Get all your news in one place.
100’s of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

Zoom fixes significant security flaw that could have allowed hackers to hijack your meetings

A white padlock on a dark digital background.

Zoom has confirmed it fixed a vulnerability in one of its features which allowed threat actors to steal sensitive data from users.

This is according to cybersecurity researchers from AppOmni, which discovered the vulnerability, detailed it, and reported it to the video conferencing company for fixing.

The exploit could have allowed hackers to hijack meetings and steal information.

Harvesting important data

In a detailed report  the researchers said that they discovered a flaw in Zoom Rooms in June 2023. 

Zoom Rooms is a system that allows team members in different physical locations to work together over Zoom. The user would install the app on an endpoint which would serve as a terminal for the people in the room. 

When a Zoom Room is created, Zoom creates a service account with licenses for Meetings and Whiteboards.

And that’s where the problem lies. Zoom automatically assigns an email address to the Room service account. The format of the address is rooms_@companycomain.com. So, for example, if a user has an Outlook address, Zoom would create one in the format of room_@outlook.com.

Since everyone can create an Outlook address, it’s easy to create a valid email inbox for a Zoom Room. Using that email, the researchers signed up to Zoom, and got an activation link in the inbox. Upon activation, Zoom logged the researchers into the victims’ Zoom tenant as the service account. 

The service account is considered a team member, allowing the researchers to gather information laterally across the tenant. As Zoom Rooms starts with two licenses, it gives the researchers a view of all users in the organizations, allows them to hijack meetings as if they were the hosts, view all whiteboards, and more.

The only prerequisite to successfully pulling off the attack is knowing the email address which, considering the amount of stolen emails every day, isn’t that big of a challenge. Malicious insiders can also pull it off by simply being in the same Zoom Room.

After disclosing the findings to Zoom, the company promptly issued a fix, by removing the ability to create Zoom Room accounts.

More from TechRadar Pro

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.