Organizer
Partner Company
Hacking Zoom and other XMPP applications: More Adventures with XMPP Stanza Smuggling
Ivan Fratric
Google Project Zero
Abstract
XMPP is an instant messaging protocol used in messenger apps, online games, industrial and other applications. This talk describes XMPP stanza smuggling, a new way of attacking XMPP client software using subtle quirks in XML parsing. A zero click remote code execution exploit against Zoom client will be demonstrated. This is an updated version of the talk I gave at Black Hat USA on this topic. It will showcase additional bugs and techniques, including how the attack on Zoom and others could be performed even without the victim accepting the attacker's contact request.
Speaker Info
Ivan Fratric is a security researcher at Google Project Zero, where he currently focuses on browser security, remote attack surfaces in applications and fuzzing. Previously, he worked on the Google Security Team and, before that, at the University of Zagreb where he received his PhD. He has been publishing security research for over a decade and is the author of multiple open-source security tools.