The macOS version of Zoom, particularly its installer, exposes Apple computers and laptops to a serious security vulnerability. If exploited correctly, the bug which exists in the setup for the Zoom application can grant an attacker complete control of a Mac PC. It is concerning to note that Zoom tried to patch the setup, but hasn’t fully succeeded to patch the flaw.
Mac security specialist Patrick Wardle presented his observations about the security flaw at the Def Con hacking conference in Las Vegas on Friday. While Zoom has fixed some of the bugs, Wardle was able to successfully prove one unpatched vulnerability that still affects macOS.
It is interesting to note that Apple mandates a user or owner installing any software to enter their login password. However, Wardle discovered an auto-update function, which he was able to keep running in the background with superuser privileges.
A potential attacker is able to execute the vulnerability simply because the installer for Zoom needs to
run with special user permissions. The special case exists during the installation and removal of the Zoom application on a computer running macOS.
www.neowin.net
