jozoqa.blogg.se

Rather hilariously Apple (forcibly!) removed the vulnerable Zoom component from user’s macs worldwide via macOS’s Malware Removal Tool ( MRT): "Zoom Zero Day: 4+ Million Webcams & maybe an RCE?". 📝 Interested in more details? Read Jonathan's excellent writeup: This re-install ‘feature’ continues to work to this day.” -Jonathan Leitschuh

“ This vulnerability allows any website to forcibly join a user to a Zoom call, with their video camera activated, without the user’s permission.Īdditionally, if you’ve ever installed the Zoom client and then uninstalled it, you still have a localhost web server on your machine that will happily re-install the Zoom client for you, without requiring any user interaction on your behalf besides visiting a webpage. In June 2019, the security researcher Jonathan Leitschuh discovered a trivially exploitable remote 0day vulnerability in the Zoom client for Mac, which “ allow any malicious website to enable your camera without your permission” 😱 Though Zoom is incredibly popular it has a rather dismal security and privacy track record.

📝 Though the new issues we'll discuss today remain unpatched, they both are local security issues.Īs such, to be successfully exploited they required that malware or an attacker already have a foothold on a macOS system.