Later archive addition

Zoom Zero Day: 4 Million Webcams & maybe an RCE? Just get them to visit your website!

Jonathan Leitschuh and /@jonathan.leitschuh · Medium · 9 July 2019

The report finds that Zoom’s persistent macOS localhost server let any visited website force the client into a meeting, optionally activating the webcam, and repeatedly launch calls for denial of service. It also shows the service could silently reinstall Zoom and evaluates how weak signatures, same-NAT conditions, and trusted download domains left drive-by attack paths.

Record

Researcher

Jonathan Leitschuh and /@jonathan.leitschuh

Published by

Medium

Date

9 July 2019

In the archive

• Added to the 2019 archive after the original list was published

Related sources

• RCE follow-up

Tags

• localhost
• desktop-app
• origin-validation
• dos
• privacy
• sop-bypass
• browser
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Jonathan Leitschuh and /@jonathan.leitschuh, first published at the original source. Preserved copies are kept so the citation survives its host.