Jul 09, 2019 Zoom app leaves Macs vulnerable to to camera hijacking and spying. The Zoom video conferencing app for Macs is so popular that this serious exploit. Zoom is the leader in modern enterprise video communications, with an easy, reliable cloud platform for video and audio conferencing, chat, and webinars across mobile, desktop, and room systems. Zoom Rooms is the original software-based conference room solution used around the world in board, conference, huddle, and training rooms, as well as executive offices and classrooms. Videoconferencing firm Zoom Video Communications Inc. Today issued a fix for a vulnerability that could have allowed a hacker to hijack a webcam on a Mac computer via a malicious website.Detail.
Use Zoom On Mac
What you need to know
- Another security flaw has been highlighted in Zoom.
- An ex-NSA hacker says a bug can be used to take over a Zoom user's Mac.
- They can also access your webcam and Microphone.
An ex-NSA hacker has found yet another critical security flaw in Zoom, this time in two bugs for Mac.
According to TechCrunch, an ex-NSA hacker has found two bugs within the macOS version of Zoom:
Wardle's first bug piggybacks off a previous finding. Zoom uses a 'shady' technique — one that's also used by Mac malware — to install the Mac app without user interaction. Wardle found that a local attacker with low-level user privileges can inject the Zoom installer with malicious code to obtain the highest level of user privileges, known as 'root.'
Those root-level user privileges mean the attacker can access the underlying macOS operating system, which are typically off-limits to most users, making it easier to run malware or spyware without the user noticing.
This is a reference to Zoom's installation protocol, which was described as 'very shady' by experts. From that report:
Ever wondered how the @zoom_us macOS installer does it's job without you ever clicking install? Turns out they (ab)use preinstallation scripts, manually unpack the app using a bundled 7zip and install it to /Applications if the current user is in the admin group (no root needed).
This is not strictly malicious but very shady and definitely leaves a bitter aftertaste. The application is installed without the user giving his final consent and a highly misleading prompt is used to gain root privileges. The same tricks that are being used by macOS malware.
Well, turns out that it is malicious because it can be used by an attacker to inject the installer with malicious code, obtaining 'the highest level of user privileges'.
A second bug, (yes, there's two, plus all the other ones) involves your webcam and microphone:
Zoom Camera Hack Macs Free
The second bug exploits a flaw in how Zoom handles the webcam and microphone on Macs. Zoom, like any app that needs the webcam and microphone, first requires consent from the user. But Wardle said an attacker can inject malicious code into Zoom to trick it into giving the attacker the same access to the webcam and microphone that Zoom already has. Once Wardle tricked Zoom into loading his malicious code, the code will 'automatically inherit' any or all of Zoom's access rights, he said — and that includes Zoom's access to the webcam and microphone.
In fairness, as these have all been revealed by this blog post, giving Zoom almost no time to address them. However, Zoom appears to be a total dumpster fire when it comes to privacy and security. It has also been revealed that despite claims, Zoom's calls are not end-to-end encrpyted, and that its 'company director' feature pooled thousands of strangers, leaking personal data.
We may earn a commission for purchases using our links. Learn more.
Zoom Camera Hack Macs Pc
exposure notificationNational COVID-19 server to use Apple and Google's API, hosted by Microsoft
The Association of Public Health Laboratories has announced it is working with Apple, Google, and Microsoft to launch a national server that will securely store COVID-19 exposure notification data.
Earlier this year, Apple faced a major security crisis when its Group FaceTime was reported to have a bug that would let people spy on iOS users by simply calling them. Now its the turn of Mac users to experience the same but, fortunately, it isn’t applicable to all Mac owners nor is it Apple’s bug to fix. Unfortunately, the Zoom video conferencing app for Macs is so popular that this serious exploit all the more dangerous.
Software developers will naturally take steps to make their products as easy to use as possible but sometimes those methods can have terrible side effects. In the case of Zoom, it installs a local webserver on the Mac to make it easy for users to join video conferences by simply clicking on a link. Unfortunately, it also leaves them vulnerable to hackers.
Click on one such “join” link could give a remote attacker access to the user’s camera with no need for the user’s content. This, according to security researcher Jonathan Leitschuh, is due to the implementation terrible security. It is also due to the fact that Zoom even needs a webserver to do its magic.
That web server is pretty much the root of all Zoom’s ills. Even uninstalling Zoom doesn’t fix it because, using that same exploit, the app could be re-installed by clicking on a link as well. All of these without any interaction from the user.
Zoom’s response, however, isn’t encouraging either. While it acknowledged existence of the bug, Leitschuh says that the “quick fix” the company implemented doesn’t sufficiently address the problem. Worse, it seems that Zoom is unwilling to move away from its webserver-based magic to something more secure, all for the stated purpose of making lives easier, but also less secure, for its users.