A zero-day Zoom vulnerability could allow third parties to snoop on videoconferencing calls, reactivate uninstalled apps and conduct other malicious activities.

Details of the problem were initially disclosed in a blog post by independent security researcher Jonathan Leitschuh. An issue in the product’s architecture involving a localhost web server means a third party could potentially join a videoconferencing call without permission. Even if the client is removed, it can be automatically reinstalled just by visiting a webpage.

So far, there have been no reports of threat actors exploiting the Zoom vulnerability, but it could affect the firm’s millions of users unless they update their settings to deactivate the webcam by default.

How the Zoom Vulnerability Emerged

Leitschuh said he had reported his findings to Zoom back in March with a proposed quick-fix solution, but the company did not implement it until late last month. Security best practices generally recommend public disclosure of major threats or vulnerabilities within a 90-day period, and the blog post suggested the company had not acted in a timely manner to protect its customers.

A Zoom spokesperson told Forbes, however, that it had begun analyzing the problem within 10 minutes of learning about it, and that the ability to have one-click access to join videoconferencing calls was intended to address poor user experiences for those running Apple’s Safari 12 web browser.

In a more detailed public statement, Zoom said admins and users will be able to turn off video if they configure their client video settings, and that preferences from their first Zoom meeting will be saved once they apply its July update. The company also plans to release an uninstaller app that will allow customers to more easily delete both the Zoom local web server and its Zoom client rather than forcing them to do so manually.

Don’t Be Surprised by Zero-Days

The challenge with something like this Zoom vulnerability is that users might simply be unaware of any danger. As patches and other solutions become available, the biggest question they’re likely to ask is, “Am I affected?”

It’s best to be proactive in answering that question by connecting directly to watchlists and receiving notifications of any malicious indicators, according to IBM experts. This can be done automatically by using intelligent security analytics tools that have such features built in.

more from

From Ramnit To Bumblebee (via NeverQuest): Similarities and Code Overlap Shed Light On Relationships Between Malware Developers

A comparative analysis performed by IBM Security X-Force uncovered evidence that suggests Bumblebee malware, which first appeared in the wild last year, was likely developed directly from source code associated with the Ramnit banking trojan. This newly discovered connection is particularly interesting as campaign activity has so far linked Bumblebee to affiliates of the threat group ITG23 (aka the Trickbot/Conti…

X-Force 2022 Insights: An Expanding OT Threat Landscape

This post was written with contributions from Dave McMillen. So far 2022 has seen international cyber security agencies issuing multiple alerts about malicious Russian cyber operations and potential attacks on critical infrastructure, the discovery of two new OT-specific pieces of malware, Industroyer2 and InController/PipeDream, and the disclosure of many operational technology (OT) vulnerabilities. The OT cyber threat landscape is expanding dramatically and OT…