Zoom says the flaw was born out of a workaround for Safari 12.
Sarah Tew/CNET
Your computer's webcam has always been a gateway for potential security intrusion, which is why people like Mark Zuckerberg and ex-FBI head James Comey put tape over theirs. On Monday, security researcher Jonathan Leitschuh gave Mac users another reason to fret over their webcams — there's a security flaw in the Zoom video-conferencing app.
Zoom is most notable for its click-to-join feature, where clicking on a browser link takes you directly to a video meeting in Zoom's app. But Leitschuh in a Medium post explained that he months ago discovered Zoom achieves this in insecure ways, allowing websites to join you to a call as well as activating your webcam without your permission.
He adds that this would allow any webpage to denial-of-service a Mac by repeatedly joining you to an invalid call. Uninstalling the Zoom app from your Mac isn't enough to fix the problem, either. Zoom achieves its click-to-join function by installing a web server on your computer — which can reinstall Zoom without your permission.
"If you've ever installed the Zoom client and then uninstalled it, you still have a localhost web server on your machine that will happily re-install the Zoom client for you," Leitschuh writes, "without requiring any user interaction on your behalf besides visiting a webpage. This re-install 'feature' continues to work to this day."
Here's the first setting you should change in Zoom.
Jonathan Leitschuh/Medium
If you have the Zoom app installed on your Mac, Leitschuh lists directions to neutralize the local server in his Medium post. You should also activate the Turn off my video setting when joining a meeting, as seen above.
The researcher says he contacted Zoom on March 26, giving the company a public disclosure deadline of 90 days. He says Zoom patched the issue, disabling the ability of a webpage to automatically turn on your webcam, but still this partial fix regressed on July 7, allowing webcams to once again be turned on without permission.
Zoom in a statement said the local web server is a workaround for Apple's Safari 12 web browser introduced last September.
"Zoom installs a local web server on Mac devices running the Zoom client," the statement reads. "This is a workaround to an architecture change introduced in Safari 12 that requires a user to accept launching Zoom before every meeting. The local web server automatically accepts the peripheral access on behalf of the user to avoid this extra click before joining a meeting. We feel that this is a legitimate solution to a poor user experiRead More – Source
Zoom says the flaw was born out of a workaround for Safari 12.
Sarah Tew/CNET
Your computer's webcam has always been a gateway for potential security intrusion, which is why people like Mark Zuckerberg and ex-FBI head James Comey put tape over theirs. On Monday, security researcher Jonathan Leitschuh gave Mac users another reason to fret over their webcams — there's a security flaw in the Zoom video-conferencing app.
Zoom is most notable for its click-to-join feature, where clicking on a browser link takes you directly to a video meeting in Zoom's app. But Leitschuh in a Medium post explained that he months ago discovered Zoom achieves this in insecure ways, allowing websites to join you to a call as well as activating your webcam without your permission.
He adds that this would allow any webpage to denial-of-service a Mac by repeatedly joining you to an invalid call. Uninstalling the Zoom app from your Mac isn't enough to fix the problem, either. Zoom achieves its click-to-join function by installing a web server on your computer — which can reinstall Zoom without your permission.
"If you've ever installed the Zoom client and then uninstalled it, you still have a localhost web server on your machine that will happily re-install the Zoom client for you," Leitschuh writes, "without requiring any user interaction on your behalf besides visiting a webpage. This re-install 'feature' continues to work to this day."
Here's the first setting you should change in Zoom.
Jonathan Leitschuh/Medium
If you have the Zoom app installed on your Mac, Leitschuh lists directions to neutralize the local server in his Medium post. You should also activate the Turn off my video setting when joining a meeting, as seen above.
The researcher says he contacted Zoom on March 26, giving the company a public disclosure deadline of 90 days. He says Zoom patched the issue, disabling the ability of a webpage to automatically turn on your webcam, but still this partial fix regressed on July 7, allowing webcams to once again be turned on without permission.
Zoom in a statement said the local web server is a workaround for Apple's Safari 12 web browser introduced last September.
"Zoom installs a local web server on Mac devices running the Zoom client," the statement reads. "This is a workaround to an architecture change introduced in Safari 12 that requires a user to accept launching Zoom before every meeting. The local web server automatically accepts the peripheral access on behalf of the user to avoid this extra click before joining a meeting. We feel that this is a legitimate solution to a poor user experiRead More – Source
