Hacking Zoom: a Hacker's Journey into Zoom Security by Mazin Ahmed

Security researcher and FullHunt founder Mazin Ahmed details his vulnerability research into the Zoom desktop application and cloud infrastructure during the early months of the remote work surge [00:01]. Ahmed describes using FullHunt asset discovery APIs to map Zoom's external attack surface, enumerating over 3,000 subdomains, legacy staging servers, and exposed API gateways [08:42].

The presentation explores multiple vulnerability classes uncovered across Zoom's client and server ecosystem. Ahmed explains a remote memory leak vulnerability in Zoom's production web servers during image conversion, where uninitialized memory buffers in image palettes leaked fragments of server heap memory to unauthenticated users [17:47]. Moving to client-side analysis, he demonstrates how the Zoom desktop client stored meeting chat logs, direct messages, and credentials in unencrypted local SQLite databases and logs at rest, allowing any local process to harvest confidential communications [37:36].

Ahmed also reviews network communication security, analyzing local loopback daemons and TLS interception mechanisms [27:51]. He reflects on the responsible disclosure process with Zoom's engineering team and discusses how the platform subsequently modernized its security architecture, improved client encryption, and established a formalized bug bounty program [46:38].

(AI summary — Gemini Flash)