Zoom Critical Vulnerability Discovered

There is good news and bad news regarding a recent vulnerability discovered in the popular Zoom online conferencing tool. The bad news is researchers were able to identify and exploit a chain of 3 different vulnerabilities that allowed them to run code remotely on the victim's systems, including both Windows and Mac application versions. And this was done without any involvement from the target. So they didn't require the end user to be duped into clicking on something or installing something. The exploit worked as long as the Zoom application was running on the targeted system. Now, allowing complete remote control from an attacker, well, that's about as bad as a vulnerability can get. Now, the good news here is this discovery was part of a hosted ethical security research event where participants compete to find weaknesses for rewards and, well, sometimes fame. Companies are then provided the details in secret so that they can patch their products, and that helps everyone. Now, in this case, two researchers earned a $200,000 $100,000 reward for their Zoom discovery. And I'm actually gonna put their names right here because, well, I'm sure I won't pronounce them correctly. But my congratulations to them both on a job well done. Now, although vulnerabilities— these vulnerabilities are not patched yet, expect them to be closed before really any malicious threat actors get a chance to use them and do any harm. Traditionally, companies are given a 90-day window to produce and deploy patches for responsibly reported vulnerabilities. Zoom has already thanked the researchers for their findings and indicated that they are working on a mitigation. So it's good news for everybody, all those Zoom users out there, myself included. Now overall, this is a the way vulnerabilities should be found and reported responsibly. Companies that sponsor, support, participate in external research events are leveraging some of the best talent to find previously unknown weaknesses in their product, the ones that slip through the quality assurance checks before they were released. And researchers, well, they get financial rewards out of this, sometimes called bounties, and often recognized publicly for their skills and their beneficial contributions in making the products that we all use more safe. Now, this was not always the case. There was a time not that long ago that most companies absolutely refused to admit any vulnerabilities in their products and often threatened to sue any researchers who responsibly reported the issues to them. In fact, it was very difficult for, um, you know, vulnerability researchers to even reach out and connect with many companies. They didn't put numbers or email addresses or anything like that so that they even could report these issues. And rarely in those cases were there financial incentives except for the black market. You see, vulnerabilities like this have always been sought after by, well, nefarious groups, and unethical hackers could easily get rich selling it to such entities for their malicious exploitation. But for the ethical researchers, they really had no way to financially benefit from their attempts to help products close vulnerabilities. So this has been a positive change over the past several years. And as an industry, we really have come a long way. I've been a longtime supporter of bug bounties for this very reason. So great job to the security researchers and to Zoom. This is how the industry can work together to make digital technology and services more trustworthy.