vulnerability public to protect users. While Zoom asserted that the NDA was standard practice, some cybersecurity experts criticized the tactic.

The security issues discovered by Leitschuh highlight the risk associated with default settings on popular applications that a user might overlook. Even if you’ve uninstalled the Zoom Mac application, a “local-host” web server will remain on your computer and reinstall the application, according to Leitschuh.

Following criticism of that feature, Zoom announced a patch for it on Tuesday.

UPDATE, 6:02 pm, E.D.T: This story has been updated with Zoom’s announcement that it would patch the web-server feature. 

Government

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

Technology

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems