Researchers have uncovered vulnerabilities in the Zoom video conferencing platform that potentially allowed anyone on a call to take control of another participant’s device. The security flaws were identified by A Security, a digital defense firm, and were discovered using publicly available AI tools, requiring fewer than 20 prompts to unearth a working exploit.
The vulnerabilities specifically resided in the protocol for real-time annotation during screen sharing. Any participant in a shared screen scenario, whether the host or regular attendees, was at risk of a silent attack. This kind of exploitation could occur without the victim’s knowledge or interaction.
A Security’s co-founder, Omer Gull, emphasized the implications of these vulnerabilities, suggesting that the barriers to finding such security flaws have been greatly lowered. He noted that what once required a dedicated team months of effort can now be achieved quickly by individuals utilizing AI tools. Gull highlighted Zoom’s prominence, stating that users typically trust the platform, making it a valuable target for attackers.
The researchers indicated that even established companies like Zoom, which presumably conduct thorough code reviews, may overlook vulnerabilities in complex, proprietary code. Zoom promptly responded to the findings by issuing a security advisory and has begun rolling out patches to rectify the issues across all operating systems it supports: Windows, macOS, Linux, iOS, and Android.
The implications of such a vulnerability are extensive, especially in scenarios involving corporate use. A Security co-founder Yossi Torati warned that an attacker could hijack a device simply by being on a call, potentially leading to broader access within an organization. This situation underscores the importance of vigilance among users in trusting video conferencing platforms, which are widely utilized for both personal and professional communication.
As AI continues to evolve, the arms race between security practitioners and attackers intensifies, evolving what was once a simple cat-and-mouse game into a high-stakes race.
