29 votes

The Mac client for Zoom (video-conferencing app) allows any site to enable your camera and connect you to a call, and leaves a web server running on your machine even if you uninstall it

Posted July 9, 2019 by Deimos

Tags: security, apple, zoom, mac, video conferencing, author.jonathan leitschuh, source.medium, paywall

https://medium.com/@jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5

Link information

This data is scraped automatically and may be incorrect.

Title: Zoom Zero Day: 4+ Million Webcams & maybe an RCE? Just get them to visit your website!
Authors: Jonathan Leitschuh
Published: Jul 9 2019
Word count: 1330 words

3 comments

ammut
July 9, 2019
Link
This is a huge deal. Zoom has been taking strides to become the #1 conference platform. This will set them back quite a bit.

This is a huge deal. Zoom has been taking strides to become the #1 conference platform. This will set them back quite a bit.

9 votes
Deimos (OP)
July 9, 2019
Link
A couple of official responses from Zoom: Blog post: Response to Video-On Concern "Public statement" (PDF): https://assets.zoom.us/docs/pdf/Zoom+Response+Video-On+Vulnerability.pdf
A couple of official responses from Zoom:
- Blog post: Response to Video-On Concern
- "Public statement" (PDF): https://assets.zoom.us/docs/pdf/Zoom+Response+Video-On+Vulnerability.pdf
5 votes
Deimos (OP)
July 9, 2019
Link
Zoom's response blog post has a number of updates at the top now, including saying that they released an update about an hour and a half ago that totally removes the local webserver.

Zoom's response blog post has a number of updates at the top now, including saying that they released an update about an hour and a half ago that totally removes the local webserver.

1 vote