Zoom fixes security flaws in Macs that could have allowed hackers to take control of victims’ machines

Zoom has fixed vulnerabilities that could have allowed hackers to take advantage of the vulnerability and gain full control of the victim’s machine. The issues were found and reported to Zoom in December 2021 but were shared at the DefCon security conference by Mac security researcher Patrick Wardle in Las Vegas last week. He said he highlighted two issues in the video communication platform’s automatic update last year, which were fixed. However, the fix also brings another security hole that Wardle shared on stage at the conference. Zoom has also addressed the third vulnerability.

According to many reports of The Verge and WiredThe first vulnerability was found by Wardle, a security researcher and founder of the Objective-See Foundation, which makes open-source macOS security tools, located in Launch installer. The second is in a tool that helps validate the cryptographic signatures needed to install updates. Zoom yes patch holes and the patched version is now Available for download.

But how did the vulnerability reveal itself to the user? The Zoom installer requires users to enter their login credentials or cryptographic signatures as special permissions to remove or install apps. Once done, the Zoom app will automatically download and install the security patches by checking the signature. The first vulnerability could have allowed an attacker to replace the signature providing privileges, allowing the installer to install a malicious update and exploit it.

The second vulnerability was found in a tool that facilitates cryptographic signature verification. When the Zoom app is installed on a Mac, the system takes the help of the standard macOS helper to confirm the signature and check if the update being distributed is fresh – basically. Restricted version hackers install the old, flawed version. Wardle found that a vulnerability could allow an attacker to trick the tool into accepting an old vulnerable version and take full control of the victim’s machine.

There is also a third vulnerability that Wardle found and discussed on stage last week. He said that after patching the first two vulnerabilities, where Zoom now securely checks its signatures and has a chance of a downgrade attack, there is still a third chance for hackers to exploit the vulnerability. He noticed that it took a while after verifying the signature and before the package was installed on the system when attackers were able to inject their own malware into the Zoom update.

This malware can withhold all the privileges and checks required to install the update. An attacker can force users of the Zoom app to reinstall the update to give them more of a chance to insert a malicious patch and gain root access to the victim’s device – just like Wardle did. However, the security researcher says that to exploit any of these vulnerabilities, a hacker should have some access to the victim’s machine. Furthermore, Zoom has also installed a third vulnerability.