Comprehensive software reviews to make better IT decisions
Zoom Quickly Addresses Zero-Day Vulnerabilities, But Now Is Not the Time to Rest
Amid the surge in cloud-based videoconferencing usage during the COVD-19 pandemic quarantine period, videoconferencing service provider Zoom has moved quickly to address zero-day vulnerabilities reported in its client software. That said, there is still work for it to do.
A flaw in the Zoom installer introduced a 鈥淯NC path injection鈥� vulnerability in Zoom鈥檚 client software. This vulnerability can potentially allow malicious actors to steal the Windows login credentials of their victims and execute arbitrary commands on vulnerable systems.
Another zero-day vulnerability addressed by the patch deals with how Zoom interacts with the camera and microphone on Apple Mac platforms. The exploit of this vulnerability allows a malicious actor to gain access to the user鈥檚 microphone and camera.
(Source: , April 2020)
Tom鈥檚 Guide reported nine flaws/defects in Zoom, many of which have been addressed as of this writing. While Zoom鈥檚 diligent moves to correct these issues are notable, Tom鈥檚 Guide鈥檚 reporting serves as a testament to the numerous security concerns that plague the suddenly popular videoconferencing service.
(Source: , April 2020)
Our Take
The patches released by Zoom address issues on the client software that is distributed and installed on user workstations. Therefore, IT departments are strongly encouraged to roll out the patches as soon as possible and ensure that all users immediately comply with the direction to upgrade their software.
With the immense increase in Zoom鈥檚 popularity during this pandemic quarantine period, it is commendable that Zoom is responding quickly to discovered vulnerabilities. That said, it is apparent that Zoom was unprepared for the sudden and massive increases in both the number of subscribers and usage volume. At this critical point in time, Zoom needs to first focus its attention in addressing vulnerabilities uncovered in its product, then sustain its response roadmap to stay ahead of emerging weaknesses over time. The growth in popularity makes the service an attractive prospect for hackers 鈥� especially in the publicized and often sensitive ways that Zoom has been used (such as the recent .)
To this end, to prioritize its focus on addressing security issues with its product.
Stay tuned to 91制片厂鈥檚 Tech Briefs, as we will report on additional developments as they transpire.