Zoom has partially fixed two new flaws, with other security hurdles ahead

Cisco Talos researchers uncovered two new flaws in Zoom, only one of which is fully fixed, according to Talos.

Cisco Talos researchers recently uncovered two new flaws in Zoom that could allow attackers to execute arbitrary code on users’ computers, according to research published Wednesday.

Zoom has partially fixed the vulnerabilities, according to Cisco Talos. The cybersecurity company said it worked with Zoom on addressing the flaws.

It’s the latest set of security bugs discovered in Zoom, a teleconferencing company whose software has come under heightened scrutiny in recent months as the coronavirus pandemic forced people around the world to telework and rely on videoconference platforms. Competitors include Cisco WebEx, Microsoft Teams, and GoToMeeting.

Zoom fixed one of the issues, dubbed TALOS-2020-1056, in May, . And while Zoom addressed the other flaw, dubbed TALOS-2020-1055, in a server-side update, Cisco Talos’ Jon Munshaw said in a blog he believes that a client-side update will be necessary to fully mitigate any risk.

Zoom claimed in a statement shared with CyberScoop that it updated the bugs in April.

The first flaw, TALOS-2020-1056, affecting Zoom Client version 4.6.10, relates to how Zoom processes messages.

“The core of this vulnerability is that Zoom’s zip file extraction feature does not perform validation of the contents of the zip file before extracting it,” Talos researchers write. “[I]n case of a shared code snippet, Zoom will proceed to automatically unpack the downloaded zip file in order to preview and display the snippet.”

Prior to the fix, if attackers sent a specially crafted message to individuals or groups, the vulnerability could be triggered, according to Talos. This can allow attackers to implant malicious files on victim computers, without any user interaction.

If users interact with the files they receive, for instance by downloading them, the attacker can send further malicious files, according to Talos.

The second flaw relates to how the Zoom client processes messages that contain animated GIFs, which could also be abused to execute arbitrary code.

End-to-end encryption debate

This is just the latest security headache for Zoom. For months, the San Jose, California-based company has been working to address numerous security and privacy flaws in its products, from an issue that allowed uninvited users to disrupt other people’s calls — colloquially known as “Zoombombing” — to an issue that could have allowed attackers to steal some users’ passwords, which has since been fixed.

But the information security community is still not satisfied with how the company has chosen to implement end-to-end encryption, a feature that would protect users’ communications from outside parties, including from Zoom.

The company previously falsely advertised that it was providing users end-to-end-encryption, even though Zoom could still access unencrypted video and audio from meetings. Now, the company’s founder, Eric S. Yuan, is saying that the company will provide end-to-end encryption only to paying or corporate customers, leaving customers who use the free version of Zoom without that standard of privacy and security.

The company says it has decided to leave those customers without end-to-end encryption, for now, because Zoom wants to provide information on free customers’ communications to law enforcement in case they commit crimes.

“Free users for sure we don’t want to give that because we also want to work together with FBI, with local law enforcement in case some people use Zoom for a bad purpose,” Yuan said on a conference call Tuesday, according to Bloomberg.

According to the Electronic Frontier Foundation’s Associate Director of Research, Gennie Gebhart, the company should be doing more to protect users who can’t afford their paid offering.

“[S]pinning it as ‘bad things happen on free accounts’ strikes me as paternalistic and unconcerned about other user groups who need [end-to-end encryption] protection,” Gebhart said in a tweet. “You heard that right, activists, journalists, organizers, and cash-strapped non-profits of the world: Zoom [could] offer you best-practice security, but it won’t, because you might be a child pornographer. Better luck next time.”

Former Facebook executive Alex Stamos, whom Zoom recently onboarded to help address security issues, told Reuters in an interview that the current plans are subject to change.

Government

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

Technology

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems