Hacking Zoom: A Hacker's Journey into Zoom Infrastructure & Client Security
Mazin Ahmed shares the research journey of auditing Zoom during the 2020 pandemic, uncovering security vulnerabilities and reverse engineering client protocols.
Summary
The Unprecedented Growth of Video Conferencing
During the early months of the COVID-19 pandemic, Zoom became a critical communication utility for hundreds of millions of daily corporate and educational users.
Reverse Engineering Zoom Desktop Clients and Web APIs
Mazin Ahmed explores the Zoom client architecture, examining undocumented network protocols, local web servers, and cryptographic encryption handshakes.
Discovering Vulnerabilities in Meeting Privacy and Access Controls
The author details finding vulnerabilities affecting meeting privacy, URL scheme handling, and unauthenticated API endpoints.
Coordinated Disclosure and Lessons in Rapid Platform Hardening
The presentation reviews Zoom's comprehensive 90-day security transformation and shares takeaways for securing high-growth consumer communication platforms.
Related talks
Main Stage·40 min
Julian Horoszkiewicz
Demonstrates rapid vulnerability discovery methodologies that uncovered seven zero-day local privilege escalation flaws in pre-installed OEM bloatware.
Main Stage·41 min
Patrick Wardle
macOS security expert Patrick Wardle exposes a local privilege escalation zero-day in Zoom for macOS, gaining root privileges by subverting the auto-updater.
Presentations Panels·37 min
Security researchers demonstrate attack surfaces in Adobe Reader's JavaScript engine, dissecting sandbox escapes and exploitation techniques.