Select Page

An exploration of zero-click attack surface for the popular video conferencing solution Zoom has yielded two previously undisclosed security vulnerabilities that could have been exploited to crash the service, execute malicious code, and even leak arbitrary areas of its memory.

Natalie Silvanovich of Google Project Zero, who discovered and reported the two flaws last year, said the issues impacted both Zoom clients and Multimedia Router (MMR) servers, which transmit audio and video content between clients in on-premise deployments.

The weaknesses have since been addressed by Zoom as part of updates shipped on November 24, 2021.

The goal of a zero-click attack is to stealthily gain control over the victim’s device without requiring any kind of interaction from the user, such as clicking on a link.

While the specifics of the exploit will vary depending on the nature of vulnerability being exploited, a key trait of zero-click hacks is their ability not to leave behind traces of malicious activity, making them very difficult to detect.

images from Hacker News