Abstract:
The latest version of the client for the Linux desktop operating system owned by the video conferencing giant Zoom has been exposed by the open source security community as having serious privacy breach risks. According to in-depth testing and analysis by open source security researchers and multiple Linux users,
when the latest version of the Zoom application is running in the background, it will continuously and covertly poll and read sensitive content in the system clipboard without any user authorization or active pasting interaction, triggering widespread concerns among developers and enterprise-level security compliance groups.
This abnormal behavior was first discovered by open source community users accidentally when troubleshooting system resource scheduling and interface call logs. According to technical evidence disclosed by network and security experts, under the X11 display server environment (and some Wayland compatibility layers that do not impose strict sandbox restrictions on clipboard isolation), regardless of whether Zoom is minimized, resides in the background, or is idle during meetings, its main process will frequently trigger system clipboard API calls. This means that extremely sensitive text data such as account passwords, two-factor authentication (2FA) recovery keys, private communication records and even business secret codes that users copy in browsers, local text editors or even password managers will be silently captured by the Zoom client background within milliseconds as long as they enter the system clipboard.
This phenomenon triggered a fierce backlash in the open source security and technology community. As we all know, the clipboard, as the core temporary transfer station for information exchange in desktop operating systems, has always been a target of malware and spy tools. However, as a professional collaboration software frequently used by tens of millions of enterprises and developers around the world, without providing any clear foreground operation trigger (such as the user actively clicking the "Paste in chat window" shortcut key), the application itself "swallows" the system clipboard in the background without restraint, seriously violating the principle of minimizing permissions and the bottom line of privacy compliance of modern operating systems.
Technical analysts speculate that this may not be a malicious spy backdoor actively implanted by Zoom, but more likely an extremely crude software development engineering error. For example, when trying to introduce "intelligent recognition of meeting links in the clipboard and pop-up prompts to join", "automatic formatting of rich text to be sent" or optimizing third-party cross-platform interface frameworks (such as Qt or Electron bottom hooks), the development team may have adopted an inefficient and dangerous logic implementation of endless polling (Polling) around the clock, resulting in the entire clipboard data being continuously called without protection. However, regardless of the original design intention behind it, the fact that silent reading is unencrypted, undesensitized and unauthorized puts users' sensitive credentials at extremely high risk of data exposure.
Security experts strongly recommend that before Zoom officially releases an official patch, affected users on the Linux platform should avoid handling high-risk sensitive text and passwords on systems running Zoom as much as possible; at the same time, technical users are advised to switch to clipboard isolation requirements A more rigorous pure Wayland synthesizer environment, using sandbox isolation tools such as Firejail to strictly block Zoom's read permission to the clipboard bus, or temporarily switching to running Zoom meetings through the web side of mainstream browsers to minimize potential information leakage hazards. As of now, Zoom officials have not yet given a formal public response on the cause of the vulnerability, the specific version range affected, and the push schedule for the official fix patch.
Comments