Zoom installer for macOS has a security flaw granting elevated system privileges

The macOS version of Zoom, particularly its installer, exposes Apple computers and laptops to a serious security vulnerability. If exploited correctly, the bug which exists in the setup for the Zoom application can grant an attacker complete control of a Mac PC. It is concerning to note that Zoom tried to patch the setup, but hasn’t fully succeeded to patch the flaw.

Mac security specialist Patrick Wardle presented his observations about the security flaw at the Def Con hacking conference in Las Vegas on Friday. While Zoom has fixed some of the bugs, Wardle was able to successfully prove one unpatched vulnerability that still affects macOS.

It is interesting to note that Apple mandates a user or owner installing any software to enter their login password. However, Wardle discovered an auto-update function, which he was able to keep running in the background with superuser privileges.

A potential attacker is able to execute the vulnerability simply because the installer for Zoom needs to run with special user permissions. The special case exists during the installation and removal of the Zoom application on a computer running macOS.

During every installation process, the updater function checks if the installer has been cryptographically signed by Zoom. However, a bug in the checking method granted elevated privileges to any file with the same name as Zoom’s signing certificate.

Simply put, an attacker could potentially run any kind of malware program. This is a privilege escalation attack, and it typically begins inside an account that has restricted system-level access. The Zoom installer bug essentially granted an attacker “SuperUser” or “ROOT” access.

Wardle is the founder of the Objective-See Foundation. He followed proper disclosure protocols while alerting Zoom about the bug. Wardle even offered a way to fix the flaw. This was back in December 2021.

According to Wardle, Zoom patched the flaw a few weeks before the Def Con event. However, the bug was still exploitable. Although Zoom altered the way the installer operates, an attacker can still add, remove, or modify files way beyond an ordinary account’s access level.

Source: The Verge