{"id":2359,"date":"2020-04-24T15:26:16","date_gmt":"2020-04-24T15:26:16","guid":{"rendered":"https:\/\/www.varutra.com\/blog\/?p=2290"},"modified":"2022-12-02T15:13:46","modified_gmt":"2022-12-02T09:43:46","slug":"zooming-security-vulnerabilities-part-1","status":"publish","type":"post","link":"https:\/\/www.varutra.com\/varutravrt3\/zooming-security-vulnerabilities-part-1\/","title":{"rendered":"Zooming Security Vulnerabilities [Part \u2013 1]"},"content":{"rendered":"

<\/p>\n

Diving into Zoom Security Vulnerabilities [Part \u2013 1]<\/strong><\/p>\n

 <\/p>\n

Introduction –<\/strong><\/h3>\n

Zoom is a popular web-based video-conferencing application available to be installed on computer systems and mobile devices that enables users to use online video conferencing services.<\/p>\n

Zoom application offers top-quality video, audio, and screen-sharing options with high performance and is available across various platforms.<\/p>\n

Recently attackers are attempting to use numerous methodologies through which they are able to exploit the vulnerabilities residing within the application. This blog article talks about a few of the critical vulnerabilities which are making use of the Coronavirus (COVID-19) pandemic as mentioned below:<\/p>\n

 <\/p>\n

1. Zoom Lookalike Domains –<\/strong><\/p>\n

As Zoom is widely used as the video conferencing solution because of the ongoing Corona pandemic and due to the travel restrictions for various business groups and in work from home scenarios, attackers are taking its advantage and have registered numerous Zoom themed domains for malicious purposes.<\/p>\n

\"Zoom<\/p>\n

Image Source – Check Point Technologies Blog<\/em><\/p>\n

Researchers have discovered malicious files\u00a0using a\u00a0zoom-us-zoom_##########.exe\u00a0an \u201cmicrosoft-teams_V#mu#D_##########.exe\u201d (# representing\u00a0numerous\u00a0digits). Once the file is executed, it will\u00a0try and\u00a0install unwanted third-party applications and malicious payloads.<\/p>\n

\"Zoom<\/p>\n

Image Source – Check Point Technologies Blog<\/em><\/p>\n

 <\/p>\n

2. Malicious Zoom Installer –<\/strong><\/p>\n

Malicious Coin digger\u00a0is clubbed with the legitimate installer of Zoom video conferencing application, luring users who want to install the software but end up unwittingly downloading a malicious file, note that these compromised files\u00a0are not\u00a0from Zoom\u2019s official\u00a0website.<\/p>\n

Users who try and download the installer (from lookalike domains and malicious domains) download the AutoIt compiled malware which is termed as – Trojan.Win32.MOOZ.THCCABO<\/em><\/strong><\/p>\n

It also checks whether the Microsoft Smart Screen and Windows Defender are enabled and any antivirus solutions running within the system to evade malware detection.<\/p>\n

\"Vulnerabilities<\/p>\n

Image Source- Bleeping Computer<\/em><\/p>\n

 <\/p>\n

3. UNC\u00a0Path Injection Vulnerability –<\/strong><\/p>\n

It was discovered that Zoom\u00a0client for Windows is at risk against UNC path injection vulnerability which could allow remote attackers to steal login credentials for victim\u2019s Windows systems. After stealing the information, the victim\u2019s system is exploited to launch any program already present on a victim\u2019s computer or execute arbitrary commands to compromise it remotely.<\/p>\n

The attack involves the SMBRelay<\/strong> technique where Windows automatically exposes a user’s login username and NTLM password hashes to a remote SMB server when attempting to connect and download a file hosted on the SMB server.<\/p>\n

\"UNC\u00a0Path<\/p>\n

Image Source: Medium.com<\/em><\/p>\n

Recommendations<\/strong> for UNC Path <\/strong>Injection Vulnerability<\/strong> –
\n<\/strong><\/p>\n

Windows users can change the security policy settings to restrict the operating system from automatically passing their\u00a0NTLM\u00a0credentials to a remote server.<\/p>\n

This policy is called ‘Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers and is found under the following path in the Group Policy Editor.\u00a0<\/strong><\/p>\n

Path –<\/strong>\u00a0Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers.<\/p>\n

 <\/p>\n

4. GHOST Vulnerability –<\/strong><\/p>\n

Zoom application is additionally at risk of GHOST vulnerability which is a buffer overflow bug that affects function calls in the Linux Glibc library.<\/p>\n

This vulnerability poses a risk of remote code execution attacks. An attacker who exploits this flaw can gain complete control of the compromised system.<\/p>\n

 <\/p>\n

5. Zoom-Bombing –<\/strong><\/p>\n

“Zoom-Bombing,” an uninvited intrusion on video calls that affects various virtual classes and business calls.<\/p>\n

To Zoom-bomb, attackers find ways to enter Zoom calls they weren’t invited to, either by receiving the password from others within the call, typing out a random code in the hopes that it is a real meeting ID, or finding a link in a social media post or elsewhere on the internet.<\/p>\n

\"Zoom-Bombing\"<\/p>\n

Image Source: Shutterstock\/Illustration by Rachel E. Greenspan<\/em><\/p>\n

 <\/p>\n

6. Hackers Exploiting Zoom Vulnerabilities to Record Meetings –<\/strong><\/p>\n

It was discovered that a vulnerability in the Zoom application exists that injects malware into the Zoom process and then records Zoom meeting sessions, also captures the chat text without any user interaction even when the recording option is disabled by the meeting organizer.<\/p>\n

At the time of recording, it is believed that none of the participants are aware that the session is being recorded,<\/p>\n

Shockingly, the attack is possible with the latest version of Zoom with all the security features turned on and antivirus software installed and running.<\/p>\n

\"Hackers<\/p>\n

Image Source: <\/em>gbhackers.com<\/em><\/p>\n

Distribution Methods –<\/strong><\/p>\n

Phishing Emails, Phishing Domains, Malicious Websites, Unpatched Zoom Application<\/p>\n

 <\/p>\n

Recommendations –<\/strong><\/p>\n

    \n
  1. Avoid using Zoom if possible, and check for an alternative video-conferencing application.<\/li>\n
  2. Beware of lookalike domains, spelling errors in emails and websites, and unfamiliar email senders.<\/li>\n
  3. Be cautious with emails and files received from unknown senders, especially if they are offering special deals or discounts.<\/li>\n
  4. Users are advised to download installers from the application\u2019s official websites to avoid any system compromise.<\/li>\n
  5. Keep a reliable and tested backup of data that can be restored in case of business emergencies.<\/li>\n
  6. Educate users that they should not open attachments from unknown emails.<\/li>\n
  7. Block the IoC’s as listed in the blog article on applicable security solutions.<\/li>\n
  8. Do not open attachments in unsolicited emails, even if they come from people in the contact list, and never click on a URL contained in an unsolicited email, even if the link seems benign.<\/li>\n
  9. Exercise caution while visiting unknown links or web pages.<\/li>\n
  10. Avoid sharing links via social media and try to ensure only trusted colleagues or participants join the meeting.<\/li>\n
  11. Avoid using Zoom Personal Meeting ID (PMI) to host events and meetings and use a custom meeting passwords every time.<\/li>\n
  12. Keep AV signatures as well as the operating system and 3rd party application patches up-to-date.<\/li>\n<\/ol>\n

     <\/p>\n

    References –
    \n<\/strong><\/p>\n