Zoom headquarters

Flaw in Video Conferencing App Could Have Given Hackers Immediate Access to Webcam Feeds

The company, Zoom, is now taking action to update its software after a security researcher discovered several serious security vulnerabilities in the popular video chat app.

A security vulnerability in a popular video conferencing app could have allowed hackers access to users’ webcam video feeds, according to the findings of software engineer and researcher Jonathan Leitschuh. In the wake of complaints from its customers, the company, Zoom, is now acting to address the security issues.

The popular video conferencing application for businesses boasts at least 40 million customers and is well known for offering a simple user experience. All you have to do is download the Zoom app to a laptop, click the meeting URL and watch as the application immediately opens and joins the call.

The seamless technology that makes Zoom so attractive to users is also the reason it could be easily hacked, particularly on Apple computers. In a Medium post laying out his research, Leitschuh wrote that he was drawn to look into the app because he was curious about how the functionality was implemented securely.

“Come to find out, it really hadn’t been implemented securely,” Leitschuh wrote. “Nor can I figure out a good way to do this that doesn’t require an additional bit of user interaction to be secure.”

Leitschuh found that the app sets up a local web server on every Mac that allows call URLS to automatically launch the application, bypassing any pop-up windows asking the user to confirm they want to open Zoom. (This feature is not so easy with Windows, but users can check a box to permanently dismiss the warnings and start video chats immediately, WIRED magazine reported).

But by going around the pop-ups, users were not given a valuable tool to deny access to their webcam feeds. As Leitschuh found, an attacker could set up a malicious call, trick users into clicking the link and immediately have access to their video feeds.

He also found that attackers could wage a denial of service (DoS) attack against Apple computers by using a malicious link to barrage the computer with call requests. The company fixed this issue in a May patch.

In addition, Leitschuh was disturbed by the fact that the Zoom local web server was not deleted from Macs even if the user deleted the Zoom application, allowing it to be easily redownloaded automatically if someone clicked a malicious meeting link.

Once he discovered these vulnerabilities, Leitschuh notified Zoom’s security team and gave them 90 days to fix the problems, offering a “quick fix” and suggestions for long-term solutions. He said he was frustrated by the team’s slow response and disagreements over the potential security risks of preserving the functionality of the app.

“An organization of this profile and with such a large user base should have been more proactive in protecting their users from attack,” Leitschuh wrote.

Since then, Leitschuh and other researchers have spoken with Zoom’s CEO, and the company has taken action to address the problems. Though the company maintained that it has “no indication” that a hacker ever carried out an attack similar to those described by Leitschuh, Zoom issued a patch Tuesday night that removes the local web server from Mac computers and adds an option to manually uninstall the app, including the local server.

The company is also planning another major update for later this week that will allow first-time and returning users to turn off the function that automatically gives access to their video feeds. In addition, Zoom will make it easier for researchers like Leitschuh to submit their security concerns through a “public vulnerability disclosure program” to be launched in the next several weeks.

For security experts, the episode was an example of how local web servers can pose a variety of risks for users.

“This is just one of many examples where locally running HTTP servers can vastly undermine security,” said Craig Young, a computer security researcher for Tripwire’s Vulnerability and Exposure Research Team. “The problem, at its core, is that Zoom allows for control via HTTP requests and HTTP requests can be forged from the browser by any web site a victim opens.”


  • Cloud Adoption Gives Way to Hybrid Deployments

    Cloud adoption is growing at an astonishing rate, with Gartner forecasting that worldwide public cloud end-user spending will approach $600 billion by the end of this year—an increase of more than 21% over 2022. McKinsey believes that number could eclipse $1 trillion by the end of the decade, further underscoring the industry’s exponential growth. Read Now

  • AI on the Edge

    Discussions about the merits (or misgivings) around AI (artificial intelligence) are everywhere. In fact, you’d be hard-pressed to find an article or product literature without mention of it in our industry. If you’re not using AI by now in some capacity, congratulations may be in order since most people are using it in some form daily even without realizing it. Read Now

  • Securing the Future

    In an increasingly turbulent world, chief security officers (CSOs) are facing a multitude of challenges that threaten the stability of businesses worldwide. Read Now

    • Guard Services
  • Security Entrances Move to Center Stage

    Most organizations want to show a friendly face to the public. In today’s world, however, the need to keep people safe and secure has become a prime directive when designing and building facilities of all kinds. Fortunately, there is no need to construct a fortress-like entry that provides that high level of security. Today’s secured entry solutions make it possible to create a welcoming, attractive look and feel at the entry without compromising security. It is for this reason that security entrances have moved to the mainstream. Read Now

Featured Cybersecurity

New Products

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area. 3

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings. 3

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction. 3