Security flaws in Zoom’s screen-sharing feature could have allowed hackers to take control of devices used by anyone who joined a call on the popular video conferencing platform, researchers have found.
The vulnerability was disclosed on Tuesday, August 11, by a group of researchers from the digital defense firm A Security. First discovered in June this year, the bug could have been exploited to take over targets’ devices. Both participants or hosts who were part of a call that involved screen sharing would have been vulnerable to the covert cyber attack.
The researchers said that the vulnerability was a zero-day (previously unknown) flaw that could be exploited without requiring any action from the victim, such as clicking a link (zero-click attack). It also took the researchers fewer than 20 prompts submitted to publicly available AI models in order to uncover the vulnerability and exploit them to simulate a working cyber attack.
Any device running an operating system that supports Zoom, such as Windows, macOS, Linux, iOS, and Android, was susceptible to the zero-day, zero-click attack.
The researchers’ findings come at a time when AI models have gained advanced capabilities that allow them to be used to find vulnerability in existing software systems as well as develop ways to exploit them, and carry out end-to-end automated hacking sprees via AI agents.
Over the past few weeks, prominent AI companies such as OpenAI, Anthropic, Meta, and Moonshot AI have disclosed back-to-back security incidents involving AI agents built on top of powerful new models breaking out of containment and hacking into external platforms such as HuggingFace.
However, the use of AI tools for hunting down bugs has also emerged as an important part of the evolving ‘cat-and-mouse game’ between threat actors and cyber defenders.
It is unclear which models were used to uncover the Zoom vulnerability. However, some in the tech industry have argued that Chinese open-weight models can be more useful for cybersecurity research than frontier AI models from OpenAI and Anthropic, which they say are constrained by stricter cyber guardrails.
“What is interesting for us and what we believe is dangerous is the democratisation of these capabilities—the barrier to entry is dropping rapidly,” Omer Gull, the co-founder of A Security, was quoted as saying by Wired.
“Before it would have taken a team of five people maybe six months with a lot of refining and iteration to find this. Now people can reach the same results with under 20 prompts. And Zoom is an important type of target because people assume trust when using it. They don’t see it as a threat,” Gull added.
“If you just get on a Zoom with us, we can take over your device. The worst-case scenario is that we can take over an enterprise just by having this vulnerability in our hands. If I’m an attacker, I can be on a call with someone from a company, take control of their computer and their credentials, and then use them to move laterally in the enterprise,” Yossi Torati, another co-founder of the firm, said.
The security vulnerability was traced to the protocol used to facilitate real-time annotation during screen sharing on Zoom.
The researchers said that their AI-powered, bug hunting systems have been specifically trained to probe software functions that are obscure and complex as they are most likely to be overlooked during code review and system audits.
Proprietary, closed platforms such as Zoom are especially vulnerable here as they lack the benefit of public, open review.
In response to the researchers’ findings, Zoom on Tuesday issued a security advisory, where it laid out fixes that have been issued by the company to patch the flaw in its screen-sharing feature.
The zero-click flaws have now been reportedly patched by Zoom, both on the server and client sides, which includes applications that run on customer devices. However, A Security researchers emphasised that they were alarmed to find how easily a threat actor could have exploited the zero-click flaw and hijack a target device simply by getting potential victims to join a Zoom call.
