Macs vulnerable to 'bananas' Zoom video flaw

Macs vulnerable to 'bananas' Zoom video flaw

Macs vulnerable to 'bananas' Zoom video flaw

Zoom, a company that sells video conferencing software for the business market, is tweaking the app to fix a vulnerability in its software that allows malicious websites to force users into a Zoom call with the webcam turned on.

The same feature can be exploited to spy on Zoom users, according to security researcher Jonathan Leitschuh, who started investigating the app earlier this year. Obviously, this vulnerability is something malicious snoopers and cyber pranksters could exploit.

Leitschuh first contracted Zoom in March regarding the vulnerability. That web server also allows the Zoom app to be reinstalled without requiring any user interaction. And having a web server on a local machine is also pretty dodgy as it opens up that computer to all manner of cyber nasties, notably denial of service attacks if a hacker was to spam the local web server with repeated GET requests.

Even worse, you can't close this vulnerability by just deleting the Zoom app, because Zoom installs a hidden Web server on your Mac that will reinstall the Zoom client for you if you click a Zoom link.

However, Leitschuh said that Zoom still has not fixed the forcible joining of users to call features, or the webserver re-installing uninstalled clients if webpages ask them to flaw. In a blog post, Richard Farley, Zoom's chief information security officer, said that Zoom users can set a preference for video on or off when joining a meeting. In your Zoom app's Settings page, check the box "Turn off my video when joining a meeting", which will disable automatic webcam activation.

Zoom said in its July release, it would save whether the user turns off video in their first call and apply it to future meetings, with these changes will occur on all its platforms.

Thanks to the report, Leitschuh said Zoom also removed the ability for a call host to automatically have participants join with video enabled. See below for how to prevent Zoom turning on your camera by default when you join a meeting.

More news: Cisco to buy Acacia Communications in $2.6bn deal
More news: Solskjaer insists Manchester United will not be pressured into selling players
More news: NBA Approves Coach's Challenge For 19-20 Season

TidBITS Security Editor Rich Mogull had this to say: "Zoom's efforts to circumvent Safari's native security are completely irresponsible".

To demonstrate the threat, Leitschuh created proof-of-concepts showing how the attack can work.

Of note, because the Zoom client user interface runs in the foreground upon launch, it would be readily apparent to the user that they had unintentionally joined a meeting and they could change their video settings or leave immediately. "Then you can delete the ~/.zoomus directory to remove the web server application files", Leitschuh explained. "The host or any other participant can not override a user's video and audio settings to, for example, turn their camera on".

Amid a surge of online outcry today, Zoom's blog post about the webcam vulnerability has been updated repeatedly to eventually confirm that a security patch is being pushed out now to Mac users.

"Even for those who did not upgrade, Zoom will not use the local web server to join meetings automatically anymore as we have disabled it on our backend". A very poor decision by the folks at Zoom'.

The flaw is said to be partly due to a web server the Zoom app installs on Macs that 'accepts requests regular browsers wouldn't'. In addition, Zoom has a planned release this weekend (July 12) that will address another security concern: video on by default.

Recommended News

  • Iran Britain oil tanker row deepens as Tehran warns for 'consequences'

    Iran Britain oil tanker row deepens as Tehran warns for 'consequences'

    If confirmed, this would be the second detention of a tanker carrying Iranian oil over the past two weeks. Tehran said Sunday that the ship was not headed for Syria.
    Wimbledon 2019: World No. 1 Ashleigh Barty crashes out of Grand Slam

    Wimbledon 2019: World No. 1 Ashleigh Barty crashes out of Grand Slam

    Riske is playing in her 30th Grand Slam tournament but her previous best result was reaching the fourth round at the 2013 U.S. Ashleigh Barty crashed out of Wimbledon 2019 earlier today after losing her Round 4 fixture against Alison Riske .
    Emmy-winning actor Rip Torn dead at 88

    Emmy-winning actor Rip Torn dead at 88

    That show and that role led to a late life resurgence, with nearly 200 film and TV credits to his name at the time of his death. Among his acting credits include The Men In Black film series, Disney's Hercules and a number of episodes of sitcom 30 Rock .
  • Manchester United 'pursue Chelsea midfielder Tiemoue Bakayoko'

    Manchester United 'pursue Chelsea midfielder Tiemoue Bakayoko'

    Unai Emery is also claimed to be a fan of the player as Arsenal seek to add quality and depth to their midfield. The 24-year-old midfielder is back at Stamford Bridge, after spending last season on loan at AC Milan .
    Arsenal target Mario Lemina makes Man Utd transfer decision

    Arsenal target Mario Lemina makes Man Utd transfer decision

    They are now undergoing a crisis in the middle of the park with Paul Pogba's future looks uncertain in the Theatre of Dreams. Lemina sparked the transfer scrap last week when he admitted he wants out of Southampton.
    'Neymar can leave PSG' - Leonardo open to offers after 'superficial' Barcelona discussions

    'Neymar can leave PSG' - Leonardo open to offers after 'superficial' Barcelona discussions

    However, fellow former Barca and Spain global Lobo Carrasco believes Neymar's return would cause problems defensively. Amid growing rumours of discontent in Paris, the 27-year-old forward has failed to report pre-season training.
  • US, Chinese negotiators resume trade talks on Tuesday

    US, Chinese negotiators resume trade talks on Tuesday

    The talks that seemed to be nearing conclusion stalled in May after Mr Trump accused the Chinese side of reneging on commitments. Washington wants Beijing to address what US officials see as decades of unfair and illegal trading practices.
    1st-degree murder charge in black teen’s killing

    1st-degree murder charge in black teen’s killing

    Demands for justice began after a white man was arrested for fatally stabbing 17-year-Elijah Al-Amin in Arizona over rap music. The white suspect, 27-year-old Michael Paul Adams , says he carried out the murder because the boy was playing Hip-Hop music.
    Violent Family Brawl Breaks in Disneyland

    Violent Family Brawl Breaks in Disneyland

    Even if you expected a fight in Disneyland , you'd have never thought that you could see a Battle royal among the family members. The police department has stated that an investigation is underway to determine if charges should be filed in the incident.
  • Change in Greece as conservatives win majority

    Change in Greece as conservatives win majority

    Just one day after his sweeping election victory, Greece's new Prime Minister Kyriakos Mitsotakis named his cabinet on Monday. Euro area finance ministers meeting hours later in Brussels said key targets already agreed with Athens would not be changed.
    Marcus Morris Considering Signing One-Year Deal With Knicks

    Marcus Morris Considering Signing One-Year Deal With Knicks

    If Morris did choose to head to NY , he'd have the chance to test the free agency market again next offseason. The Spurs' seemingly shrewd offseason could totally crumble if they end up losing Marcus Morris to NY .
    Corbyn calls on new Tory leader to hold second Brexit referendum

    Corbyn calls on new Tory leader to hold second Brexit referendum

    Hunt and Johnson are due to square off on Tuesday evening in their only head-to-head debate in the campaign. Tory leadership contender Mr Hunt tweeted: 'Jeremy Corbyn has never believed in Britain.

We are pleased to provide this opportunity to share information, experiences and observations about what's in the news.
Some of the comments may be reprinted elsewhere in the site or in the newspaper.
Thank you for taking the time to offer your thoughts.