SoylentNews is people
SoylentNews
Submission Preview
Critical 'Zoomsday' Flaw Enables Total Device Takeover During Zoom Calls
EDITORS: THIS HAS BEEN PRODUCED BY SOFTWARE UNDER DEVELOPMENT - THE CONTENT MAY REQUIRE EXTENSIVE EDITING
Critical 'Zoomsday' Flaw Enables Total Device Takeover During Zoom Calls — AI-Assisted Research Only Used 20 Prompts To Find An Exploit To Hack Hundreds Of Millions Of People.
The team claims it cooked the exploit with merely 20 prompts to an AI agent. The exploitable area is substantial, as recent estimates pin Zoom's monthly active users at around 220 million [countly.net] and an estimated 56% [programming-helper.com] of the global conferencing market share.
With the exploit, the attacker was able to get full remote code execution, meaning they could effectively control the user's computer and their data — invisibly, to boot. Zoom isn't an application that runs with administrator privileges, so kernel-level rootkits are off the menu, but once you have the user's data, it's not like you need much else. Plus, it's easy to gain exploit persistence any number of other ways.
A.Security says a small team developed this exploit with a mere 20 prompts to an AI agent — pointing out how easy it was to come up with a nation-state-class vulnerability with meager resources. While the majority of AI-assisted vulnerability research focuses on open-source software or applications with published communications protocols or file formats, Zoom is fully proprietary, and it was still easily cracked open.
The firm further noted that "the model requiring elite teams, months of effort, and weapons-grade budgets has collapsed," and that "the barrier that kept these weapons scarce has collapsed, and it will not come back" — basically repeating what every security researcher has been yelling from the top of their lungs for the past year or so.
The vulnerability itself is, rather unsurprisingly, a buffer overrun: the program fails to check that an input is the right size, so you can push more data than it expects and overwrite part of the following memory with code that will be executed.
First, the scientists decompiled the Android package and asked an AI agent to rank the potential attack surfaces to relatively little success. They then turned their attention to the communications protocol. They found that the code library handling annotations received each object (rectangles, text, etc.) in serialized form, with count fields telling the recipient how much data to read next.
Crucially, they found that the code handling these reads didn't have a boundary check for maximum size, meaning one could simply lie about it and send a chunk of data that's too large and padded with exploit code at the end, as Norman Stansfield would say, bin-go [youtube.com]!
