[ad_1]
An exploration of zero-click assault floor for the favored video conferencing resolution Zoom has yielded two beforehand undisclosed safety vulnerabilities that might have been exploited to crash the service, execute malicious code, and even leak arbitrary areas of its reminiscence.
Natalie Silvanovich of Google Challenge Zero, who found and reported the two flaws final yr, stated the problems impacted each Zoom purchasers and Multimedia Router (MMR) servers, which transmit audio and video content material between purchasers in on-premise deployments.
The weaknesses have since been addressed by Zoom as a part of updates shipped on November 24, 2021.
The objective of a zero-click assault is to stealthily achieve management over the sufferer’s system with out requiring any sort of interplay from the person, comparable to clicking on a hyperlink.
Whereas the specifics of the exploit will range relying on the character of vulnerability being exploited, a key trait of zero-click hacks is their capacity to not go away behind traces of malicious exercise, making them very tough to detect.
The 2 flaws recognized by Challenge Zero are as follows —
- CVE-2021-34423 (CVSS rating: 9.8) – A buffer overflow vulnerability that may be leveraged to crash the service or software, or execute arbitrary code.
- CVE-2021-34424 (CVSS rating: 7.5) – A course of reminiscence publicity flaw that could possibly be used to doubtlessly achieve perception into arbitrary areas of the product’s reminiscence.
By analyzing the RTP (Actual-time Transport Protocol) site visitors used to ship audio and video over IP networks, Silvanovich discovered that it is attainable to control the contents of a buffer that helps studying completely different knowledge sorts by sending a malformed chat message, inflicting the shopper and the MMR server to crash.
Moreover, the dearth of a NULL test — which is used to find out the top of a string — made it attainable to leak knowledge from the reminiscence by becoming a member of a Zoom assembly through an online browser.
The researcher additionally attributed the reminiscence corruption flaw to the truth that Zoom didn’t allow ASLR, aka tackle area format randomization, a safety mechanism designed to extend the issue of performing buffer overflow assaults.
“The shortage of ASLR within the Zoom MMR course of significantly elevated the chance that an attacker may compromise it,” Silvanovich stated. “ASLR is arguably an important mitigation in stopping exploitation of reminiscence corruption, and most different mitigations depend on it on some stage to be efficient. There is no such thing as a good purpose for it to be disabled within the overwhelming majority of software program.”
Whereas most video conferencing techniques use open-source libraries comparable to WebRTC or PJSIP for implementing multimedia communications, Challenge Zero known as out Zoom’s use of proprietary codecs and protocols in addition to its excessive licensing charges (almost $1,500) as limitations to safety analysis.
“Closed-source software program presents distinctive safety challenges, and Zoom may do extra to make their platform accessible to safety researchers and others who want to consider it,” Silvanovich stated. “Whereas the Zoom Safety Staff helped me entry and configure server software program, it isn’t clear that assist is out there to different researchers, and licensing the software program was nonetheless costly.”
[ad_2]
