Zoom.us flaw forces users onto video and audio calls

By

Uninstalled Zoom clients can be re-installed by webpages.

The macOS client application for the popular audio and video conferencing service Zoom can be made to forcibly join users to calls, activating Mac microphones video cameras without users being asked for permission, a researcher has found.

Zoom.us flaw forces users onto video and audio calls
Tick this box or get Zoomed. Source: J Leitschuh.

Security researcher Jonathan Leitschuh from software development automation company Gradle was curious how sending a simple meeting link would start up users' Zoom clients, simply by clicking on it so that the web browser would open it.

Leitschuh thought it was an "amazing bit of functionality" and wondered how it had been implemented securely by Zoom.

His curiosity led to the discovery of two serious vulnerabilities that are very simple to exploit, and which Leitschuh said exposes up to 750,000 companies around the world with over four million webcams being activated by malicious websites.

On top of being able to activate Mac webcams which Leitschuh wrote [Caution: link will join those who click on it to a call with the video camera activated] a proof of concept for , he said it's possible to launch denial of service attacks if a webpage repeatedly joins users to invalid calls.

Anyone who's installed the Zoom client and then uninstalled it will have a web server running on their machines listening on the localhost port.

This server will "happily reinstall the Zoom client for you, without requiring any user interaction on your behalf besides visiting a webpage."

Leitschuh said it appears that Zoom is abusing a hack to bypass cross-origin resource sharing protections.

How to avoid being Zoomed

Although Leitschuh noted that Zoom did not fully fix the vulnerabilities within the 90-day industry standard disclosure period, users can can stop the client from turning on the webcam automatically if they're being joined to calls.

Going to the Settings dialog in the Zoom client, and then picking Video | Meetings | and ticking the Turn off my video when joining a meeting will see to this.

Running the UNIX list of open files command: lsof -i :19421 will reveal if the webserver bound to localhost is running, and provide its process identity number (PID).

With the process numbrer in hand, issue kill -9 [PID] and delete the ~/.zoomus directory to remove the web server application files, Leitschuh advised.

However, Leitschuh said that Zoom still has not fixed the forcible joining of users to call features, or the webserver re-installing uninstalled clients if webpages ask them to flaw.

The security researcher first contacted Zoom via email on March 26, and the company provided a quick fix solution.

Leitschuh was offered a bug bounty for his report the next day, which he declined as Zoom's policy is to require non-reporting of the vulnerability even after it's been patched.

[UPDATE]
Zoom will issue a patch for its macOS client that the company says will completely remove the local web server from users’ computers.
 
A manual removal option for the local web server is also introduced. From now on, Zoom will no longer use a local web server on Macs, the company said.
 
Zoom said that at first it did not see the local web server or the video being turned on by default as significant risk to customers. After user outcry and security community protestations as to the opposite however, Zoom changed its mind and decided to patch the client accordingly.
Got a news tip for our journalists? Share it with us anonymously here.
Copyright © iTnews.com.au . All rights reserved.
Tags:

Most Read Articles

Ex-student charged over Western Sydney University cyberattacks

Ex-student charged over Western Sydney University cyberattacks

Home Affairs officer accessed data on "friends and associates"

Home Affairs officer accessed data on "friends and associates"

SA Water plans 'once-in-a-generation' core technology uplift

SA Water plans 'once-in-a-generation' core technology uplift

Sportsbet recruits 'security champions' in shift-left strategy

Sportsbet recruits 'security champions' in shift-left strategy

Log In

  |  Forgot your password?