Hackers can hijack your Mac webcam with Zoom. Here’s how to prevent it.

If you have a Mac and you have ever used Zoom video conferencing, you might have a problem — though as of Thursday both Zoom and Apple say they’re fixing it.

On Monday, security researcher Jonathan Leitschuh publicly disclosed a vulnerability in the video-conferencing program Zoom that apparently would allow someone to turn on your Mac’s webcam and force you to join a Zoom call without your permission. In a Medium post, Leitschuh said he initially disclosed the vulnerability to Zoom on March 26, 2019, but the company still failed to resolve it beyond an initial fix he’d first suggested.

Here is, basically, what Leitschuh uncovered:

This vulnerability allows any website to forcibly join a user to a Zoom call, with their video camera activated, without the user’s permission.

On top of this, this vulnerability would have allowed any webpage to DOS (Denial of Service) a Mac by repeatedly joining a user to an invalid call.

Additionally, if you’ve ever installed the Zoom client and then uninstalled it, you still have a localhost web server on your machine that will happily re-install the Zoom client for you, without requiring any user interaction on your behalf besides visiting a webpage. This re-install ‘feature’ continues to work to this day.

In other words, if you have Zoom installed on your Mac — or if you ever had it — a website could spy on you or undertake a denial of service (DoS) attack, where a bad actor could basically hit a user with a barrage of meeting requests and lock up his or her computer. As The Verge explains it, the Zoom app “installs a web server on Macs that accepts requests regular browsers wouldn’t.”

On Monday, people started to try out the vulnerability … and it worked.

Leitschuh said that when he initially flagged the vulnerability, Zoom defended itself by implying it wanted customers to be able to choose to join a meeting with their microphone and video automatically enabled. But if someone doesn’t get the option to join the meeting in the first place, that’s not much of a choice. According to Leitschuh, Zoom made attempts to patch the vulnerability by preventing an attacker from turning on a video camera, but he was able to discover workarounds that would permit an attacker to force a target to join a call and activate their webcam.

This is a big deal: The flaw could expose up to 750,000 companies and the millions of people who use Zoom.

In response to a request for comment on Monday, Zoom initially pointed Recode to a blog post from the company’s chief information security officer Richard Farley, in which he disputed some of Leitschuh’s claims and downplays the severity of the vulnerability. But in a separate post on Wednesday, Zoom founder and CEO Eric Yuan said the company had “misjudged the situation” and failed to act quickly enough. He said that on Tuesday, Zoom had updated its Mac app to remove the local web server and allow users to manually uninstall Zoom, and on Wednesday, Apple itself issued an update to remove the Zoom web server from all Macs. Yuan said Zoom has a “planned release” for the weekend that will “address video on by default.” Basically, when you use Zoom for the first time, you can select to always turn our video off, and that will be the saved preference.

Farley on Monday explained how this happened in the first place: Zoom said it developed a local web server as a “workaround” after Apple changed its Safari web browser to require users to confirm they wanted to join video calls before launching them. He defended the decision as a “legitimate solution to a poor user experience, enabling our users to have seamless, one-click-to-join-meetings, which is our key product differentiator.”

Yuan said that to make sure something like this doesn’t happen again, that within the next few weeks it will go live with a program for the public to disclose system vulnerabilities and the company will take steps to improve its escalation process when issues are uncovered.

Judging by the way users reacted to the initial news of the flaw, Zoom has some work to do to regain confidence:

What to do about Zoom

Leitschuh outlined how to patch the vulnerability in his Medium post. Basically, you can disable by default Zoom’s ability to turn on your webcam when you join a meeting. He also laid out some terminal commands at the bottom of the post and explained how to test whether your fix is working.

Zoom, which was founded in 2011, went public in April — after Leitschuh first flagged this flaw. The company beat estimates during its first quarterly earnings report as a public company in June and has been among the best-performing tech IPOs of the year. It’s not yet clear how this vulnerability will affect its business overall. The company’s stock price fell by about 1 percent on Tuesday but has since rebounded.

Recode and Vox have joined forces to uncover and explain how our digital world is changing — and changing us. Subscribe to Recode podcasts to hear Kara Swisher and Peter Kafka lead the tough conversations the technology industry needs today.

We're here to shed some clarity

One of our core beliefs here at Vox is that everyone needs and deserves access to the information that helps them understand the world, regardless of whether they can pay for a subscription. With the 2024 election on the horizon, more people are turning to us for clear and balanced explanations of the issues and policies at stake. We’re so grateful that we’re on track to hit 85,000 contributions to the Vox Contributions program before the end of the year, which in turn helps us keep this work free. We need to add 2,500 contributions this month to hit that goal. Will you make a contribution today to help us hit this goal and support our policy coverage? Any amount helps.

One-Time Monthly Annual

$5/month

$10/month

$25/month

$50/month

Other

$

Yes, I'll give $5/month

Yes, I'll give $5/month

We accept credit card, Apple Pay, and Google Pay. You can also contribute via