The Hacker who could turn on ANYONE'S Zoom Camera [Zero-Day]

In this video, we take a deep dive into a high severity Zoom SQL injection vulnerability, which allowed attackers to enable a victims webcam and microphone without their permission. This vulnerability was exploited by taking advantage of dependencies between back-end systems and the SQLite database engine. Whether you're a pen tester, security researcher, or cyber security expert, having a solid foundation in character encoding schemes, especially when it comes to SQL, is critical.

0:00 - Overview
1:06- Reverse Engineering
4:40- SQLite
5:32 - Attack Vector
8:27 - Encoding (ASCII, Unicode, UTF-8)
11:45 - Exploit

Original report by Keegan Ryan

MUSIC CREDITS:
LEMMiNO - Cipher
CC BY-SA 4.0

LEMMiNO - Firecracker
CC BY-SA 4.0

LEMMiNO - Nocturnal
CC BY-SA 4.0

LEMMiNO - Siberian
CC BY-SA 4.0

#programming #software #softwareengineering #computerscience #code #programminglanguage #softwaredevelopment #hacking #hack #cybersecurity #exploit #tracking #softwareengineer #vulnerability #pentesting #privacy #spyware #malware #cyber #cyberattack #bugbounties #ethicalhacking #lowlevelsecurity #zeroday #zeroday #cybersecurityexplained #bugbounty #SQL #injection #SQLinjection #unicode #ASCII #UTF8 #encoding #breach #SQLbreach #SQLite #databaseinjection #Zoom #Linux #localSQL

[chriss]

Classic SQL injection and a nice explanation to go with it!
Text encoding was def not the first thing on my mind when thinking about possible escapes, and I guess it wasn't on the mind of the person that tried to manually sanitize SQL input either!

[capability-snob]

We tend not to ship debug symbols by default with open source programs either - they tend to be much larger than the compiled program itself.

[eyephpmyadmin]

"Cant read the source code" Ghidra has entered the chat

[amaankhan]

Criminally underrated channel. Keep up the good work man you'll make it big

[bthrkay]

Wow! Very well explained, thank you!
EDIT: my only complaint is the title. It's makes it look like a recent exploit, which is clickbaity and not very nice. I don't think you need to resort to that. 🙂

[xgordo]

Great video! That explanation of unicode was perfect.

[nournote]

Very well explained. Lots of small things to learn, not only a story telling content. Just keep up.
Subscribed.

[ghstmnstr]

Oh my goodness. This is such fantastic knowledge. You explain things phenomenally. Thanks so much.

[junosoft]

Seems very well explained. Still didn't finish the video, but so far so good. Keep it up

[mrt_]

4:33 and if you want it be more of a hell for people who want to reverse engineer your stuff, you can tell the compiler to generate a stripped binary.
On Linux you can do this using the "strip" command. You could use it like this "strip binary -o stripped_binary"
or you can do it with the "-s" flag if you are using GCC.

[cancerino]

Why a new company like Zoom decided to use SQL with all of it's string-based vulnerabilities baffles me.

[ByronShingo]

Another eloquent description of a fascinating piece of software security history, brilliant as always.

[dcquence]

Very interesting. I cannot get over the upward inflection on every sentence though

[Impracticallypractical]

Great video! Well explained! Only correction is that SQL doesn’t use `//` for comments. It uses `--`.

[whoman]

I honestly thought I was watching from a big channel, your so underrated, keep it going!

[mbhv-lllq]

How do you not have more than million subscribers? What. you deserve more. keep up the great work!

[thisismygascan]

is there any reason zoom would have decided to manually implement the input sanitization

[vanzylv]

Very interesting and technically informative. You have a elegant way of explaining things. Thanks!

[Jiyoon]

Wow... Vulnerabilities like this one convince just how important it is to implement a web-cam cover and a physical mic on/off togle, just for a percussion. A simple step like that goes quite a long way, it seems.

[altaccount]

jokes on you i don't have a camera