Stay at home.
Due to the coronavirus pandemic, that is what everyone has been doing in the last couple of weeks.
One of the apps that have been essential to people who have been working from home is Zoom. It is an app that provides remote conferencing services such as video calls, online meetings, chat, as well as mobile collaboration.
The app has been helpful with businesses and employers-employees by taking it to virtually to discuss business matters without physical interaction.
Because of such an arrangement, the app’s users have skyrocketed in just a short amount of time.
And because of its popularity, it has been a target for hackers. Just recently, the app faces a security flaw – hackers crashing into voice calls without permission, disrupting calls, and many more.
Now, researchers have exposed yet another security flaw Zoom is facing. Apparently, Windows users are the target of such an attack.
Zoom faces another security flaw
Researchers from Bleeping Computer has exposed another security flaw that Zoom is facing. The flaw involves hackers being able to steal passwords from Windows users.
According to Bleeping Computer, the issue exists because of messages with URLs or regular paths in the app convert into clickable links automatically in the Zoom app.
Although it is very helpful for users in opening a link quickly in the browser. But for non-URLs or Windows networking UNC paths, this leads to very weird behavior.
If a user clicks on a UNC path link, Windows will attempt to connect to the remote site using the SMB file-sharing protocol to open the remote cat.jpg file, – explained by Lawrence Abrams
And here is the catch:
While doing so, Windows also shares the users’ credentials, including its login name and NTLM password hash.
Thus, a potential attacker would easily be able to dehash the passwords just by using any tools like Hashcat. Also, it would not take long before password hashes would be cracked thanks to tools such as GPUs.
Exposing the security flaw
The bug has first caught the attention of a security researcher with the alias “g0dmode” on Twitter.
Then, another researcher Matthew Hickey showed how the UNC injection in Zoom capture NTLM password hashes.
The UNC injection will also allow attackers to execute arbitrary codes on the target device.
Zoom issues fix for the UNC vulnerability
Longing for good news?
Well, after the discovery of the issue, Zoom CEO Eric Yuan addressed the security issues in a blog post.
In the blog post, it was detailed that a bug fix that would fix the UNC vulnerability is well on its way. It appears that the fix is pushing out automatically to users.
And according to a PCWorld staff who has already received the fix reports the Zoom update version number as 4.6.9 (19253.0401).