A vulnerability has been discovered that can infect the Mac version of Zoom! Immediate update recommended | GetNavi web Get Navi

Zoom video conferencing app is widely used all over the world, including Japan, but a vulnerability has been reported in the version of macOS that allows hackers to access it with root privileges (the privileges that can do anything) and control the entire operating system. I am here. Moreover, it appears that this vulnerability has not yet been completely fixed.

Patrick Wardle, a former National Security Agency (NSA) security expert, gave a presentation at DEFCON, the world’s largest international security conference. Although Zoom has already fixed some related bugs, it appears that unaddressed vulnerabilities have been revealed.

According to Wardle, the vulnerability targets the Zoom app installer. Special permissions are required to install or uninstall Zoom (with users entering their password to allow this), but I’ve found that the auto-update feature keeps this special permission running in the background.

In other words, once the user grants special privileges to the installer, it continues to use those privileges behind the scenes. However, this is the permission required to update the app every time Zoom publishes an update. There is nothing wrong with checking that the package is cryptographically signed by the company and then running the updater (update function).

However, there was a bug in this encryption check that allowed hackers to trick the updater into thinking that the malicious file had been signed by Zoom. As a result, hackers can inject all kinds of malware and run it with high privileges of the updater.

This privilege escalation attack appears to have allowed hackers to gain root or superuser privileges (the account with the strongest privileges) on your Mac. In theory, you can add, remove, or modify any file on your Mac.

In December of last year, Wardel reported Zoom about the vulnerability and released a patch. However, this fix also contained another bug, and it seems that there is still a risk of being exploited. As a result, he reported the second error and how to fix the code to Zoom, but there was no response for more than half a year, so it is said that he decided to open it to the public.

The bug is still present in the latest version of the Zoom app for Mac, but Wardle said it’s very easy to fix, and he hopes making the bug public will “move the gears” on the company’s agenda soon. He says he does.

In response, Zoom said in a statement: “We are aware of a recently reported security vulnerability in Zoom’s automatic update for macOS and are working hard to address it. “After that, it was said that there was indeed a vulnerability in versions 5.7.3 to 5.11.3 of the macOS app that could take root privileges of the operating system.RecognitionIt is currently being distributedVersion 5.11.4It appears to be fixed now.

In any case, I would like to break my heart that Mr. Wardle’s call has arrived. If you are using an earlier version, we recommend that you update as soon as possible.

source:the edge