July 10, 2019 By Shane Schick 2 min read

A zero-day Zoom vulnerability could allow third parties to snoop on videoconferencing calls, reactivate uninstalled apps and conduct other malicious activities.

Details of the problem were initially disclosed in a blog post by independent security researcher Jonathan Leitschuh. An issue in the product’s architecture involving a localhost web server means a third party could potentially join a videoconferencing call without permission. Even if the client is removed, it can be automatically reinstalled just by visiting a webpage.

So far, there have been no reports of threat actors exploiting the Zoom vulnerability, but it could affect the firm’s millions of users unless they update their settings to deactivate the webcam by default.

How the Zoom Vulnerability Emerged

Leitschuh said he had reported his findings to Zoom back in March with a proposed quick-fix solution, but the company did not implement it until late last month. Security best practices generally recommend public disclosure of major threats or vulnerabilities within a 90-day period, and the blog post suggested the company had not acted in a timely manner to protect its customers.

A Zoom spokesperson told Forbes, however, that it had begun analyzing the problem within 10 minutes of learning about it, and that the ability to have one-click access to join videoconferencing calls was intended to address poor user experiences for those running Apple’s Safari 12 web browser.

In a more detailed public statement, Zoom said admins and users will be able to turn off video if they configure their client video settings, and that preferences from their first Zoom meeting will be saved once they apply its July update. The company also plans to release an uninstaller app that will allow customers to more easily delete both the Zoom local web server and its Zoom client rather than forcing them to do so manually.

Don’t Be Surprised by Zero-Days

The challenge with something like this Zoom vulnerability is that users might simply be unaware of any danger. As patches and other solutions become available, the biggest question they’re likely to ask is, “Am I affected?”

It’s best to be proactive in answering that question by connecting directly to watchlists and receiving notifications of any malicious indicators, according to IBM experts. This can be done automatically by using intelligent security analytics tools that have such features built in.

More from

Generative AI security requires a solid framework

4 min read - How many companies intentionally refuse to use AI to get their work done faster and more efficiently? Probably none: the advantages of AI are too great to deny.The benefits AI models offer to organizations are undeniable, especially for optimizing critical operations and outputs. However, generative AI also comes with risk. According to the IBM Institute for Business Value, 96% of executives say adopting generative AI makes a security breach likely in their organization within the next three years.CISA Director Jen…

Q&A with Valentina Palmiotti, aka chompie

4 min read - The Pwn2Own computer hacking contest has been around since 2007, and during that time, there has never been a female to score a full win — until now.Valentina Palmiotti, aka chompie, changed that. At the March 2024 competition, Palmiotti scored a full win with her discovery of an Improper Update of Reference Count bug to escalate privileges on Windows 11. It was her first time entering Pwn2Own.Pwn2Own is considered one of the most — if not the most — prestigious…

Self-replicating Morris II worm targets AI email assistants

4 min read - The proliferation of generative artificial intelligence (gen AI) email assistants such as OpenAI’s GPT-3 and Google’s Smart Compose has revolutionized communication workflows. Unfortunately, it has also introduced novel attack vectors for cyber criminals. Leveraging recent advancements in AI and natural language processing, malicious actors can exploit vulnerabilities in gen AI systems to orchestrate sophisticated cyberattacks with far-reaching consequences. Recent studies have uncovered the insidious capabilities of self-replicating malware, exemplified by the “Morris II” strain created by researchers. How the Morris…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today