When it comes to video calling final word is Zoom. It is used by corporates and individual users around the globe. In this article, we will discuss the newly discovered threats in the Zoom app.
Zoom has revealed four recent(May 2022) security vulnerabilities:
- CVE-2022-22784 (CVSS score: 8.1): Improper XML Parsing in Zoom Client for Meetings
- CVE-2022-22785 (CVSS score: 5.9): Improperly constrained session cookies in Zoom Client for Meetings
- CVE-2022-22786 (CVSS score: 7.5): Update package downgrade in Zoom Client for Meetings for Windows
- CVE-2022-22787 (CVSS score: 5.9): Insufficient hostname validation during server switch in Zoom Client for Meetings
Common Vulnerability Scoring System(CVSS) provides a numerical (0-10) representation of the severity of an information security vulnerability. A higher CVSS score indicates it is a severe vulnerability. Ivan Fratric( Google Project Zero) discovered these four vulnerabilities, ranging from 5.9 to 8.1 in severity.
Zoom’s chat feature is built on using the XMPP standard. Hackers are using the Zoom video platform to inject malware into users’ systems or mobile devices. The most worrying part is the user doesn’t need to interact with hackers; it happens hidden way. This vulnerability is applicable for :
- iPhone
- Android devices
- Windows
- Linux
- Mac OS
In the report, Fratric writes:
“This report describes a vulnerability chain that enables a malicious user to compromise another user over Zoom chat. User interaction is not required for a successful attack. The only ability an attacker needs is to be able to send messages to the victim over Zoom chat over XMPP protocol. Initial vulnerability (labeled XMPP Stanza Smuggling) abuses parsing inconsistencies between XML parsers on Zoom’s client and server in order to be able to “smuggle” arbitrary XMPP stanzas to the victim client. From there, by sending a specially crafted control stanza, the attacker can force the victim client to connect to a malicious server, thus turning this primitive into a man-in-the-middle attack.”
How to escape from the Zoom threat?
Zoom has fixed these 4 vulnerabilities. So we need to update the Zoom app. Zoom advises downloading the latest version of the app (5.10.0 or higher). It is better to stay away from clicking any malicious links or text messages. Read about the WhatsApp Message Wp20.ru link.