Friday, April 18, 2025
HomeCVE/vulnerabilityHacking Zoom - Researchers Discovered Multiple Security Vulnerabilities in Zoom

Hacking Zoom – Researchers Discovered Multiple Security Vulnerabilities in Zoom

Published on

SIEM as a Service

Follow Us on Google News

Zoom is the popular video conferencing app that grew rapidly and it has more than 200M by the mid-2020. The popularity of the app made it a prime target for hackers.

Security researcher Mazin Ahmed, who presented his findings at DEFCON 2020 and disclosed the vulnerabilities to Zoom. All the vulnerabilities fixed with version 5.2.4.

Vulnerabilities Disclosed

Ahmed discovered the vulnerability with Zoom Launcher for Linux that could allow an attacker to run any unauthorized software in the way it launches the “zoom” executable.

- Advertisement - Google News

He used a vulnerability intelligence platform FullHunt.io to query the domains associated with Zoom. Here is the list of vulnerabilities;

  • Zoom Exposed Public Kerberos Authentication Server
  • Memory Leak on Zoom Production Server
  • Unexploitable RCE on Zoom Production Server
  • Shadow IT Issues on accessible Zoom servers

Flaws With Zoom App for Linux:

  • Bad Design Practise on TLS/SSL implementation
  • A Really Bad Design Practice on Zoom Launcher Implementation.
  • End-to-End encrypted messages between Zoom users are stored on-disk in plain-text.
  • Zoom Local Database accessible by all local users, including private end-to-end encrypted messages (stored in plain-text), and access tokens.

During the analysis, he observed a Kerberos service has been exposed by Zoom that provides a wider attack surface to enumerate the Login Credentials.

Another vulnerability is with the image conversion on Zoom which converts the GIF to PNG, for image conversion Zoom uses ImageMagick version that has a memory leak vulnerability. The memory leak vulnerability occurs because of the uninitialization of the memory space on the GIF parser of ImageMagick.

He also published a POC video, exploiting the leak;

Ahmed found that “Zoom TLS/SSL is Broken By Design on Linux, here wrote a PoC that injects TLS/SSL certificate fingerprints into the local Zoom database. Once this code is executed on a user machine, all injected certificates will be accepted without errors on Zoom.”

He also added that Zoom is not fully End-to-End Encrypted.

Zoom released an update on August 3rd, 2020, in the update with the Zoom version 5.2.4 all the security vulnerabilities has been fixed.

Other Zoom Flaws

A New Zoom URL Flaw Let Hackers Mimic Organization’s Invitation Link

Zoom 0day Vulnerability Let Remote Attacker to Execute Arbitrary Code on Victim’s Computer

New Zoom Flaw Let Attackers to Hack into the Systems of Participants via Chat Messages

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity, and hacking news updates.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

How To Detect Obfuscated Malware That Evades Static Analysis Tools

Obfuscated malware presents one of the most challenging threats in cybersecurity today. As static...

How Security Analysts Detect and Prevent DNS Tunneling Attack In Enterprise Networks

DNS tunneling represents one of the most sophisticated attack vectors targeting enterprise networks today,...

How to Conduct a Cloud Security Assessment

Cloud adoption has transformed organizations' operations but introduces complex security challenges that demand proactive...

U.S DOGE Allegedly Breached – Whistleblower Leaked Most Sensitive Documents

A federal whistleblower has accused the Department of Government Efficiency (DOGE) of orchestrating a...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Critical AnythingLLM Vulnerability Exposes Systems to Remote Code Execution

A critical security flaw (CVE-2024-13059) in the open-source AI framework AnythingLLM has raised alarms across cybersecurity...

PoC Released for Linux Kernel Vulnerability Allowing Privilege Escalation

A security vulnerability, tracked as CVE-2024-53141, has recently come to light in the Linux kernel's...

Bubble.io 0-Day Flaw Lets Attackers Run Arbitrary Queries on Elasticsearch

A vulnerability in Bubble.io, a leading no-code development platform, has exposed thousands of applications...