While attending the DEFCON 30 hacking and cybersecurity conference, CTIX analysts had the privilege of attending a talk given by macOS security researcher Patrick Wardle. The talk, titled “You’re Muted and Rooted,” detailed the successful exploitation of a macOS auto-update security vulnerability within the popular Zoom video conferencing application. Over the course of his talk, Wardle detailed how exploiting this flaw allowed him to abuse the Zoom installer to escalate his local privileges from a low-privileged user to root, ultimately taking full control of the target system. The flaw, tracked as CVE-2022-28756, affects Zoom Client for Meetings for macOS versions 5.7.3 to 5.11.4, and was mitigated on August 13, 2022. A few days later, another CVE was patched, tracked as CVE-2022-28757; this is the same exact flaw, but the patch for this vulnerability fixes version 5.11.5. This flaw exists even though manually installing or uninstalling the Zoom client requires a user password. This is due to the fact that the auto-update function bypasses the verification checker as root with a signed package called “Zoom Video … Certification Authority Apple Root CA.pkg”. After gaining initial access, attackers could exploit this flaw by giving the updater a file with the same naming convention as Zoom’s signed certificate, allowing it to bypass the verification checker. This means that attackers could potentially install any kind of malware, named in the correct certificate signing convention, and the compromised system would execute those files with root user privileges. Once the escalation of privileges attack is successful, threat actors could add, remove, or modify any files on the machine, as well as conduct follow-on malicious behavior. Since the beginning of the COVID-19 pandemic, Zoom’s popularity has grown exponentially, and thus has become a popular target for attacks. This flaw has been fixed by Zoom, and CTIX analysts recommend all macOS Zoom users ensure that their client is running the most recent secure version.