On Monday, people started to try out the vulnerability … and it worked. As The Verge explains it, the Zoom app “installs a web server on Macs that accepts requests regular browsers wouldn’t.” In other words, if you have Zoom installed on your Mac - or if you ever had it - a website could spy on you or undertake a denial of service (DoS) attack, where a bad actor could basically hit a user with a barrage of meeting requests and lock up his or her computer. This re-install ‘feature’ continues to work to this day. On top of this, this vulnerability would have allowed any webpage to DOS (Denial of Service) a Mac by repeatedly joining a user to an invalid call.Īdditionally, if you’ve ever installed the Zoom client and then uninstalled it, you still have a localhost web server on your machine that will happily re-install the Zoom client for you, without requiring any user interaction on your behalf besides visiting a webpage. This vulnerability allows any website to forcibly join a user to a Zoom call, with their video camera activated, without the user’s permission. Here is, basically, what Leitschuh uncovered: In a Medium post, Leitschuh said he initially disclosed the vulnerability to Zoom on March 26, 2019, but the company still failed to resolve it beyond an initial fix he’d first suggested.
On Monday, security researcher Jonathan Leitschuh publicly disclosed a vulnerability in the video-conferencing program Zoom that apparently would allow someone to turn on your Mac’s webcam and force you to join a Zoom call without your permission. If you have a Mac and you have ever used Zoom video conferencing, you might have a problem - though as of Thursday both Zoom and Apple say they’re fixing it.
0 kommentar(er)
