Comment: Zoom Client Leaks Windows Login Credentials To Attackers

The Zoom Windows client is vulnerable to UNC path injection in the client’s chat feature that could allow attackers to steal the Windows credentials of users who click on the link.

When using the Zoom client, meeting participants can communicate with each other by sending text messages through a chat interface.

When sending a chat message, any URLs that are sent are converted into hyperlinks so that other members can click on them to open a web page in their default browser, Bleeping Computer reported.

Experts Comments

April 02, 2020
Tal Zamir
Founder and CTO
Hysolate
Especially in the current situation, enterprises must keep in mind that user devices use a variety of apps that go beyond just email and internet. Zoom is one of the most popular non-browser apps these days, and has new vulnerabilities enterprises should care about. This includes the recently discovered Zoom Client vulnerability that allows a remote attacker on a Zoom call to receive a user's Windows credentials. Unfortunately, we'll see an increase of such attacks on collaboration tools such.....Read More
Especially in the current situation, enterprises must keep in mind that user devices use a variety of apps that go beyond just email and internet. Zoom is one of the most popular non-browser apps these days, and has new vulnerabilities enterprises should care about. This includes the recently discovered Zoom Client vulnerability that allows a remote attacker on a Zoom call to receive a user's Windows credentials. Unfortunately, we'll see an increase of such attacks on collaboration tools such as Zoom, Teams, and Slack, as they all have a wide attack surface. To really protect against endpoint threats in a comprehensive way, enterprises should adopt OS isolation techniques that move sensitive enterprise apps, data, and credentials into a separate OS that is isolated from riskier external-facing apps.  Read Less
What do you think of the topic? Do you agree with expert(s) or share your expert opinion below.
Be part of our growing Information Security Expert Community (1000+), please register here.

Share on facebook
Share on twitter
Share on linkedin

Recent Posts

Information Security Buzz (aka ISBuzz News) is an independent resource that provides the experts comments, analysis and opinion on the latest Information Security news and topics

Twitter Facebook-f Linkedin Youtube

Working With Us

The Pages

Our Contributing Experts