Wednesday, June 19, 2024

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical vulnerability that threat actors could potentially exploit for various malicious purposes.

This vulnerability was reported as part of the H1-4420 Hacking event conducted in June 2023.

This vulnerability existed in Zoom rooms, a system developed by Zoom to allow team members from different locations to work together over Zoom.

A threat actor could potentially exploit this vulnerability and gain access to the victim organization’s tenant.

Document
Protect Your Storage With SafeGuard

Is Your Storage & Backup Systems Fully Protected? – Watch 40-second Tour of SafeGuard

StorageGuard scans, detects, and fixes security misconfigurations and vulnerabilities across hundreds of storage and backup devices.

Vulnerability Analysis

For setting up Zoom rooms, the Zoom Rooms application is installed on a device such as an iPad, mobile, etc which acts as a terminal for people in the Zoom room.

Whenever a Zoom room is created within the Zoom platform, a service account is created with licenses for meetings and Whiteboards.

This service account is assigned an email address by Zoom, which has the format rooms_<account ID>@companydomain.com. In certain cases, organizations prefer to use the Outlook domain for their email accounts instead of their company domain.

As Outlook is public and anyone can create an email address, the service account email address can be created and claimed by a threat actor.

This provides complete access to the threat actor over the service account which can be utilized to gather information laterally across the tenant.

In addition to this, a service account has at least two licenses and is also treated as a normal team member. This provides considerable access to the threat actor, like contacts, or hijack the meeting itself. 

Zoom Chat Channel

Zoom provides a new feature called “Channels,” which is a system of text channels that are open by default to tenant employees.

Since the threat actor has access to the service account, he has access to view the contents of any channel which also includes confidential information and has complete invisibility.

Moreover, room users cannot be removed from the channel by any administrator or even the owner. A complete detailed report has been published, which provides additional information about this vulnerability.

Experience how StorageGuard eliminates the security blind spots in your storage systems by trying a 14-day free trial.

Website

Latest articles

Amtrak Data Breach: Hackers Accessed User’s Email Address

Amtrak notified its customers regarding a significant security breach involving its Amtrak Guest Rewards...

Chrome Security Update – Patch for 6 Vulnerabilities

Google has announced a new update for the Chrome browser, rolling out version 126.0.6478.114/115...

Hackers Weaponize Windows Installer (MSI) Files to Deliver Malware

Cybersecurity researchers have uncovered a sophisticated malware campaign orchestrated by a threat actor group,...

Hackers Using VPNs To Exploit Restrictions & Steal Mobile Data

Hackers are offering "free" mobile data access on Telegram channels by exploiting loopholes in...

New PhaaS Platform Lets Attackers Bypass Two-Factor Authentication

Several phishing campaign kits have been used widely by threat actors in the past....

Stuxnet, The Malware That Propagates To Air-Gapped Networks

Stuxnet, a complex worm discovered in 2010, targeted Supervisory Control and Data Acquisition (SCADA)...

Threat Actors Claiming Breach of AMD Source Code on Hacking Forums

A threat actor named " IntelBroker " claims to have breached AMD in June...
Eswar
Eswar
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles