Zoom has confirmed it fixed a vulnerability in one of its features which allowed threat actors to steal sensitive data from users.
This is according to cybersecurity researchers from AppOmni, which discovered the vulnerability, detailed it, and reported it to the video conferencing company for fixing.
The exploit could have allowed hackers to hijack meetings and steal information.
Harvesting important data
In a detailed report the researchers said that they discovered a flaw in Zoom Rooms in June 2023.
Zoom Rooms is a system that allows team members in different physical locations to work together over Zoom. The user would install the app on an endpoint which would serve as a terminal for the people in the room.
When a Zoom Room is created, Zoom creates a service account with licenses for Meetings and Whiteboards.
And that’s where the problem lies. Zoom automatically assigns an email address to the Room service account. The format of the address is rooms_<account ID>@companycomain.com. So, for example, if a user has an Outlook address, Zoom would create one in the format of room_<account ID>@outlook.com.
Since everyone can create an Outlook address, it’s easy to create a valid email inbox for a Zoom Room. Using that email, the researchers signed up to Zoom, and got an activation link in the inbox. Upon activation, Zoom logged the researchers into the victims’ Zoom tenant as the service account.
The service account is considered a team member, allowing the researchers to gather information laterally across the tenant. As Zoom Rooms starts with two licenses, it gives the researchers a view of all users in the organizations, allows them to hijack meetings as if they were the hosts, view all whiteboards, and more.
The only prerequisite to successfully pulling off the attack is knowing the email address which, considering the amount of stolen emails every day, isn’t that big of a challenge. Malicious insiders can also pull it off by simply being in the same Zoom Room.
After disclosing the findings to Zoom, the company promptly issued a fix, by removing the ability to create Zoom Room accounts.
