July 10, 2019 By Shane Schick 2 min read


A zero-day Zoom vulnerability could allow third parties to snoop on videoconferencing calls, reactivate uninstalled apps and conduct other malicious activities.

Details of the problem were initially disclosed in a blog post by independent security researcher Jonathan Leitschuh. An issue in the product’s architecture involving a localhost web server means a third party could potentially join a videoconferencing call without permission. Even if the client is removed, it can be automatically reinstalled just by visiting a webpage.

So far, there have been no reports of threat actors exploiting the Zoom vulnerability, but it could affect the firm’s millions of users unless they update their settings to deactivate the webcam by default.

How the Zoom Vulnerability Emerged

Leitschuh said he had reported his findings to Zoom back in March with a proposed quick-fix solution, but the company did not implement it until late last month. Security best practices generally recommend public disclosure of major threats or vulnerabilities within a 90-day period, and the blog post suggested the company had not acted in a timely manner to protect its customers.

A Zoom spokesperson told Forbes, however, that it had begun analyzing the problem within 10 minutes of learning about it, and that the ability to have one-click access to join videoconferencing calls was intended to address poor user experiences for those running Apple’s Safari 12 web browser.

In a more detailed public statement, Zoom said admins and users will be able to turn off video if they configure their client video settings, and that preferences from their first Zoom meeting will be saved once they apply its July update. The company also plans to release an uninstaller app that will allow customers to more easily delete both the Zoom local web server and its Zoom client rather than forcing them to do so manually.

Don’t Be Surprised by Zero-Days

The challenge with something like this Zoom vulnerability is that users might simply be unaware of any danger. As patches and other solutions become available, the biggest question they’re likely to ask is, “Am I affected?”

It’s best to be proactive in answering that question by connecting directly to watchlists and receiving notifications of any malicious indicators, according to IBM experts. This can be done automatically by using intelligent security analytics tools that have such features built in.

More from

Unified endpoint management for purpose-based devices

4 min read - As purpose-built devices become increasingly common, the challenges associated with their unique management and security needs are becoming clear. What are purpose-built devices? Most fall under the category of rugged IoT devices typically used outside of an office environment and which often run on a different operating system than typical office devices. Examples include ruggedized tablets and smartphones, handheld scanners and kiosks. Many different industries are utilizing purpose-built devices, including travel and transportation, retail, warehouse and distribution, manufacturing (including automotive)…

Stealthy WailingCrab Malware misuses MQTT Messaging Protocol

14 min read - This article was made possible thanks to the hard work of writer Charlotte Hammond and contributions from Ole Villadsen and Kat Metrick. IBM X-Force researchers have been tracking developments to the WailingCrab malware family, in particular, those relating to its C2 communication mechanisms, which include misusing the Internet-of-Things (IoT) messaging protocol MQTT. WailingCrab, also known as WikiLoader, is a sophisticated, multi-component malware delivered almost exclusively by an initial access broker that X-Force tracks as Hive0133, which overlaps with TA544. WailingCrab…

Operationalize cyber risk quantification for smart security

4 min read - Organizations constantly face new tactics from cyber criminals who aim to compromise their most valuable assets. Yet despite evolving techniques, many security leaders still rely on subjective terms, such as low, medium and high, to communicate and manage cyber risk. These vague terms do not convey the necessary detail or insight to produce actionable outcomes that accurately identify, measure, manage and communicate cyber risks. As a result, executives and board members remain uninformed and ill-prepared to manage organizational risk effectively.…

Pentesting vs. Pentesting as a Service: Which is better?

5 min read - In today's quickly evolving cybersecurity landscape, organizations constantly seek the most effective ways to secure their digital assets. Penetration testing (pentesting) has emerged as a leading solution for identifying potential system vulnerabilities while closing security gaps that can lead to an attack. At the same time, a newer entrant into the security arena is Pentesting as a Service (PTaaS). Although PTaaS shares some similarities with pentesting, distinct differences make them two separate solutions. This article will discuss how these methodologies…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today