Severe Zoom Vulnerabilities Allow Malicious Meeting Participants to Take Over Your Device

Researchers identified critical vulnerabilities in Zoom that allows a full device takeover with no user interaction, and present on all devices.

The work was made possible due to the help of AI, something that's becoming more and more common in security research as AI tools massively accelerate the rate at which bugs are found.

Ⓐ Security describes the bug as a "nation-state" level exploit and a "weapon" the likes of which governments would normally have to pay millions for. The researchers discovered it in a single work day using less than 20 prompts on publicly available AI models.

Appropriately dubbed "Zoomsday," the exploit is a memory-corruption bug (go figure) in Zoom's annotation feature, a completely proprietary and undocumented protocol. The zoom client automatically parses anything it receives, allowing an attacker to use the vulnerability without any interaction from the victims.

The annotation feature doesn't send an image to overlay on the call, it sends instructions on how to draw the onscreen lines, shapes, text, etc in order in a continuous stream of data.

The receiver trusts the data stream from the sender to tell it how much more to read.

The attacker can target each person individually because of how the annotation streams are set up.

The bundle that the annotation feature ships on doesn't use Pointer Authentication Codes or any other feature that would mitigate a memory corruption bug.

With no PAC to authenticate anything, we don't need a complex exploit. We can just point the return address (X30/LR) at one ready-made instruction sequence (a "gadget") in the system's shared library cache, and let the epilogue pre-load the argument registers for us.

The researchers reported the exploit to Zoom on June 10, with Zoom getting a fix out in just twelve days. If you haven't updated Zoom in a while, make sure you're on the latest version.

It's a good thing Zoom were so responsive as Zoom is used in so many places from doctors' offices to enterprises that an unpatched exploit like this would put a lot of people's data at risk.

The researchers have a bit of an ominous warning though:

Beyond this vulnerability, prepare for the next one, because there will be a next one and not necessarily in Zoom. Every endpoint runs software that parses bytes chosen by outsiders, and you cannot audit any of it.

With the rise of AI tools for finding exploits, we've seen a huge jump in vulnerabilities, some almost two decades old, and sometimes hundreds of vulnerabilities being patched at once to keep up with the onslaught of AI bug reports.