LILY HAY NEWMAN, SECURITY 07.09.19, 11:18 AM
A ZOOM FLAW
GIVES HACKERS EASY ACCESS TO YOUR WEBCAM
ZOOM HAS GAINED devotees—and a post-IPO boom—thanks to its dead-simple video conferencing tech. Joining a call is particularly easy; with the click of a meeting URL, the page automatically launches the desktop app, and you're in. But as security researcher Jonathan Leitschuh discovered, that seamlessness comes with a striking set of vulnerabilities for Zoom users on Apple computers—including one that could let an attacker hijack your webcam.
On Monday, Leitschuh publicly disclosed details of how an attacker could set up a malicious call, trick users into clicking a link to join it, and instantly add their video feed, letting them look into a victim's room, office, or wherever their webcam is pointing. In addition, Leitschuh found that attackers could also launch a denial of service attack against Macs by using the same mechanism to overwhelm them with join requests.
Zoom patched this DoS issue in a May update but for now is only adjusting its auto-join video settings, giving users a more prominent way of choosing whether their video feed automatically launches when they click a Zoom call link. Leitschuh says the new fix is not enough to address user privacy concerns or the underlying insecurity of the flow that allows Zoom to launch calls from meeting URLs so smoothly.
LILY HAY NEWMAN COVERS INFORMATION SECURITY, DIGITAL PRIVACY, AND HACKING FOR WIRED.
“Without the user giving any explicit consent nor taking any explicit action, they would be instantly dropped into a Zoom meeting,” Leitschuh says of a malicious Zoom call attack. "By default, Zoom shows video but doesn't send audio, though both settings are changeable. So depending on their video and audio settings, victims would potentially be immediately broadcasting themselves, perhaps even without their knowledge if they're not looking at their screen."
To demonstrate the severity of the vulnerability, Leitschuh published some proof-of-concept attack links; click on them and you'll automatically join a call. Since Zoom hasn't issued the update meant to address this yet, the demo still very much works.
ZOOM HAS GAINED devotees—and a post-IPO boom—thanks to its dead-simple video conferencing tech. Joining a call is particularly easy; with the click of a meeting URL, the page automatically launches the desktop app, and you're in. But as security researcher Jonathan Leitschuh discovered, that seamlessness comes with a striking set of vulnerabilities for Zoom users on Apple computers—including one that could let an attacker hijack your webcam.
On Monday, Leitschuh publicly disclosed details of how an attacker could set up a malicious call, trick users into clicking a link to join it, and instantly add their video feed, letting them look into a victim's room, office, or wherever their webcam is pointing. In addition, Leitschuh found that attackers could also launch a denial of service attack against Macs by using the same mechanism to overwhelm them with join requests.
Zoom patched this DoS issue in a May update but for now is only adjusting its auto-join video settings, giving users a more prominent way of choosing whether their video feed automatically launches when they click a Zoom call link. Leitschuh says the new fix is not enough to address user privacy concerns or the underlying insecurity of the flow that allows Zoom to launch calls from meeting URLs so smoothly.
LILY HAY NEWMAN COVERS INFORMATION SECURITY, DIGITAL PRIVACY, AND HACKING FOR WIRED.
“Without the user giving any explicit consent nor taking any explicit action, they would be instantly dropped into a Zoom meeting,” Leitschuh says of a malicious Zoom call attack. "By default, Zoom shows video but doesn't send audio, though both settings are changeable. So depending on their video and audio settings, victims would potentially be immediately broadcasting themselves, perhaps even without their knowledge if they're not looking at their screen."
To demonstrate the severity of the vulnerability, Leitschuh published some proof-of-concept attack links; click on them and you'll automatically join a call. Since Zoom hasn't issued the update meant to address this yet, the demo still very much works.
The vulnerability stems from a conscious choice on Zoom's part. To reduce friction from the video chat experience, Zoom sets up a local web server on every user’s Mac that allows call URLs to automatically launch the desktop app. Zoom says that this setup is in place as a “workaround” to a feature of Safari 12 that would require users to approve Zoom launching every time they click a call link. And though the workaround is there to deal with a Safari feature, the same setup applies no matter which browser you launch a Zoom link from. Zoom doesn't offer quite such a frictionless experience on Windows, but there's a box you can check to permanently dismiss the prompts and start video automatically, which would put you in a similar situation.
“The local web server enables users to avoid this extra
click before joining every meeting. We feel that this is a legitimate solution
to a poor user-experience problem,” Zoom said in a statement late Monday
night. “We are not alone among video conferencing providers in implementing
this solution.”
"This is a very disturbing set of bugs, but unsurprising given other
Zoom issues."
THOMAS REED, MALWAREBYTES
The Safari feature does add an extra
step for users. But by circumventing that step, Zoom potentially exposes its
users to strangers ogling them online—which demonstrates the need for that
extra layer of permission in the first place. Additionally, Leitschuh points
out that Zoom’s local web server persists on your Mac even if you uninstall the
Zoom desktop app. If you ever click a Zoom call link again, the program can
quickly download and reinstall itself automatically through the web server.
“Having an installed app that is
running a web server on my local machine with a totally undocumented API feels
incredibly sketchy to me,” Leitschuh wrote in his report, noting that he combed
the web for details about Zoom’s application programming interface for this
feature and couldn’t find anything. “The fact that any website that I visit can
interact with this web server running on my machine is a huge red flag for me.”
Zoom has added a cryptographic signing
mechanism for requests made to the local web servers, which is an
authentication improvement, but Leitschuh has already proposed a way that an
attacker could bypass the protection.
"This is a very disturbing set of
bugs, but unsurprising given other Zoom issues I’ve observed and reported in
the past. The local web server is honestly the most concerning part, and it's
not fixed," says Thomas Reed, a Mac research specialist at the security
firm Malwarebytes. "The web server is concerning because of the
possibility that someone could find a way to use it remotely to trigger remote
code execution."
As Leitschuh points out, researchers at the security
exposure assessment firm Tenable recently discovered such
a remote code-execution bug in Zoom that could have been combined with these
new findings to attack not just Zoom but a user's broader Mac system. Zoom has
patched the Tenable vulnerability.
"This Zoom vulnerability is
especially concerning and downright creepy because it doesn't require a user to
be on a Zoom call," says Tenable's David Wells. "The Zoom flaw I
found last year would allow an attacker to invoke keystrokes on remote
machines, even without being a meeting attendee. Combining both vulnerabilities
in a targeted attack would be extremely dangerous."
And Zoom won't fully issue a patch here. Instead, to
address the auto-join-video-feeds feature, Zoom is adding a tweak in an
upcoming update that will use the setting people choose in their first-ever
Zoom call as the default for future calls. If you decide in your first call
that you want to manually add video each time, that will be the default for
every call thereafter. In the current version of Zoom, you can add similar
protection for yourself by going to Settings/Preferences > Video > Meetings
> Turn off my video when joining a meeting.
Leitschuh told Zoom on March 26 that
the company had 90 days—a standard deadline in information security—to fix the
issues. He declined to join Zoom’s private bug-bounty program because of its
nondisclosure-agreement requirements. Zoom now says it is going to launch a
public bug bounty in the next few weeks. “We acknowledge that our website
currently doesn’t provide clear information for reporting security concerns,”
the company says.
For now, make sure your Zoom is up to
date, and change your video settings to block auto-joining. The situation is an
important reminder, though, that given the choice between protecting security
and privacy or prioritizing convenience, Zoom unabashedly chose convenience.
And will continue to do so.
Updated
July 9, 2019, 12:10pm ET to include details about Zoom on Windows and comment
from Tenable.
Link originale: https://www.wired.com/story/zoom-bug-webcam-hackers/
Nessun commento:
Posta un commento