Zoom Fixes Bug That Let Call Participants Take Control of Other Devices
Zoom has fixed issues in its annotation system that allowed malicious meeting participants to run code on other attendees' devices without their consent.
Researchers at the AI-equipped cybersecurity research firm (A)Security discovered issues in the data shared by Zoom clients during screen sharing and annotation. Crucially, the bug did not allow random internet users to directly take over devices just by knowing a meeting link or a Zoom account; the attacker first needed to join the target meeting.
The researchers said an attacker could send annotation data to a participant's Zoom client, after which the client would process that data automatically, even if the recipient did not click an annotation, approve remote control, or open a file. These bugs could let an attacker run code with the same permissions as the Zoom app.
The team responsible for finding the flaws reported them to Zoom back in June. Zoom released fixes...
Copyright of this story solely belongs to extremetech.com. To see the full text click HERE
