AI prompts expose ‘Zoomsday’ hack in under 20 tries
▼ Summary
– Zoom patched a major security vulnerability that could allow attackers to hijack devices during meetings.
– The flaw, found by A Security researchers, was uncovered using fewer than 20 prompts on publicly available AI models.
– The exploit targeted Zoom’s annotation feature, letting attackers run malicious code without victim action or visual cues.
– Attackers could steal data, enable cameras or microphones, or install malware on compromised devices.
– The fix was issued on Tuesday, impacting Zoom apps on Windows, macOS, Linux, Android, and iOS.
The security firm that pulled off the discovery says the entire process took just a single day, leveraging AI models that are freely available to the public. The vulnerability, which Zoom patched on Tuesday, affected the video conferencing app across Windows, macOS, Linux, Android, and iOS.
Researchers at A Security detailed their findings in a blog post, explaining that they uncovered the flaw using fewer than 20 prompts on publicly accessible AI models. The exploit targeted Zoom’s annotation feature, a tool that lets participants draw on a shared screen during a presentation or meeting.
By exploiting this feature, an attacker could join or host a meeting and execute malicious code on a victim’s device. That level of access could allow the attacker to steal sensitive data, activate the camera or microphone without permission, or install malware. Notably, the attack required no action from the victim and left no visible trace that the device had been compromised.
Idan Levcovich, a vulnerability researcher at A Security, highlighted the significance of the discovery in the blog post. He noted that producing a working exploit of this nature has traditionally been considered nation-state work, requiring elite teams, months of effort, and budgets that governments regulate as weapons. In this case, however, the team accomplished it in a single day with an AI agent and models that anyone can access today.
The speed and accessibility of this exploit underscore a shifting dynamic in cybersecurity. What once demanded substantial resources and specialized expertise is now within reach of individuals with the right AI tools and a bit of creativity. Zoom has already rolled out a fix, but the incident serves as a reminder of how rapidly attack methods are evolving in the age of generative AI.
(Source: The Verge)
