Video conferencing app Zoom has a major security flaw in its Mac client,secret sex with fat sister videos letting any website turn on your Mac's camera without a warning, security researcher Jonathan Leitschuh claims.
In a blog post Monday, Leitschuh detailed the vulnerability, which he says he'd disclosed to Zoom more than 90 days ago, and the company still hasn't fixed it.
SEE ALSO: Google Nest camera security flaw allows former owners to observe others' homesThe problem lies in Zoom's usage of a web server on users' local machines. This makes some of Zoom's cool features possible, for example, clicking on a simple link in your web browser automatically starts up the app.
Having an app install and run a web server on a user's machine with an undocumented API "feels incredibly sketchy," Leitschuh says. But there's more. According to Leitschuh, "this web server can do far more than just launch a Zoom meeting. (...) this web server can also re-install the Zoom app if a user has uninstalled it."
This is bad by itself, but Leitschuh discovered a vulnerability that let him launch a Zoom call, with video enabled, on a user's machine without permission. The same vulnerability allows the attacker to perform a DOS (denial of service) type attack on a user's machine.
Leitschuh says that he'd contacted Zoom on March 26, offering the company a quick fix for the vulnerability. After a lot of back and forth, Zoom partially fixed the flaw, but Leitschuh was able to bypass their fix, after which the company offered no additional fix. The security issue is still present in the latest version of Zoom for Mac, 4.4.4.
In a blog post Monday, Zoom defended its app's functionality, claiming that users are prompted to turn their video off when joining their first meeting, and can set the video to off in subsequent meetings; if they do so, it would be impossible for the host or other participants to turn their camera on. Furthermore, Zoom claims, "because the Zoom client user interface runs in the foreground upon launch, it would be readily apparent to the user that they had unintentionally joined a meeting and they could change their video settings or leave immediately."
The company said they will give users more control of their video settings in an upcoming, July 2019 release.
The company also addresses the presence of the web server on user machines, saying it's a "workaround to a change introduced in Safari 12" and a "legitimate solution to a poor user experience problem."
Zoom has assessed that both the video call issue and the DOS issue were "low risk," which is why the company decided not to change the app's functionality. The company also promised it will launch a public vulnerability disclosure program in the "next several weeks."
The main question users should be asking themselves is whether they want to sacrifice their system's security for a bit of added functionality -- likely, functionality they can live without. Zoom's ability to re-install itself without user permission after it's been uninstalled is particularly worrisome. Since there's no official fix for the issue, you can remove Zoom's web server from your machine by following the steps described in Leitschuh's post.
Topics Cybersecurity
Previous：Alliance подписала 18
A NASA rover just exposed something on Mars that eluded orbiters
Best LG C4 deal: Save $150 on this 42
Google Search AI Overviews at 6 months: Is the feature getting better?
NYT Strands hints, answers for December 5
Best music streaming deal: Get a free 3
Best free online courses from Harvard University
'Challengers' internet reactions: See the funniest and sexiest tweets
Bumble revamps the 'first move' and other features
A NASA rover just exposed something on Mars that eluded orbiters
FKA twigs creates deepfake of herself, calls for AI regulation
Вышел трейлер скинов в честь Uzi из Зала славы League of Legends — они стоят $450
NYT Strands hints, answers for December 5
Google Search AI Overviews at 6 months: Is the feature getting better?
Add holiday cheer to your Mac's desktop with Festivitas
CPU and GPU Availability and Pricing Update: April 2021
Tinder's 'Share My Date' feature lets friends and family keep up with new dates
How to delete your Tinder account
Wordle today: The answer and hints for December 6
Celestron telescopes on sale: Save up to 39%
How to set boundaries in the early stages of dating
NYT Connections hints and answers for November 26: Tips to solve 'Connections' #534.Why is Drake suing UMG and Spotify over Kendrick Lamar?Sam Altman and OpenAI employees are flooding the timeline with heart emojisRoblox avatars are helping Gen Z embrace their 'authentic selves'TikTok has an obsession with testing friends and partners — it needs to stopBest Lego deal: Lego Friends Advent Calendar Playset on sale for $25.11Nintendo Switch Pro Controller deal: Save $20.99 at WalmartSam Altman and OpenAI employees are flooding the timeline with heart emojisHisense Smart TV Black Friday deal: $548 at WalmartThe best Black Friday Instant Pot deals for 2023 Blair Braverman uses her adorable dogs to talk about body image Review roundup: Critics dismiss 'The Lion King' 2019 as stale retread 'Frankenstein's Monster's Monster, Frankenstein' is the weirdest thing Google Doodle celebrates Apollo 11 moon landing anniversary 4 ways to help our national parks flourish this summer FaceApp's aging filter has people comparing their selfies to pictures of their parents Take a look at the pickup truck emoji that could arrive in 2020 Tesla simplifies lineup again, removes Standard Range Model S and X Flamethrower attachments for drones now a reality Everything coming to (and going from) Hulu in August 2019
0.1806s , 12495.2265625 kb
Copyright © 2025 Powered by 【secret sex with fat sister videos】Enter to watch online.Zoom lets a website turn on your Mac's camera without permission,
