Hackers Could Take Over Your Mac via Zoom
Zoom has just patched a macOS bug that allowed hackers to take control of a given device’s operating system through the platform, according to a security researcher.
However, users who have not updated their software could still be at risk of having their macs infiltrated.
Since the pandemic, companies across the globe have turned to Zoom to facilitate collaboration in remote working environments, with its 300 million-strong active user base an appealing target for hackers.
macOS users with the Zoom client installed have been advised by the company to update their systems as soon as possible.
Security Issues Escalate Quickly
The flaw in Zoom’s system, tracked as CVE-2022-28756, theoretically allows a hacker to gain control of a computer’s entire operating system, post-exploit.
The issue was discovered by Patrick Wardle of the Objective-See Foundation, a non-profit that creates security tools for devices running macOS. He revealed the existence of the bug to the public at the Def Con hacking conference in Las Vegas last Friday.
The vulnerability stems from the installer for Zoom, which requires users to grant the application an all-access pass for updates, in order to run on a Mac.
The installer asks a user to input their password, when the application is added to a given system. However, after this, it sets the app up to run auto-updates in the background and grants Zoom “superuser” privileges. A superuser is a “root account” on a mac that has access to do whatever it wants to the system.
When an update is rolled out by Zoom, the program checks if the new software has been “signed” cryptographically by the company – but an issue with the updater function’s checking rules has meant that any file with Zoom’s signing certificate as its name will be green-lighted for installation.
According to Wardle, a hacker could easily deceive the Zoom application via the use of that signing certificate and orchestrate a “privilege escalation attack”, whereby a hacker uses a lower-level account to subsequently gain access to an account with system-level privileges.
Zoom’s Sluggish Response
On the surface, you may think a hacking conference is an odd place to first disclose such…
