# Zoom Zero Day: 4+ Million Webcams & maybe an RCE? Just get them to visit your website!

<https://medium.com/@jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5>

- Host: [medium.com](https://links.thingelstad.xyz/hosts/medium.com/)
- Saved: July 8, 2019 (2019-07-09T02:17:58Z)
- Record: https://links.thingelstad.xyz/links/7f093e076c4b/
- JSON: https://links.thingelstad.xyz/links/7f093e076c4b.json

## What Jamie wrote

Yikes.

> This vulnerability leverages the amazingly simple Zoom feature where you can just send anyone a meeting link (for example https://zoom.us/j/492468757) and when they open that link in their browser their Zoom client is magically opened on their local machine. I was curious about how this amazing bit of functionality was implemented and how it had been implemented securely. Come to find out, it really hadn’t been implemented securely. Nor can I figure out a good way to do this that doesn’t require an additional bit of user interaction to be secure.

🚨

[Response from Zoom](https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/).

And a [better response from the CEO of Zoom](https://blog.zoom.us/wordpress/2019/07/10/security-update-and-our-ongoing-efforts/).

## Facts

- Kind: [Page](https://links.thingelstad.xyz/kinds/page/)

## Same host

- [One-on-ones are my most valuable meetings; here’s how I run them](https://links.thingelstad.xyz/links/0354fe375437/) (medium.com, May 9, 2019)
- [The Time of Day Has a Significant Effect on Your Productivity](https://links.thingelstad.xyz/links/1cc6aeec0ab9/) (medium.com, May 14, 2019)
- [How Dark deploys code in 50ms - Darklang - Medium](https://links.thingelstad.xyz/links/28f230cef77b/) (medium.com, July 10, 2019)
- [How to Be a Better Writer - Better Humans - Medium](https://links.thingelstad.xyz/links/7491fc20d922/) (medium.com, July 30, 2019)
- [John Allspaw: “Getting the messy details is critical”](https://links.thingelstad.xyz/links/70621e613c9a/) (medium.com, August 6, 2019)

## Saved the same week

- [Cloudflare outage caused by bad software deploy (updated)](https://links.thingelstad.xyz/links/92b0238380a6/) (blog.cloudflare.com, July 8, 2019)
- [The hardest leadership advice to follow](https://links.thingelstad.xyz/links/6e2404e27c12/) (m.signalvnoise.com, July 8, 2019)
- [How can you improve your organization’s data strategy?](https://links.thingelstad.xyz/links/19f5ac4444f4/) (blog.google, July 8, 2019)
- [Homerun's guide to Diversity & Inclusion](https://links.thingelstad.xyz/links/db4c1c2fe7f4/) (artofwork.co, July 10, 2019)
- [USA 2019 Womens World Cup champions were unflappable, unequaled | SI.com](https://links.thingelstad.xyz/links/77eb6592ec58/) (si.com, July 10, 2019)

## Elsewhere

- Wayback Machine: https://web.archive.org/web/*/https://medium.com/@jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5