Zoom vulnerability reveals privacy issues for users

Zoom faced privacy concerns after the disclosure of a vulnerability that could allow threat actors to use the video conferencing software to spy on users.

The Zoom vulnerability, originally reported to only affect the Mac version of the software, has been found to partially affect Windows and Linux as well. Jonathan Leitschuh, software engineer at open source project Gradle, disclosed the Zoom vulnerability in a blog post earlier this week and said it "allows any website to forcibly join a user to a Zoom call, with their video camera activated, without the user's permission."

On top of this, this vulnerability would have allowed any webpage to DOS (Denial of Service) a Mac by repeatedly joining a user to an invalid call," Leitschuh added. "Additionally, if you've ever installed the Zoom client and then uninstalled it, you still have a localhost web server on your machine that will happily re-install the Zoom client for you, without requiring any user interaction on your behalf besides visiting a webpage."

According to Leitschuh, it took Zoom 10 days to confirm the vulnerability and in a meeting on June 11, he told Zoom there was a way to bypass the planned fix, but Zoom did not address these concerns when Zoom reported the vulnerability fixed close to two weeks later. The Zoom vulnerability resurfaced on July 7, Leitschuh disclosed on July 8 and Zoom patched the Mac client on July 9. Zoom also worked with Apple on a silent background update for Mac users, released July 10, which removed the Zoom localhost from systems.

"Ultimately, Zoom failed at quickly confirming that the reported vulnerability actually existed and they failed at having a fix to the issue delivered to customers in a timely manner," Leitschuh wrote. "An organization of this profile and with such a large user base should have been more proactive in protecting their users from attack." 

Zoom -- whose video conferencing software is used by more than 4 million users in approximately 750,000 companies around the world -- downplayed the severity of the issue and refuted Leitschuh's characterization of the company.

This trust tradeoff, between making it easy and making it secure, is something that every consumer should consider.

"Once the issue was brought to our Security team's attention, we responded within ten minutes, gathering additional details, and proceeded to perform a risk assessment," Richard Farley, CISO at Zoom, wrote in the company's response. "Our determination was that both the DOS issue and meeting join with camera on concern were both low risk because, in the case of DOS, no user information was at risk, and in the case of meeting join, users have the ability to choose their camera settings."

"To be clear, the host or any other participant cannot override a user's video and audio settings to, for example, turn their camera on," Farley added. 

Both the disclosure and response from Zoom portrayed the issue as only affecting the Mac client, but Alex Willmer, Python developer for CGI, wrote on Twitter that the Zoom vulnerability affected Windows and Linux as well.

"In particular, if zoommtg:// is registered as a protocol handler with Firefox then [Zoom] joins me to the call without any clicks," Willmer tweeted. "To be clear, a colleague and I saw the auto-join/auto-webcam/auto-microphone behavior with Firefox, and Chromium/Chrome; on Linux, and Windows. We did not find any webserver on port 19421 on Linux. We didn't check Windows for the webserver."

Leitschuh confirmed Willmer's discovery, but it is unclear if Zoom is working to fix these platform clients. Leitschuh also noted in his disclosure that the issue affects a whitehite label version of Zoom licensed to VoIP provider RingCentral. It is unclear if RingCentral has been patched.

Leitschuh told SearchSecurity via Twitter DM that "Zoom believes the Windows/Linux vulnerabilities are the browser vendors' to fix," but he disagrees.

Zoom did not respond to requests for comment at the time of this post.

Tom Patterson, chief trust officer at Unisys, said the tradeoff between security and ease of use is "not always a fair trade."

"The fact that uninstalling any app doesn't completely uninstall all components runs counter to engendering trust. In this case, it's an architectural decision made by the manufacturers which appears to be designed to make operations much easier for users," Patterson told SearchSecurity. "This trust tradeoff, between making it easy and making it secure, is something that every consumer should consider."