Zoom Client On Windows Exposes Windows Credentials To Attackers

Zoom Client On Windows Exposes Windows Credentials To Attackers | Ecency

Zoom has once again made it to the news owing to another privacy issue. As discovered, Zoom client on Windows exposes users’ Windows credentials to potential attackers via UNC links.

Zoom Client Exposes Windows Credentials

Bleeping Computer has recently revealed how Zoom client on Windows exposes credentials to an attacker.

As revealed, the problem exists because of messages with URLs or regular paths in the app convert into clickable links automatically in the Zoom app. While that helps a user in opening a link quickly in the browser, for non-URLs or Windows networking UNC paths, this leads to weird behavior. As explained by Lawrence Abrams,

If a user clicks on a UNC path link, Windows will attempt to connect to the remote site using the SMB file-sharing protocol to open the remote cat.jpg file.

While doing so, Windows also shares the users’ credentials (login name and NTLM password hash). Hence, an attacker may easily dehash the passwords using any tools such as Hashcat. With GPUs, such tools would not take long to crack the password hashes.

The bug first caught the attention of a security researcher with alias g0dmode on Twitter.

https://twitter.com/_g0dmode/status/1242131019026874369
- _g0dmode

Later, another researcher Matthew Hickey demonstrated the UNC injection in Zoom to capture NTLM password hashes.

https://twitter.com/hackerfantastic/status/1245133371262619654
- hackerfantastic

Such a UNC injection may also allow an attacker to execute arbitrary codes on the target device.

https://twitter.com/hackerfantastic/status/1245148192037011460
- hackerfantastic

Do This To Mitigate Until A Fix Is Available

For now, this remains an unpatched issue awaiting a fix from Zoom which should prevent the automatic conversion of UNC paths into clickable links. Though, Zoom has confirmed in a statement to Bleeping Computer that they are working on a fix.