Have you ever used Zoom for video conferencing? If you have, you may want to read this because the websites you visit could start filming you without your knowledge on both Mac and Windows.
Zoom’s problems used to be isolated to macOS, but reports indicate that Windows is susceptible, too. If you have Zoom set to turn your camera on by default in meetings, all someone has to do is embed a Zoom link and they can immediately start recording you – on both Mac and Windows.
RELATED STORY:
Zoom, however, is adamant that this has never happened. In fact, the company says this is a feature of Zoom, and that you’ve given the ok for the recording to happen if your Zoom client is set to automatically turn your webcam on when you join a meeting.
Jonathan Leitschuh’s proof of concept website lists how the filming can happen:
If you have Zoom software installed and go to the website, the Zoom software will launch and automatically join the meeting and start recording with your webcam. When using macOS, it will happen even if you previously uninstalled Zoom, because of a secret web server Zoom leaves running after it is uninstalled. But, even on Windows, Zoom will launch if you currently have it installed.
On the first visit to the website, you’ll be prompted to open the Zoom app—assuming you don’t have Zoom installed. If you check “Always open these types of links in the associated app,” you’re in trouble. That’s a box nearly anyone would check to skip extra clicking in the future.
The next time we visited the website, Zoom automatically opened, connected us to the meeting, and started our webcam. We didn’t click any prompts or give any approval. With no interaction on your part, as long as you have Zoom installed, malicious sites could easily record you.
You can see the Zoom window and it’s clear you’re being recorded. Nonetheless, a malicious website could easily capture a video of you before you ended the video conference.1
RELATED STORY:
This is a huge and critical issue. Leitschuh suggests that Zoom is uninstalled if you don’t use it often. If you need it installed, you can also select the “Turn my video off when joining meeting” option on the “Video” tab in Zoom’s settings window to keep this from happening. On macOS, remember to check for the web server and uninstall it too.
RELATED STORY:
Zoom’s official response to the situation suggests the company considers this a feature and not a problem. We hope Zoom understands the full severity of the issue soon and decides to fix it.
