Zoom Screen-Sharing Bug Enabled Full Device Takeover on Calls
▼ Summary
– Researchers disclosed Zoom vulnerabilities that could let attackers silently take over devices during screen-sharing calls, affecting all supported operating systems.
– The bugs were found using public AI models in under 20 prompts, a task that previously might take a team of five people six months.
– The flaws were in Zoom’s real-time annotation protocol, which the AI targeted because obscure closed-source features often hide overlooked bugs.
– Zoom has issued server and client-side patches, but researchers warn that joining a call is a trust gesture that could lead to full device or enterprise compromise.
– Experts highlight the “democratization” of AI hacking, noting the rapidly dropping barrier to entry is turning security into an all-out race.
The latest advance in artificial intelligence has produced a troubling demonstration: researchers have uncovered critical flaws in Zoom’s video conferencing platform that could have allowed a full takeover of any participant’s device during a call. The vulnerabilities, disclosed on Tuesday, affected anyone engaged in screen sharing, whether they were the host or simply a guest, and could be triggered silently, with zero interaction or warning to the victim.
A Security, a digital defense firm, reported that its team identified the bug in early June using publicly accessible AI models. Remarkably, it took fewer than 20 prompts to uncover the weaknesses and construct a functional exploit. Zoom has since acknowledged the issue, issuing a security advisory on Tuesday and rolling out fixes for both its servers and client applications across all supported operating systems, including Windows, macOS, Linux, iOS, and Android.
The discovery highlights a shifting paradigm in cybersecurity, where the tools to find and weaponize software flaws are no longer confined to elite specialists. A Security cofounder Omer Gull emphasized the gravity of this trend in an interview, noting that what once demanded a team of five researchers spending six months on meticulous refinement can now be accomplished in minutes with a handful of prompts. He pointed to Zoom as a particularly high-value target because users inherently trust the platform, rarely viewing it as a potential threat.
The specific weaknesses resided in the protocol governing real-time annotation during screen-sharing sessions. The researchers deliberately steered their AI systems toward this component, reasoning that, like human experts, these models are trained to suspect that complex and less-traveled functions often harbor overlooked errors. Closed-source software from established firms like Zoom typically undergoes rigorous internal review, yet without the scrutiny of an open-source community, intricate features such as annotation can slip through the cracks.
Zoom did not respond to repeated inquiries from WIRED regarding the findings.
Although the vulnerabilities are now patched, with fixes deployed on both the backend and user devices, the implications remain unsettling. The attack vector was deceptively simple: an adversary merely needed to get a target onto a Zoom call. Given the platform’s ubiquity across personal, professional, and semi-public settings like webinars, most users approach a meeting with their guard down, treating the act of joining as a gesture of good faith.
A Security cofounder Yossi Torati illustrated the potential damage during a conversation, noting that the worst-case scenario involved gaining control of an entire enterprise. An attacker could join a call with an employee, seize their computer and credentials, and then pivot laterally through the corporate network, all without raising suspicion.
Security has long been described as a cat-and-mouse game, but the proliferation of AI-driven bug hunting has accelerated the pace dramatically. What was once a deliberate, methodical pursuit is now a high-speed race, and the barrier to entry has never been lower.
(Source: Wired)
