Zoom installer for macOS has a security flaw granting elevated system privileges


Level 78
Thread author
Honorary Member
Top Poster
Content Creator
Apr 24, 2016
The macOS version of Zoom, particularly its installer, exposes Apple computers and laptops to a serious security vulnerability. If exploited correctly, the bug which exists in the setup for the Zoom application can grant an attacker complete control of a Mac PC. It is concerning to note that Zoom tried to patch the setup, but hasn’t fully succeeded to patch the flaw.

Mac security specialist Patrick Wardle presented his observations about the security flaw at the Def Con hacking conference in Las Vegas on Friday. While Zoom has fixed some of the bugs, Wardle was able to successfully prove one unpatched vulnerability that still affects macOS.

It is interesting to note that Apple mandates a user or owner installing any software to enter their login password. However, Wardle discovered an auto-update function, which he was able to keep running in the background with superuser privileges.

A potential attacker is able to execute the vulnerability simply because the installer for Zoom needs to run with special user permissions. The special case exists during the installation and removal of the Zoom application on a computer running macOS.
According to Wardle, Zoom patched the flaw a few weeks before the Def Con event. However, the bug was still exploitable. Although Zoom altered the way the installer operates, an attacker can still add, remove, or modify files way beyond an ordinary account’s access level.

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.