The attack must also originate from an accepted external contact or be a part of the target's same organizational account.Īs a best practice, Zoom recommends that all users only accept contact requests from individuals they know and trust. In-session chat in Zoom Meetings and Zoom Video Webinars are not impacted by the issue. We are working to mitigate this issue with respect to Zoom Chat, our group messaging product. We take security very seriously and greatly appreciate the research from Computest.

'We thank the Zero Day Initiative for allowing us to sponsor and participate in Pwn2Own Vancouver 2021, an event highlighting the critical and skillful work performed by security researchers. Zoom reached out to us after this story was first published to provide this statement: Winners must share their methods privately with the developers of the software they've hacked. White-hat hackers are given stock machines and software, all fully patched, and must demonstrate their exploits in real-time before a live audience.

The Pwn2Own competition, now run by Trend Micro's Zero Day Initiative team, has been running since 2007. (Zoom will nudge you to install the desktop app when joining a meeting online, but you can ignore that.) If you want to play it safe for now, then use the Zoom browser interface instead of the Zoom desktop client. Under Pwn2Own rules, software developers have 90 days to fix flaws revealed during the competition.įor their trouble, Keuper and Alkemade received $200,000, no doubt a nice supplement to their day jobs at Dutch cybersecurity firm Computest.Īs long as Keuper, Alkemade and the Zoom security team stay tight-lipped about how this exploit works, there's little chance that hackers will use it to hijack computers running Zoom. There's been no mention of the exploit on the Zoom website yet, but we can be pretty sure Zoom's own people are working to fix this flaw as quickly as possible. Zoom itself is a major sponsor (opens in new tab) of this year's Pwn2Own competition.

However, the browser version of the Zoom meeting client is not affected. The exploit also works on the Zoom desktop client for Mac, explained Malwarebytes researcher Pieter Arntz (opens in new tab) in a blog post.

Zoom download for macs