Zoom has a security flaw that allows attackers to install malware on the device, without the user getting alerted about it. The security flaw has been reported in the Zoom Client for Meetings platform which is available for Android, iOS, macOS, Windows and Linux as well.
Zoom says the vulnerability was found in the version 5.10.0, which fails to properly validate the hostname during a server switch request. The company is asking users to update the software right away, also warning people from clicking on any links from unknown sources that may be carrying the malware.
The threat starts with a simple message and pushes the host device to complete risk. It was developed in such a way that a specifically structured and the compromised message was sent to the users. This allowed the hackers to drop malicious code on the victim's machine and shoot malware and spyware attacks.
The hackers were only supposed to send messages to the target user via Zoom chat over the XMPP protocol. Most of the people affected by these types of attacks are those who open links or texts from unknown sources. The invite links of meetings should be shared via a channel of secure communication in order to avoid any misuse.
Zoom said in a blog post “This issue could be used in a more sophisticated attack to trick an unsuspecting user’s client to connect to a malicious server when attempting to use Zoom services.” The loophole was identified by the security experts at Google's Project Zero. As of now, Zoom has patched the vulnerability and the application is again ready to use.
