Critical Zoom Vulnerability Triggers Remote Code Execution Without User Input:
A zero-day vulnerability in Zoom which can be used to launch remote code execution (RCE) attacks has been disclosed by researchers.
Pwn2Own, organized by the Zero Day Initiative, is a contest for white-hat cybersecurity professionals and teams to compete in the discovery of bugs in popular software and services.
[...] For successful entrants, the financial rewards can be high -- and in this case, Daan Keuper and Thijs Alkemade earned themselves $200,000 for their Zoom discovery.
The researchers from Computest demonstrated a three-bug attack chain that caused an RCE on a target machine, and all without any form of user interaction.
[...] As noted by Malwarebytes, the attack works on both Windows and Mac versions of Zoom, but it has not -- yet -- been tested on iOS or Android. The browser version of the videoconferencing software is not impacted.
In a statement to Tom's Guide, Zoom thanked the Computest researchers and said the company was "working to mitigate this issue with respect to Zoom Chat." In-session Zoom Meetings and Zoom Video Webinars are not affected.
"The attack must also originate from an accepted external contact or be a part of the target's same organizational account," Zoom added. "As a best practice, Zoom recommends that all users only accept contact requests from individuals they know and trust."
[...] End-users just need to wait for a patch to be issued -- but if worried, they can use the browser version in the meantime.
Related Stories
Windows 11, Tesla, Ubuntu, and macOS hacked at Pwn2Own 2023:
On the first day of Pwn2Own Vancouver 2023, security researchers successfully demoed Tesla Model 3, Windows 11, and macOS zero-day exploits and exploit chains to win $375,000 and a Tesla Model 3.
The first to fall was Adobe Reader in the enterprise applications category after Haboob SA's Abdul Aziz Hariri (@abdhariri) used an exploit chain targeting a 6-bug logic chain abusing multiple failed patches which escaped the sandbox and bypassed a banned API list on macOS to earn $50,000.
The STAR Labs team (@starlabs_sg) demoed a zero-day exploit chain targeting Microsoft's SharePoint team collaboration platform that brought them a $100,000 reward and successfully hacked Ubuntu Desktop with a previously known exploit for $15,000.
Synacktiv (@Synacktiv) took home $100,000 and a Tesla Model 3 after successfully executing a TOCTOU (time-of-check to time-of-use) attack against the Tesla – Gateway in the Automotive category. They also used a TOCTOU zero-day vulnerability to escalate privileges on Apple macOS and earned $40,000.
Oracle VirtualBox was hacked using an OOB Read and a stacked-based buffer overflow exploit chain (worth $40,000).
Last but not least, Marcin Wiązowski elevated privileges on Windows 11 using an improper input validation zero-day that came with a $30,000 prize.
Throughout the Pwn2Own Vancouver 2023 contest, security researchers will target products in enterprise applications, enterprise communications, local escalation of privilege (EoP), server, virtualization, and automotive categories.
[...] After zero-day vulnerabilities are demoed and disclosed during Pwn2Own, vendors have 90 days to create and release security fixes for all reported flaws before Trend Micro's Zero Day Initiative publicly discloses them.
During last year's Vancouver Pwn2Own contest, security researchers earned $1,155,000 after hacking Windows 11 six times, Ubuntu Desktop four times, and successfully demonstrating three Microsoft Teams zero-days.
Previous:
Critical Zoom Vulnerability Triggers Remote Code Execution Without User Input
Work from Home Pwn2Own Hackers Make $130,000 in 48 Hours from Windows 10 Exploits
It's March 2018 and Your Windows PC Can Be Pwned By a Web Article
(Score: 2) by Freeman on Monday April 12 2021, @07:29PM
The S in Security stands for Security, oh wait, that's not the mantra. Still, this is just another security hole that's come to light after how many other since the pandemic began? Zoom rocketed in use and so has the interest in finding all of the bugs. Not by the company mind you, but those that are looking to exploit it.
Joshua 1:9 "Be strong and of a good courage; be not afraid, neither be thou dismayed: for the Lord thy God is with thee"
(Score: 0) by Anonymous Coward on Monday April 12 2021, @07:42PM
I wonder if Pwn2Own is owned by the same people as that other notable security firm Crypto AG?
(Score: 1, Insightful) by Anonymous Coward on Monday April 12 2021, @08:14PM (1 child)
... to not have been pwned by this exploit yet.
(Score: 2) by Freeman on Monday April 12 2021, @09:24PM
A much more fitting end to that sentence. Since by the nature of the exploit, you can't know, unless you are talking to them and know they are who they say they are.
Joshua 1:9 "Be strong and of a good courage; be not afraid, neither be thou dismayed: for the Lord thy God is with thee"
(Score: 1) by fustakrakich on Monday April 12 2021, @09:41PM (2 children)
Are the alternatives that worthless?
La politica e i criminali sono la stessa cosa..
(Score: 5, Informative) by Booga1 on Tuesday April 13 2021, @02:23AM
The fact it was "free" was a big deal. Plus it claimed to have "end to end" encryption when that was gaining visibility with the public. Of course, that was a lie.
What propelled them to popularity was the foothold they got in the education market. While it wasn't that popular at first, it was free and "easy" to use for non-technical staff. Then the pandemic hit. Timing is everything. Teachers talk to other teachers and they all start just picking Zoom because Ms. Smith over at the high school used it a couple of times. That's all the momentum it needed. I see parallels to when Microsoft was giving copies of MS Office away to schools.
They have a horrible track record of vulnerabilities, gaffs, and privacy flaws. [soylentnews.org]
They had problems before the pandemic: Video Calls At Risk From Hackers [forbes.com]
They routed their data through China: Zoom Admits Data Got Routed Through China [soylentnews.org]
They've lied about their encryption: Zoom Meetings Aren’t End-to-End Encrypted, Despite Misleading Marketing [theintercept.com]
They had to buy a company to actually deliver encryption: Zoom Acquires Keybase to Bring End-to-End Encryption to Video Platform [soylentnews.org]
Then tried to leave free users in the lurch so they could be spied on: Zoom says free users won’t get end-to-end encryption so FBI and police can access calls [theverge.com]
And so on...
At this point they have pretty much the worst software bugs in recent memory after Adobe and WordPress. They have horrible privacy issues, bad business policies, practices, ethics, and security.
The only thing going for them is cost and ease of use. Apparently that's good enough to become a major player in the video conferencing market.
(Score: 1, Interesting) by Anonymous Coward on Tuesday April 13 2021, @04:25PM
Somehow it's a lot easier to use than Teams, Webex, etc.
My mom and her friends can use Zoom. She needs a bit of help to use Webex every now and then. Hope she never needs to use Microsoft Teams.
She can use WhatsApp too, but for some reason it doesn't scale as well as Zoom for video.
Discord is for the young kids (and even then I see a lot of users not understand the split in chat and voice channels). See also: https://support.discord.com/hc/en-us/community/posts/360032342232-Link-a-voice-channel-with-a-text-chat [discord.com] and https://www.reddit.com/r/discordapp/comments/5w8vc3/merge_voice_and_text_channels/ [reddit.com]
(Score: 1, Informative) by Anonymous Coward on Tuesday April 13 2021, @02:50AM (2 children)
From tfa:
> The browser version of the videoconferencing software is not impacted.
I've been using the browser version of Zoom with a new customer, but when I went to share my screen I found out that the only screens it will share are other browser tabs (Chrome, Windows 7). To share some other screen (like a local pdf file through Sumatra) requires downloading and running the Zoom app.
If I'm not presenting, I still use the browser version...
(Score: 0) by Anonymous Coward on Tuesday April 13 2021, @04:25AM
I exclusively use their web client because I don't trust their app. The web client doesn't have as many options but you should still be able to share your desktop if that is an acceptable alternative.
(Score: 0) by Anonymous Coward on Tuesday April 13 2021, @04:28PM
That's kind of why you should use the browser version by default... Just make sure it's a different browser from the one you use to watch porn. ;)