A vulnerability in Zoom could have allowed hackers access to victims' machines

By TechThop Team

Posted on: 16 Aug, 2022

The Zoom software has been upgraded to address vulnerabilities that could have been exploited by hackers to gain control of a victim's computer. Zoom was notified about the issues in December 2021, but Mac security researcher Patrick Wardle shared them at DefCon last week.

The video communication platform's automatic update feature was fixed after he identified two issues last year. Wardle shared another vulnerability onstage at the conference, along with the fix. Another flaw has been fixed by Zoom.

A security researcher and founder of the Objective-See Foundation that creates open-source macOS security tools, Wardle, discovered the first security flaw in the Zoom installer, according to multiple reports by The Verge and Wired.

The second one was in the tool for confirming cryptographic signatures before installing updates. There is a patched version of Zoom available for download now that has been patched against the vulnerabilities.

The vulnerability exposed users, but how? During the Zoom installer, users are asked to enter their credentials or cryptographic signatures as special permissions. By checking the signature, the Zoom app automatically downloads and installs security patches.

As a result of the first vulnerability, an attacker may have been able to change the signature that offers privileges, allowing the installer to install a malicious update, and exploit that vulnerability. Another vulnerability was discovered in a tool for checking cryptographic signatures. 

A standard macOS tool is used to confirm the signature and check whether the update being delivered is fresh when Zoom is installed on a Mac, preventing hackers from installing an old, flawed version.

A flaw in Wardle's tool could enable hackers to trick the tool into accepting an old vulnerable version rather than the current one and gain complete control of the victim's computer as a result.

The third vulnerability was also discovered and discussed by Wardle last week. Despite patching the first two flaws, where Zoom now secures its signature check and eliminates the downgrade attack opportunity, there was still a third opportunity for hackers to exploit.

As he observed, there is a moment after the signature verification and before the Zoom update is being installed on the system when attackers could inject their malicious software into the Zoom update during this period.

The malicious software can retain all the privileges and checks necessary to install the update. Similarly to Wardle, an attacker could force the Zoom app user to reinstall the update to insert a malicious patch and gain root access.

The researcher, however, says that to exploit any of these flaws, a hacker must have some access to the victim's computer. As well as fixing the first two flaws, Zoom has also patched the third one.

For more stories like this

Explore our website