Zero-Touch-Pwn: Abusing Zoom's Zero Touch Provisioning for Remote Attacks on Desk Phones
summary
Zoom zero touch provisioning plus an AudioCodes C450 reveal an exploit chain: an unauthenticated vendor redirect exposes config files, hardcoded crypto keys let encrypted credentials be decrypted, and firmware uses only a simple checksum so no firmware signature allows arbitrary images. Adding or bulk-importing MAC addresses into Zoom provisions devices to download attacker servers, yielding remote root shells, eavesdropping, call spoofing and lateral network pivoting. Zoom blocks foreign-firmware downloads; mutual TLS is optional and vendor fixes are partial.
AI-written summary · about
chapters (16)
- 0:00Zero-Touch-Pwn research intro
- 1:09Research motivation
- 3:15Zoom’s Zero Touch Provisioning
- 5:03Vendor redirect service analysis
- 7:11Hardcoded encryption keys
- 10:23Configuration encryption flaws
- 13:53Zoom’s mutual TLS auth
- 16:22Malicious config deployment
- 18:28Unauthenticated device enrollment
- 20:56Firmware verification bypass
- 22:42Exploit chain demo
- 24:09Scaling via CSV import
- 25:32Attack scenarios
- 26:36Vendor response and fixes
- 28:45Secure deployment recs
- 29:06Conclusion
related talks
37mCDPwn: Taking Over Millions of Enterprise-Things with Layer 2 Zero-Days
34mTowards Discovering Remote Code Execution Vulnerabilities in Apple FaceTime
42mDiscovering and Exploiting Novel Security Vulnerabilities in Apple ZeroConf
44mCritical Zero Days Remotely Compromise the Most Popular Real-Time OS
01h 02mVoIP Wars: Attack of the Cisco Phones
01h 09mThe Critical Path to Implant Backdoors and Potential Mitigation Techniques: Learnings from XZ...
45mOutside the box: pwning IoT devices through their applications
53mVoIP Wars: the Phreakers Awaken