A Zoom Screen-Sharing Bug Let Anyone Take Over Other Devices on a Call

A severe security vulnerability has been identified in Zoom's screen-sharing functionality, enabling attackers to take over devices belonging to other participants on a call. According to reports from WIRED and 9to5Mac, the flaw allowed for the takeover of various hardware, specifically including Macs and iPhones. This vulnerability is categorized as a zero-click flaw, meaning it could be exploited without requiring any specific action or interaction from the victim during a meeting. The flaw facilitated remote code execution, or RCE, which granted attackers a high level of control over the targeted devices while they were active in a Zoom call. Coverage of the incident is widespread across multiple technology and security publications. SecurityWeek reports that Zoom has already issued patches to address the zero-click code execution vulnerability.

Meanwhile, CyberInsider emphasizes the nature of the flaw as an RCE attack vector that occurred during active meetings. The Verge has highlighted a specific aspect of the discovery, noting that the hack—which they refer to as the 'Zoomsday' hack—was uncovered using fewer than 20 AI prompts. These outlets collectively present the bug as a significant failure in the software's security architecture regarding how screen-sharing is handled. This incident is particularly noteworthy due to the 'zero-click' nature of the attack, which represents a higher tier of security risk than traditional phishing or social engineering. By allowing remote code execution, the bug bypassed typical user warnings or consent screens that usually accompany screen-sharing requests. The fact that iPhones and Macs were specifically mentioned by 9to5Mac indicates that the vulnerability crossed platform boundaries, affecting both desktop and mobile operating systems.

The context provided by The Verge regarding the use of AI prompts suggests that automated tools are becoming more efficient at discovering critical vulnerabilities in enterprise software. Moving forward, the primary focus for users is the deployment of the patches mentioned by SecurityWeek. Because the flaw allowed for the complete takeover of devices, organizations using Zoom for secure communications must ensure all client versions are updated. While the vulnerability has been patched, the details surrounding the 'Zoomsday' hack and the role of AI in its discovery remain key points of interest. Further updates will likely center on whether other similar zero-click flaws exist within the screen-sharing protocols of other video conferencing platforms, though current coverage is focused solely on the Zoom resolution.