Zoom security issues leave vendor scrambling

Zoom was caught flatfooted this week by the reaction to a security researcher's report on the vulnerabilities of a web server it had quietly installed on Apple computers. The debacle raised broader questions on whether unified communications vendors were too quick to sacrifice privacy and security for ease of use.

The Zoom security issue stemmed from the use of the web server as a workaround for a privacy feature on version 12 of the Safari web browser, which Apple released for the Mac last fall. The feature forced users to consent to open Zoom's video app every time they tried to join a meeting. In contrast, browsers like Chrome and Firefox let users check a box telling them to automatically trust Zoom's app in the future.

Zoom felt the extra click in Safari would undermine its frictionless experience for joining meetings, so it installed the web server on Mac computers to launch a meeting immediately.

That left Mac users vulnerable to being instantly joined to a Zoom meeting by clicking on a spam link or loading a malicious website or pop-up advertisement. A similar risk still exists for all Mac and PC users who choose to have their web browsers automatically launch Zoom.

Another issue with the Mac web server was that it would remain in place even after users deleted the Zoom app, and would automatically reinstall Zoom upon receiving a request to join a meeting, according to the security researcher. It also created an avenue for denial-of-service attacks, a risk that Zoom released an optional patch for in May.

In a broader sense, the permanent installation of a web server on local devices troubled independent researcher Jonathan Leitschuh, who sparked this week's events with a blog post Monday.

"First off, let me start off by saying having an installed app that is running a web server on my local machine with a totally undocumented API feels incredibly sketchy to me," Leitschuh wrote in his public disclosure. "Secondly, the fact that any website that I visit can interact with this web server running on my machine is a huge red flag for me as a security researcher."

Leitschuh's disclosure forced Zoom to issue multiple statements as user outrage grew. The security threat received widespread international news coverage, with many headlines containing the chilling combination of "hacker" and "webcam." In an interview Wednesday, Zoom's chief information security officer, Richard Farley, said the news coverage caused "maybe some panic that was unnecessary."

"Part of the challenge for us, of course, is controlling that message out there that this was not as big a deal as it's been made out to be," Farley said. "There's a lot of misinformation that went out there. ... People just didn't understand it."

Zoom initially tried to assuage fears about the Mac web server without removing it. The company pointed out that it would be obvious to users they had just joined a meeting because a window would open in the foreground and their webcam's indicator light would flash on. Also, a hacker couldn't gain access to a webcam in secret or retain access to that video feed after users exited a meeting.  

Ultimately, Zoom reversed its original position and released a software update Tuesday that removed the web server from its Mac architecture. The next day, Apple pushed out a software patch that wiped the web server from all Mac devices, even for users who had previously deleted Zoom.

"We misjudged the situation and did not respond quickly enough -- and that's on us," Zoom CEO Eric Yuan wrote in a blog post. "We take full ownership, and we've learned a great deal."

Zoom's default preferences added fuel to the fire. Unless users go out of their way to alter Zoom's out-of-the-box settings, their webcams will be on by default when joining meetings. Also, Zoom does not by default have a pre-meeting lobby in which users confirm their audio and video settings before connecting.

Zoom said it would release an update over the July 13 weekend to make it easier for new users to control video settings. The first time a user joins a meeting, they will be able to instruct the app to join them to all future sessions with their webcams turned off.

Zoom has also taken heat for allowing embedded IFrame codes to launch Zoom meetings. In a statement, the company said IFrames -- a method for adding HTML content to webpages -- was necessary to support its integrations.

Leitschuh first raised the security issues with Zoom in March. The company invited him to its private bug bounty program, offering money in exchange for Leitschuh agreeing not to disclose his research publicly. Leitschuh, who said the proposed bounty was less than $1,000, declined because of the demand for secrecy.

Despite clashing over whether to remove the web server, Leitschuh and Zoom were able to agree on the severity of the risk it posed. They gave it a Common Vulnerability Scoring System rating of 5.4 out of 10. That score is in the "medium" range -- riskier than "low" but not as severe as "high" or "critical."

Zoom's response to Leitschuh's concerns was an indicator that companies have to verify the security architectures of UC vendors, analysts said.

"This event should be a clear reminder to both vendors and customers using UC and collaboration tools that there are very real threats to their platforms," said Michael Brandenburg, analyst at Frost & Sullivan. "We are long past the days of only having to worry about toll fraud, and businesses have to be as mindful of the security risks on their UC platforms as they are with any other business application."