Video conferencing app Zoom has a major security flaw in its Mac client,lee???? ???????? letting any website turn on your Mac's camera without a warning, security researcher Jonathan Leitschuh claims.
In a blog post Monday, Leitschuh detailed the vulnerability, which he says he'd disclosed to Zoom more than 90 days ago, and the company still hasn't fixed it.
SEE ALSO: Google Nest camera security flaw allows former owners to observe others' homesThe problem lies in Zoom's usage of a web server on users' local machines. This makes some of Zoom's cool features possible, for example, clicking on a simple link in your web browser automatically starts up the app.
Having an app install and run a web server on a user's machine with an undocumented API "feels incredibly sketchy," Leitschuh says. But there's more. According to Leitschuh, "this web server can do far more than just launch a Zoom meeting. (...) this web server can also re-install the Zoom app if a user has uninstalled it."
This is bad by itself, but Leitschuh discovered a vulnerability that let him launch a Zoom call, with video enabled, on a user's machine without permission. The same vulnerability allows the attacker to perform a DOS (denial of service) type attack on a user's machine.
Leitschuh says that he'd contacted Zoom on March 26, offering the company a quick fix for the vulnerability. After a lot of back and forth, Zoom partially fixed the flaw, but Leitschuh was able to bypass their fix, after which the company offered no additional fix. The security issue is still present in the latest version of Zoom for Mac, 4.4.4.
In a blog post Monday, Zoom defended its app's functionality, claiming that users are prompted to turn their video off when joining their first meeting, and can set the video to off in subsequent meetings; if they do so, it would be impossible for the host or other participants to turn their camera on. Furthermore, Zoom claims, "because the Zoom client user interface runs in the foreground upon launch, it would be readily apparent to the user that they had unintentionally joined a meeting and they could change their video settings or leave immediately."
The company said they will give users more control of their video settings in an upcoming, July 2019 release.
The company also addresses the presence of the web server on user machines, saying it's a "workaround to a change introduced in Safari 12" and a "legitimate solution to a poor user experience problem."
Zoom has assessed that both the video call issue and the DOS issue were "low risk," which is why the company decided not to change the app's functionality. The company also promised it will launch a public vulnerability disclosure program in the "next several weeks."
The main question users should be asking themselves is whether they want to sacrifice their system's security for a bit of added functionality -- likely, functionality they can live without. Zoom's ability to re-install itself without user permission after it's been uninstalled is particularly worrisome. Since there's no official fix for the issue, you can remove Zoom's web server from your machine by following the steps described in Leitschuh's post.
Topics Cybersecurity
Kokoro to Headline Benefit for OCBC Building Fund
Edo Period Artwork on View at JACCC
THROUGH THE FIRE: Breaking Tradition for the Sake of Representation
Midnight Screening of ‘Spirited Away’ at Nuart
max: "We'll consider any result other than qualifying for the Major as failure"
Midnight Screening of ‘Spirited Away’ at Nuart
Changer.ae Ltd launches its Crypto Custodian Services in the UAE
Godzilla’s Latest Rampage Extended Through Oct. 27
Matsuri of Faith in Torrance
Chirpley Takes Flight to Ethereum Chain
NBC4 Celebrating APA Heritage
AOFverse Secures Grant Funding from The Arbitrum Foundation
Sui Tops $300M in TVL, Passes Bitcoin on this parameter and Joins Upper Echelon of DeFi Protocols
Countdown to the World Blockchain Summit Bangkok Begins!
IEM Dallas Group A opening round concludes; FURIA relegated to lower bracket
DH Open Cluj day four: First photos
Screenings of ‘Rashomon,’ ‘Seven Samurai’
Grateful Crane to Present Tohoku Goodwill Tour Concert and Misora Hibari Show
Karaoke Contest at Zenshuji Soto Temple
Ready to Pop
Oh nothing, just a man walking a duck with two dogs in his pocketsSecret citizen Peter Thiel thinks he is God's gift to New Zealand, basicallyLyft catches up to Uber again, adds calendar integrationOne hashtag is uniting Americans in the fight against TrumpDenis Leary knows he looks like Kellyanne Conway and he's not ruling out a biopicMeet Lovely, the sex toy that's like a FitBit for your dickA Syrian journalist's ordeal after Trump's travel banLEGO releases 'Beauty and the Beast' blocks just in time for the liveTeen headed to space camp 'gutted' after being denied U.S entryThis Super Bowl ad for Mexican avocados has nothing to do with Trump Get 50% off NordPass during its summer sale Apple's devices are about to get super Best smart home deals: Kasa Smart home deals Electric car maker Fisker files for bankruptcy Pakistan vs. Ireland 2024 livestream: Watch T20 World Cup for free 'House of the Dragon' Season 2, episode 1: The Helaena prophecy you may have missed Best headphone deal: Get the Beats Solo 4 for 35% off at Amazon Germany vs. Scotland 2024 livestream: Watch Euro 2024 for free Serbia vs. England 2024 livestream: Watch Euro 2024 for free Wordle today: The answer and hints for June 17
0.1377s , 10013.3203125 kb
Copyright © 2025 Powered by 【lee???? ????????】Zoom lets a website turn on your Mac's camera without permission,Global Hot Topic Analysis
