Zoom Screen Sharing Attack
Lily Hay Newman (via Ben Lovejoy):
As AI models gain advanced capabilities to find vulnerabilities in software, develop ways to exploit them, and even carry out autonomous hacking sprees, researchers offered a sobering new example on Tuesday, disclosing vulnerabilities in the video conferencing platform Zoom that could have been exploited to take over targets’ devices. Anyone on a call that involved screen sharing, whether participants or the host, would have been vulnerable to a silent attack that could be carried out with no indication and no interaction from the victim.
Researchers from the digital defense firm A Security say the bug was discovered in early June using publicly available AI models, and that it took fewer than 20 prompts to uncover the vulnerabilities and create a working attack. Zoom issued a security advisory on Tuesday, including details about fixes the company has already begun rolling out to address the flaws, which affected devices running all operating systems that Zoom supports—Windows, macOS, Linux, iOS, and Android.
[…]
The vulnerabilities were specifically in the protocol used to facilitate real-time annotation during screen sharing.
I don’t understand how it could take over an iOS device when Zoom’s iOS screen sharing feature only allows observation, not control.
Previously:
4 Comments RSS · Twitter · Mastodon
> "I don’t understand how it could take over an iOS device when Zoom’s iOS screen sharing feature only allows observation, not control."
And that is exactly where many fear things are headed. Is it that you don't understand "this vulnerability" but LLMs can and be trained to exploit?
> I don’t understand how it could take over an iOS device
I don't think it does. The vulnerability is in the app, but I think it only lets an attacker use Zoom's existing capabilities.
> "I don’t understand how it could take over an iOS device"
It's a memory-safety issue resulting in remote code execution, so even if the Zoom code only allows observation, the attacker can inject their own code that allows them to control the Zoom process.
@Plume That seems most likely to me, but I would like to see more information about this.
@Nick But AFAIK there isn’t even an API to do remote control, so wouldn’t this only be possible in combination with some other major vulnerability?
