‘Zero-Click’ Zoom Vulnerabilities Could Have Exposed Calls

Most hacks require the victim to click on the wrong link or open the wrong attachment. But as so-called zero-click vulnerabilities—in which the target does nothing at all—are exploited more and more, Natalie Silvanovich of Google's Project Zero bug-hunting team has worked to find new examples and get them fixed before attackers can use them. Her list now includes Zoom, which until recently had two alarming, interactionless flaws lurking inside.

Though fixed now, the two vulnerabilities could have been exploited without any user involvement to take over a victim's device or even compromise a Zoom server that processes many users' communications in addition to those of the original victim. Zoom users have the option to turn on end-to-end encryption for their calls on the platform, which would keep an attacker with that server access from surveilling their communications. But a hacker could still have used the access to intercept calls in which users didn't enable that protection.

“This project took me months, and I didn't even get all the way there in terms of carrying out the full attack, so I think this would only be available to very well-funded attackers,” Silvanovich says. “But I wouldn’t be surprised if this is something that attackers are trying to do.”