On Monday, July 8, 2019, Zoom released a response to a report in March 2019 where a security researcher notified Zoom of some concerns related to the Zoom meetings platform:
1. AUTO JOIN VIA ZOOM LOCAL WEB SERVER (MACS ONLY)
Zoom installs a local web server on Mac devices running the Zoom client. This is a workaround
to an architecture change introduced in Safari 12 that requires a user to accept launching
Zoom before every meeting. The local web server automatically accepts the peripheral access
on behalf of the user to avoid this extra click before joining a meeting. We feel that this is a
legitimate solution to a poor user experience, enabling our users to have seamless,
one-click-to-join meetings, which is our key product differentiator.
2. LOCAL DENIAL OF SERVICE VULNERABILITY (MACS ONLY)
The security researcher identified a local denial of service vulnerability. A hacker could have
potentially targeted a Mac user who already had the Zoom client installed with an endless loop
of meeting join requests, thereby causing the targeted machine to lock up. We have no
indication that this vulnerability was ever exploited and we released a fix for it in May 2019.
The following link details those concerns and Zoom's responses: https://wcupa.edu/infoServices/d2lServices/d2lFacultyStaffHelp/documents/ZoomResponseVideoOnVulnerability.pdf.
There are 2 steps that all users may want to consider:
1. Update to the latest version of Zoom (on all Operating Systems) when prompted by Zoom.
2. Use the settings options in Zoom to turn off your camera by default.
Please contact the Help Desk at 610-436-3350 if you have any questions.
