Blog

A security researcher has found a way that an attacker could leverage the macOS version of Zoom to gain access over the entire operating system.

Details of the exploit were released in a presentation given by Mac security specialist Patrick Wardle at the Def Con hacking conference. Some of the bugs have already been fixed by Zoom, but the researcher also presented one unpatched vulnerability that still affects systems now.

The exploit works by targeting the installer for the Zoom application, which needs to run with special user permissions in order to install or remove the main Zoom application from a computer.

While the installer requires a user to enter their password first in order to add the application to the system, Wardle found that an auto-update function continually ran in the background with superuser privileges.

When Zoom issued an update, the updater function would install the new package after checking that it had been cryptographically signed by Zoom.

However, the bug found in how the checking method was implemented meant that giving the updater any file with the same name as Zoom’s signing certificate, would allow an attacker to substitute it with any kind of malware program, and have it be run by the updater with elevated privileges.

The result is a privilege escalation attack, which assumes an attacker has already gained initial access to the target system and then employs an exploit to gain a higher level of access.

In this case, the attacker begins with a restricted user account but escalates into the most powerful user type, known as a “superuser” or “root” allowing them to add, remove, or modify any files on the machine.

Wardle is the founder of the Objective-See Foundation, a nonprofit that creates open-source security tools for macOS. Wardle detailed the unauthorized use of algorithms lifted from his open-source security software by for-profit companies.

Following responsible disclosure protocols, Wardle informed Zoom about the vulnerability in December of last year. To his frustration, he says an initial fix from Zoom contained another bug that meant the vulnerability was still exploitable in a slightly more roundabout way, so he disclosed this second bug to Zoom and waited eight months before publishing the research.

Wardle told The Verge, “To me that was kind of problematic because not only did I report the bugs to Zoom, I also reported mistakes and how to fix the code, so it was really frustrating to wait, what, six, seven, eight months, knowing that all Mac versions of Zoom were sitting on users’ computers vulnerable.”

A few weeks before the Def Con event, Wardle says Zoom issued a patch that fixed the bugs that he had initially discovered, but on closer analysis, he found another small error that meant the bug was still exploitable.

In the new version, a package to be installed is first moved to a directory owned by the “root” user. This basically means that no user without root permission is able to add, remove, or modify files in this directory.

However, because of a subtlety of Unix systems (of which macOS is one), when an existing file is moved from another location to the root directory, it retains the same read-write permissions it previously had.

Therefore, in this case, it can still be modified by a regular user, and because it can be modified, a cyber criminal can still swap the contents of that file with a file of their own choosing, and then use it to become root.

While this bug is currently live in Zoom, Wardle says it’s very easy to fix and that he hopes that talking about it publicly will help have the company take care of it sooner rather than later.

In a statement to The Verge, Matt Nagel, Zoom’s security and privacy PR lead, said: “We are aware of the newly reported vulnerability in the Zoom auto updater for macOS and are working diligently to address it.”