AI-Driven Exploit Enables Device Takeover via Zoom Vulnerability

What happened

Researchers from A Security discovered a critical vulnerability in Zoom's screen-sharing annotation feature that could allow attackers to take complete control of a victim's device without any user interaction, such as clicking a link or downloading a file.

Using fewer than 20 prompts on publicly available AI models, the researchers identified and weaponized the flaw in less than 24 hours. The vulnerability involved memory corruption in the annotation resource, which Zoom processed automatically during screen-sharing sessions.

The flaw affected Zoom versions up to 7.0.5 across Windows, macOS, Linux, iPhone, and Android. Zoom has implemented patches to address the vulnerability.

Reported impact

A malicious participant could target the presenter, while a compromised presenter could reach other participants. The attack worked silently without alerting the victim.

Index analysis

The vulnerability's discovery demonstrates how AI tools can dramatically accelerate the identification and exploitation of security flaws. Tasks that historically required months of work by elite specialist teams were completed by the AI-assisted researchers in under 24 hours.

The speed and accessibility of this exploitation using publicly available AI models underscore concerns about lowering barriers to entry for potential attackers to develop exploits against widely-used software.

Classification

Organizations

Zoom (subject), A Security

Category

Security and cyberattacks

Industry

Digital security

Country

Brazil

Harm status

Potential harm

Intent

Unintentional

Timing

Post-deployment

Harmed

Consumers, Business

Consequences

None recorded

AI systems

Publicly available AI models

Sources and evidence