![](\"https:\/\/media.wired.com\/photos\/5d24d6cfc463480009014514\/master\/pass\/security_zoom_19108463913007.jpg\"\/)
<\/p>\n<\/p>\n
Credit to Author: Lily Hay Newman| Date: Tue, 09 Jul 2019 15:18:30 +0000<\/strong><\/p>\n Zoom has gained <\/span>devotees\u2014and a post-IPO boom\u2014thanks to its dead-simple video conferencing tech<\/a>. Joining a call is particularly easy; with the click of a meeting URL, the page automatically launches the desktop app, and you're in. But as security researcher Jonathan Leitschuh discovered, that seamlessness comes with a striking set of vulnerabilities for Zoom users on Apple computers\u2014including one that could let an attacker hijack your webcam.<\/p>\n On Monday, Leitschuh publicly disclosed<\/a> details of how an attacker could set up a malicious call, trick users into clicking a link to join it, and instantly add their video feed, letting them look into a victim's room, office, or wherever their webcam is pointing. In addition, Leitschuh found that attackers could also launch a denial of service attack against Macs by using the same mechanism to overwhelm them with join requests.<\/p>\n Zoom patched this DoS issue in a May update but for now is only adjusting its auto-join video settings, giving users a more prominent way of choosing whether their video feed automatically launches when they click a Zoom call link. Leitschuh says the new fix is not enough to address user privacy concerns or the underlying insecurity of the flow that allows Zoom to launch calls from meeting URLs so smoothly.<\/p>\n \u201cWithout the user giving any explicit consent nor taking any explicit action, they would be instantly dropped into a Zoom meeting,\u201d Leitschuh says of a malicious Zoom call attack. "By default, Zoom shows video but doesn't send audio, though both settings are changeable. So depending on their video and audio settings, victims would potentially be immediately broadcasting themselves, perhaps even without their knowledge if they're not looking at their screen."<\/p>\n To demonstrate the severity of the vulnerability, Leitschuh published some proof-of-concept attack links; click on them and you'll automatically join a call. Since Zoom hasn't issued the update meant to address this yet, the demo still very much works.<\/p>\n The vulnerability stems from a conscious choice on Zoom's part. To reduce friction from the video chat experience, Zoom sets up a local web server on every user\u2019s Mac that allows call URLs to automatically launch the desktop app. Zoom says that this setup is in place as a \u201cworkaround\u201d to a feature of Safari 12 that would require users to approve Zoom launching every time they click a call link. And though the workaround is there to deal with a Safari feature, the same setup applies no matter which browser you launch a Zoom link from. Zoom doesn't offer quite such a frictionless experience on Windows, but there's a box you can check to permanently dismiss the prompts and start video automatically, which would put you in a similar situation.<\/p>\n \u201cThe local web server enables users to avoid this extra click before joining every meeting. We feel that this is a legitimate solution to a poor user-experience problem,\u201d Zoom said in a statement<\/a> late Monday night. \u201cWe are not alone among video conferencing providers in implementing this solution.\u201d<\/p>\n "This is a very disturbing set of bugs, but unsurprising given other Zoom issues."<\/p>\n Thomas Reed, Malwarebytes<\/p>\n The Safari feature does add an extra step for users. But by circumventing that step, Zoom potentially exposes its users to strangers ogling them online\u2014which demonstrates the need for that extra layer of permission in the first place. Additionally, Leitschuh points out that Zoom\u2019s local web server persists on your Mac even if you uninstall the Zoom desktop app. If you ever click a Zoom call link again, the program can quickly download and reinstall itself automatically through the web server.<\/p>\n \u201cHaving an installed app that is running a web server on my local machine with a totally undocumented API feels incredibly sketchy to me,\u201d Leitschuh wrote in his report, noting that he combed the web for details about Zoom\u2019s application programming interface for this feature and couldn\u2019t find anything. \u201cThe fact that any website that I visit can interact with this web server running on my machine is a huge red flag for me.\u201d<\/p>\n Zoom has added a cryptographic signing mechanism for requests made to the local web servers, which is an authentication improvement, but Leitschuh has already proposed a way that an attacker could bypass the protection.<\/p>\n "This is a very disturbing set of bugs, but unsurprising given other Zoom issues I\u2019ve observed and reported in the past. The local web server is honestly the most concerning part, and it's not fixed," says Thomas Reed, a Mac research specialist at the security firm Malwarebytes. "The web server is concerning because of the possibility that someone could find a way to use it remotely to trigger remote code execution."<\/p>\n