Zoom Can Expose You To Cyber Attacks

The video-conference platform Zoom has disclosed four new software problems and vulnerabilities that expose users to cyber attacks.

Cyber security researchers found that the vulnerabilities can be used to compromise users over the platform’s chat function. This is possible if criminal hackers send a specially crafted XMPP (Extensible Messaging and Presence Protocol) message and executing malicious code.

If the specific message is sent, an attacker could trigger clients into connecting to a man-in-the-middle server that presented a version of the Zoom client from 2019. Google Project Zero security researcher Ivan Fratric, who uncovered the problems, has said, “User interaction is not required for a successful attack. The only ability an attacker needs is to be able to send messages to the victim over Zoom chat over XMPP protocol.”

XMPP is the standard upon which Zoom’s chat feature is built. A cyber-attacker can pose as a regular user through exploitation of the afore-mentioned vulnerabilities. In turn, the individual can connect to a suspicious server and download an update, resulting in arbitrary code execution stemming from a downgrade attack.

Zoom, the video-conferencing platform that has become a staple for connection and communication since the onset of COVID-19 and now Zoom has acknowledged that the security vulnerabilities, ranging from 5.9 to 8.1 in severity, can be exploited to compromise chat users.

The vulnerabilities could be exploited to compromise users over chat by sending specially crafted  XMPP messages and executing malicious code.

In the Report, Fratric writes: “Initial vulnerability (labeled XMPP Stanza Smuggling) abuses parsing inconsistencies between XML parsers on Zoom's client and server in order to be able to ‘smuggle’ arbitrary XMPP stanzas to the victim client. “From there, by sending a specially crafted control stanza, the attacker can force the victim client to connect to a malicious server, thus turning this primitive into a man-in-the-middle attack.”

The issue at the core of these vulnerabilities is the ability of a cyber attacker to find inconsistencies between XML parsers in the software’s client and server.

When this happens, XMPP stanzas can be sent to the victim of the attack. This allows hackers to take advantage of software updates, weaponizing the process and delivering an outdated, less secure version of Zoom to prospective targets through a malicious server.

David Mahdi CISO advisor at Sectigo, commented on these forms of social hacks and offers advice on how to avoid becoming a victim: “As a form of social engineering, attacks like this can be incredibly hard to prevent, with attackers using incredibly savvy methods to trick users into doing 'the wrong thing', such as clicking a bad link that will download malware... Attackers are now deploying a growing variety of tactics, such as supply chain attacks and social engineering, to target organizational issues inherent with hybrid work, human error, and shadow IT.
“Multi-factor authentication (MFA), when correctly deployed, can mitigate cyber-criminal attacks from using stolen credentials to access devices or networks in the case of a phishing attack.” according to Mahdi. 

Zoom:     TEISS:      Infosecurity Magazine:    IT Governance:    Wired:  Google:     Chromium:  

You Might Also Read: 

Microsoft Eliminates Cyber Attack Flaws: