Many of us have been there: You fire up the Zoom app as you rush to join a meeting you’re already late for, and you’re hit with a prompt to download updates. If something like this has happened to you, you’re enrolled in Zoom's automatic update feature.
Launched in its current form in November 2021 for Zoom’s Windows and Mac desktop apps, the feature aims to help users keep up with software patches. You enter your system password when you initially set up the feature, granting Zoom permission to install patches, then you never have to enter it again. Easy. But after noticing the feature, longtime Mac security researcher Patrick Wardle wondered whether it was a little too easy.
At the DefCon security conference in Las Vegas today, Wardle presented two vulnerabilities he found in the automatic update feature’s validation checks for the updates. For an attacker who already had access to a target Mac, the vulnerabilities could have been chained and exploited to grant the attacker total control of a victim’s machine. Zoom has already released fixes for both vulnerabilities, but onstage on Friday, Wardle announced the discovery of an additional vulnerability, one he hasn’t yet disclosed to Zoom, that reopens the attack vector.
“I was curious about exactly how they were setting this up. And when I took a look, it seemed on first pass that they were doing things securely—they had the right ideas,” Wardle told WIRED ahead of his talk. “But when I looked closer, the quality of the code was more suspect, and it appeared that no one was auditing it deeply enough.”
To automatically install updates after the user enters their password once, Zoom installs a standard macOS helper tool that Wardle says is widely used in development. The company set up the mechanism so only the Zoom application could talk to the helper. This way, no one else could connect and mess with things. The feature was also set up to run a signature check to confirm the integrity of the updates being delivered, and it specifically checked that the software was a new version of Zoom, so hackers couldn’t launch a “downgrade attack” by tricking the app into installing an old and vulnerable version of Zoom.
The first vulnerability Wardle found, though, was in the cryptographic signature check. (It’s a sort of wax-seal check to confirm the integrity and provenance of software.) Wardle knew from past research and his own software development that it can be difficult to truly validate signatures in the types of conditions Zoom had set up. Ultimately, he realized that Zoom’s check could be defeated. Imagine that you carefully sign a legal document and then put the piece of paper facedown on a table next to a birthday card that you signed more casually for your sister. Zoom’s signature check was essentially looking at everything on the table and accepting the random birthday card signature instead of actually checking whether the signature was in the right place on the right document. In other words, Wardle found that he could change the name of the software he was trying to sneak through to contain the markers Zoom was broadly looking for and get the malicious package past Zoom’s signature check.
“All you do is name your package in a certain way, and then you can fully bypass their cryptographic checks,” Wardle says.
In the second vulnerability Wardle found that, while Zoom had created a check to confirm that an update being delivered was a new version, he could get around this if he offered software that had passed the signature check directly to a flaw in how the updater app received software to distribute. Wardle found that using a Zoom tool known as updater.app, which facilitates Zoom’s actual update distribution, he could trick the distributor into accepting an old, vulnerable version of Zoom instead, after which an attacker could exploit old flaws to get full control.
“We have already resolved these security issues,” a Zoom spokesperson told WIRED in a statement. “As always, we recommend users keep up to date with the latest version of Zoom … Zoom also offers automatic updates to help users stay on the latest version.”
During his talk at DefCon, though, Wardle announced another Mac vulnerability he discovered in the installer itself. Zoom now conducts its signature check securely, and the company plugged the downgrade attack opportunity. But Wardle noticed that there is a moment after the installer verifies the software package—but before the package installs it—when an attacker could inject their own malicious software into the Zoom update, retaining all the privileges and checks that the update already has. Under normal circumstances, an attacker would be able to grab this opportunity only when a user is installing a Zoom update anyway, but Wardle found a way to trick Zoom into reinstalling its own current version. The attacker can then have as many opportunities as they want to attempt to insert their malicious code and gain the Zoom automatic update installer’s root access to the victim device.
“The main reason I looked at this is that Zoom is running on my own computer,” Wardle says. “There’s always a potential tradeoff between usability and security, and it’s important for users to install updates for sure. But if it’s opening this broad attack surface that could be exploited, that’s less than ideal.”
To exploit any of these flaws, an attacker would need to already have an initial foothold in a target’s device, so you’re not in imminent danger of having your Zoom remotely attacked. But Wardle’s findings are an important reminder to keep updating—automatically or not.
Update Monday, August 15, 2022, at 2:10 pm ET: The day after Wardle's talk, Zoom released a patch for the flaw he disclosed at DefCon. “A local low-privileged user could exploit this vulnerability to escalate their privileges to root,” the company wrote in its advisory.
