Researchers found a way to hijack devices through Zoom screen sharing

Researchers from the digital defense firm A Security disclosed vulnerabilities in Zoom's video conferencing platform that could allow attackers to silently take over devices via screen sharing, affecting all supported operating systems. The bugs were found in early June using publicly available AI models with fewer than 20 prompts, and Zoom has begun rolling out fixes. A Security cofounder Omer Gull highlighted the democratization of such capabilities, noting that what once took a team months can now be achieved with minimal prompts.

As AI models gain advanced capabilities https://www.wired.com/story/anthropics-mythos-will-force-a-cybersecurity-reckoning-just-not-the-one-you-think/ to find vulnerabilities in software, develop ways to exploit them https://www.wired.com/story/openai-didnt-notice-its-ai-agents-using-a-message-board-to-plan-their-hacking-spree/ , and even carry out autonomous hacking sprees https://www.wired.com/story/openai-anthropic-ai-hacking-sprees-illegal/ , researchers offered a sobering new example on Tuesday, disclosing vulnerabilities https://a.security/blog/asecurity-zoomsday in the video conferencing platform Zoom that could have been exploited to take over targets’ devices. Anyone on a call that involved screen sharing, whether participants or the host, would have been vulnerable to a silent attack that could be carried out with no indication and no interaction from the victim. Researchers from the digital defense firm A Security say the bug https://www.zoom.com/en/trust/security-bulletin/zsb-26015/ was discovered in early June using publicly available AI models, and that it took fewer than 20 prompts to uncover the vulnerabilities and create a working attack. Zoom issued a security advisory on Tuesday, including details about fixes the company has already begun rolling out to address the flaws, which affected devices running all operating systems that Zoom supports—Windows, macOS, Linux, iOS, and Android. “What is interesting for us and what we believe is dangerous is the democratization of these capabilities—the barrier to entry is dropping rapidly,” A Security cofounder Omer Gull told WIRED ahead of the disclosure. “Before it would have taken a team of five people maybe six months with a lot of refining and iteration to find this. Now people can reach the same results with under 20 prompts. And Zoom is an important type of target because people assume trust when using it. They don’t see it as a threat.” The vulnerabilities were specifically in the protocol used to facilitate real-time annotation during screen sharing. The researchers say that their AI bug hunting systems specifically delved into this component because, like human bug hunters, they have been trained that convoluted and obscure functions often contain overlooked vulnerabilities. This is particularly true with proprietary, closed-source software. An established company like Zoom presumably does extensive code review and vetting on all components and functions, but without the benefit of public, open review, esoteric yet complex features like annotation are more likely to contain mistakes.