Zoom installer flaw can give attackers root access to your Mac

guest · Aug 14, 2022

August 12, 2022

A security researcher has discovered a flaw in Zoom on macOS that could allow attackers to gain root access and control the entire operating system — and the issue has yet to be fully fixed.

Patrick Wardle, a veteran security researcher who formerly worked for the NSA, shared his findings in a presentation at the Defcon conference in Las Vegas on Friday, according to The Verge.
Click to expand...

The attack works by leveraging the Zoom for macOS installer, which requires special user permissions to be able to install or uninstall Zoom from a Mac. More specifically, Wardle discovered that the installer has an auto-update function that continues to run in the background with elevated privileges.

However, a flaw in the cryptographic verification method meant that an attacker could trick the updater into thinking a malicious file was signed by Zoom.
Click to expand...

As a privilege escalation attack, the flaw could allow attackers to gain "root" or "superuser" privileges on a Mac. In theory, that could allow them to add, remove, or modify any file on the machine.

Although Zoom issued an initial patch a few weeks before the event, Wardle said that the update contained another bug that could have allowed attackers to continue exploiting the flaw.
A few months before the Defcon conference in August, Wardle says that Zoom issued another patch that fixed the bugs he initially discovered. However, this latest patch still contains errors that could allow attackers to leverage the flaw.
Click to expand...

The Verge: The Zoom installer let a researcher hack his way to root access on macOS

Zoom has issued a patch, but the researcher says it’s incomplete
Click to expand...

guest · Aug 14, 2022

Zoom Updates Mac App With Important Security Fix
August 14, 2022

Zoom has released a new version of its macOS app with a fix for a security vulnerability affecting the app's automatic updates feature.

In an August 13 security bulletin, Zoom said version 5.7.3 to version 5.11.3 of its macOS app contain a vulnerability in the auto-update process that can be exploited by a local low-privileged user to gain root privileges to the operating system. The vulnerability has been patched in version 5.11.5 of the Zoom app for macOS, available now.
Click to expand...

The vulnerability was revealed by Mac security researcher Patrick Wardle at the hacking conference DEF CON in Las Vegas on Friday. The Verge and WIRED shared more details about Wardle's findings for those interested in learning more.
Click to expand...

Log in or Sign up

Zoom installer flaw can give attackers root access to your Mac

guest Guest

guest Guest

Log in or Sign up

Zoom installer flaw can give attackers root access to your Mac

guest Guest

guest Guest

Useful Searches