You're Muted, Rooted: Exploiting Zoom on macOS
macOS security expert Patrick Wardle exposes a local privilege escalation zero-day in Zoom for macOS, gaining root privileges by subverting the auto-updater.
Summary
The Security Posture of Ubiquitous Video Conferencing
Zoom is deployed across millions of corporate and personal devices, running privileged background updater daemons that make it a critical attack target.
Reverse Engineering the Zoom macOS Auto-Updater
Patrick Wardle dissects Zoom's privileged helper tool, analyzing how it verifies cryptographic signatures on incoming application update packages.
Exploiting Signature Verification Time-of-Check to Time-of-Use (TOCTOU)
Wardle demonstrates bypassing signature verification via a race condition, tricking the privileged updater daemon into executing arbitrary root payloads.
Coordinated Disclosure and macOS Software Hardening
The author details the disclosure process with Zoom, the release of emergency patches, and best practices for secure privileged helper tool development.
Related talks
Main Stage·40 min
Julian Horoszkiewicz
Demonstrates rapid vulnerability discovery methodologies that uncovered seven zero-day local privilege escalation flaws in pre-installed OEM bloatware.
Red Team Village·53 min
Mazin Ahmed
Mazin Ahmed shares the research journey of auditing Zoom during the 2020 pandemic, uncovering security vulnerabilities and reverse engineering client protocols.
Main Stage·37 min
James 'albinowax' Kettle
James Kettle unleashes novel HTTP request smuggling and desync attack classes against modern web infrastructure, arguing for the retirement of HTTP/1.1.