Wardle obviously describes this in technical terms over on the Objective-See blog, and if you’re interested in seeing how he breaks it down go check it out. This is possible, and I’ll try to put this as simply as possible, because one of the bugs allows the attacker to alter or replace the “runwithroot” script during an installation –or potentially an upgrade– that allows them to gain root access. Almost immediately I uncovered several issues, including a vulnerability that leads to a trivial and reliable local privilege escalation (to root!). These can not only allow an attacker to gain control of the Mac’s microphone and/or webcam, but also make it possible for that individual to gain root access to macOS as well.Īs such, today when Felix Seele also noted that the Zoom installer may invoke the AuthorizationExecuteWithPrivileges API to perform various privileged installation tasks, I decided to take a closer look. Wardle details several of Zoom’s security flaws that have been discovered recently (dating back to last year’s debacle), and then goes into detail about the latest bugs. Roundup: The best work from home communication apps for remote teams The discovery was made by Jamf researcher and ex-NSA hacker Patrick Wardle, as first reported by TechCrunch. And now a security researcher has discovered a brand new zero-day vulnerability for the software running on Macs, all tied to a pair of bugs that can allow attackers to take over the machine - including the webcam and microphone.
But with so many people now using Zoom there is an even greater focus on some of the issues present with the software, like the fact that, despite claims, the video calls are not end-to-end encrypted.
Zoom is having a moment, thanks to the fact that many, many people around the world are being forced to work from home (when they can) due to the global coronavirus pandemic.Īll of that remote work means a lot of video conference calls, which has seen a gigantic spike in users for the service.
0 kommentar(er)
