Zoom Zero-Day Bug Opens Mac Users to Webcam Hijacking

Pedestrians use crosswalk in large metropolis

Pedestrians use crosswalk in large metropolis

He demonstrated that any website can open up a video-enabled call on a Mac with the Zoom app installed.

Millions of people use Zoom's corporate video conferencing apps. The good news, though, is that there are solutions (one is seriously hard, though), and Zoom seems to be fixing it all soon. Users should update the client; manual downloads can be found here.

"The July 9 patch to the Zoom app on Mac devices detailed below is now live", Zoom noted in the latest blog update on its webpage.

This slow response has been noticed by security experts, who also slammed the firm for its decision about the uninstall option.

This local server left users vulnerable even after they had uninstalled the Zoom client.

Yuan also said his company took "full ownership and we've learned a great deal" from the saga that began when security researcher Jonathan Leitschuh contacted the company in March.

Leitschuh shared this tip in his post revealing the flaw.

Futures slip ahead of Powell's testimony
Trump and Chinese President Xi Jinping declared a truce last month in what had threatened to become an escalating U.S. Minutes from the last Federal Open Market Committee meeting, held mid-June, are scheduled to be released at 2 p.m.

On Tuesday, Zoom defended the use of the server, saying to ZDNet in a statement that it was a "legitimate solution to a poor user experience, enabling our users to have seamless, one-click-to-join meetings, which is our key product differentiator".

Farley says "the consensus seems to be we'd rather have our users have to make an extra click to join a meeting than have this extra piece of code listening in on a port on a Mac".

Ultimately, the voice of users and security professionals led to Zoom deciding that the risks outweighed convenience factor provided by the local web server.

The problem here is that going through the normal procedure of removing Zoom will not remove the phantom web server that remains on your Mac, which again means that if you've ever installed Zoom on your computer, you're technically still running it, regardless of whether you can see any signs of it or not.

On Tuesday, Zoom said tonight's update will remove the local web server to secure the system and do away with the use of these servers moving forward.

Oh, and a victim doesn't even need to even be tricked into opening a web page. It's used by 750,000 companies around the world to conduct their business, including such big names as Nasdaq, the U.S. Centers for Disease Control and Prevention, the U.S. Department of Homeland Security, and the U.S. Department of Energy.

When cybersecurity lets you down, the best solution is to always cover yourself physically; and in this case, covering your webcam physically. Leitschuh pointed out in his blog that it's possible to ambush call someone and force the recipient's camera to be turned on via settings in Zoom's call interface. The first is an audio-only version; the second link, which includes "iframe" in the URL, starts a call with video active.

Recommended News

  • Palit RTX 2070 Super GameRock Graphics Card Review

    Palit RTX 2070 Super GameRock Graphics Card Review

    The RTX 2060 Super comes with a TU106 GPU and has 2176 CUDA cores, and now boasts 8GB of GDDR6 memory - versus 6GB on the standard RTX 2060 - over a 256-bit interface.
    Everton, Arsenal circle as Malcom agent arrives in England

    Everton, Arsenal circle as Malcom agent arrives in England

    Emery has all but given up on landing Zaha after his £40m bid - which is half what Crystal Palace want - was rejected. Another Premier League side are also monitoring Malcom's situation in the form of Unai Emery's Arsenal .
    Dora And the Lost City of Gold Official Trailer #2 - HD

    Dora And the Lost City of Gold Official Trailer #2 - HD

    The film is produced by Christopher Robin producer Kristin Burr, who is joined by longtime Bobin associate, executive producer John G.
  • Little chance of Clowney-Texans agreement

    Little chance of Clowney-Texans agreement

    Players rarely go the Le'Veon Bell route when hit with the franchise tag , as it requires giving up a ton of money. Via the NFL Players Association, the Texans now have $40.27 million in salary cap space.

    Rashford defends Man Utd pal Lingard over video controversy

    Rashford has made over 160 appearances for United across all competitions, scoring 45 goals. It was a mistake, but there is not much more I can say about that'.
    Matt Cullen retiring from the National Hockey League

    Matt Cullen retiring from the National Hockey League

    Since debuting in the NHL in 1997, Cullen has appeared in 1,516 NHL games - 19th most in NHL history. Even if we had won the Cup I would have been done.
  • 'Oldest remains' outside Africa reset human migration clock

    'Oldest remains' outside Africa reset human migration clock

    An worldwide team of researchers used state-of-the art computer modelling and uranium dating to re-examine the two skulls. He expressed reservations, because the now re-imagined skull bones from Greece only in the fragments available.
    How to Watch Today's Amazon Prime Day Concert with Taylor Swift

    How to Watch Today's Amazon Prime Day Concert with Taylor Swift

    Walmart is hosting Google Week , which includes up to 50 percent off products like Google Home and Nest from July 8 to July 16. Below are the best beauty, makeup , hair care, and skincare Prime Day deals to best fit your beauty needs.
    Trump and Xi talked by phone on Tuesday, no details reported

    Trump and Xi talked by phone on Tuesday, no details reported

    Washington wants Beijing to address what United States officials see as decades of unfair and illegal trading practices. Meanwhile, the Trump administration on Tuesday chose to exempt 110 Chinese imports from the ambit of high tariffs .
  • Federal Appeals Court Hands Win to Trump in Hotel 'Emoluments' Case

    Federal Appeals Court Hands Win to Trump in Hotel 'Emoluments' Case

    Court of Appeals for the District of Columbia Circuit to instead allow for a mid-case appeal or to dismiss the case outright. Meanwhile, on Monday , Department of Justice lawyers challenged a federal judge's decision to allow a case accusing Mr.
    PICARD's Dog Debuts in STAR TREK Spin-Off Poster

    PICARD's Dog Debuts in STAR TREK Spin-Off Poster

    During the course of the series, Picard took a leave from Starfleet to visit the vineyard, which is being run by his brother. Former Star Trek: The Next Generation co-star Jonathan Frakes will return to direct two episodes of the series as well.
    Metal drinking straw fatally impales woman through eye, brain after fall

    Metal drinking straw fatally impales woman through eye, brain after fall

    There is no give in them at all. 'If someone does fall on one and it's pointed in the wrong direction, serious injury can occur'. The 60-year-old's wife said she believes the metal straws can be extremely hazardous, especially for those with mobility issues.

We are pleased to provide this opportunity to share information, experiences and observations about what's in the news.
Some of the comments may be reprinted elsewhere in the site or in the newspaper.
Thank you for taking the time to offer your thoughts.