Exploiting the post-attendee URL feature in Zoom webinar to distribute malware

Area of Science:

• Cybersecurity
• Digital Forensics
• Information Security

Background:

• The Zoom post-attendee Uniform Resource Locator (URL) feature is an often-overlooked vulnerability.
• This feature can redirect webinar participants to any URL specified by the host.
• Malicious actors can exploit this to distribute malware or lead users to harmful websites.

Purpose of the Study:

• To demonstrate the exploitability of the Zoom post-attendee URL feature.
• To analyze the risk of malware transmission via this feature.
• To provide insights into preventing such attacks.

Main Methods:

• An experimental environment was created using four Windows 10 desktops with Zoom version 5.7.5.
• A webinar was set up with four user accounts acting as participants.
• The post-attendee URL was configured to redirect to a keylogger website and then to a direct download link for a .jpg file.

Main Results:

• All user accounts, regardless of role, were redirected to the post-attendee URL after joining the webinar.
• The exploit was successful in redirecting participants to both a malicious website and a file download link.
• The study confirmed the vulnerability of the post-attendee URL feature.

Conclusions:

• The post-attendee URL in Zoom presents a significant security risk for malware transmission.
• Webinar participants are vulnerable regardless of their user role.
• Awareness and preventative measures are crucial for mitigating this exploit.