The Zoom client on Linux used to (?) have a nasty command injection. The URL for joining a meeting got passed to some bash reinvocation (so they could set the library path if my memory serves me). A specially crafted URL could execute commands on the system. I haven't been too interested in using Zoom since seeing that.
Vulnerability in the Mac Zoom client allows malicious websites to enable camera
21–30 of 473 posts
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#22Sooo... this is still vulnerable?!
Yes. Try this link from the article to see it in action if you have (or had) Zoom installed: https://jlleitschuh.org/zoom_vulnerability_poc/ WARNING, this will open a video chat with random strangers, and will turn your webcam on. Consider yourself warned!
If you want to test it without using your real webcam, I recommend CamTwist [1]. The author is in the group video call now. I joined for a short minute, and was relieved to see that my real webcam wasn't being used.
Normally I use CamTwist so I can write subtitles on top of my video feed when chatting with my gran. It seems it's also a good layer of extra security!
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#23Note: "Zoom" is a videoconfrerencing app, not a built-in Mac OS accessibility feature for "zoom". The article does not clearly state this, ceding a plain English word to a corporation, enabling a takeover of human language. P.S.: This part > Apr 26, 2019 — Video call with Mozilla and Zoom Security Teams is funny, and would be way funnier if it was an non-consensual video call. Finally, note that Zoom effectively does…
>The article does not clearly state this, ceding a plain English word to a corporation, enabling a takeover of human language. I agree with your outrage, but you have a long way to go. That sort of behavior is the soup du jour of SV the past ten years or so. Keep fighting the good fight. I've given up, but I hope you win.
10 years is nothing on the scale of language development, and SV is nothing on the scale of the English-speaking world :) Fear not, I bet there aren't enough words to go around for this to be a big deal long-term.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#24Earlier quoted context omitted.
> In our Zoom clients, we both already had the “Turn off my video when joining a meeting” box checked. I believe this is one of the mitigations, which is why it didn’t work.
That makes sense. But, I don’t remember ever turning on that checkbox.
This is the issue. It’s on by default.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#25How to protect yourself: "Disable the ability for Zoom to turn on your webcam when joining a meeting." It's under Settings->Video in Zoom, check "Turn off my video when joining a meeting".
What if you have uninstalled Zoom? It seems that it leaves a web server on your machine that will re-install Zoom if it receives a request to join a meeting.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#26> This vulnerability leverages the amazingly simple Zoom feature where you can just send anyone a meeting link (for example https://zoom.us/j/492468757) and when they open that link in their browser their Zoom client is magically opened on their local machine. I was curious about how this amazing bit of functionality was implemented and how it had been implemented securely. Come to find out, it really hadn’t been implemented securely. Nor can I figure out a good way to do this that doesn’t require an additional bit of user interaction to be secure.
Does anybody understand (and have a moment to explain) why the author says this is difficult to do securely? macOS has a simple facility for handling custom URL schemes, so my impulse would be to have `https://zoom.us/j/492468757` do a server-side redirect to a URL like, say, `zoomus://492468757`, which would launch Zoom locally using the OS's built-in services. This wouldn't require a third-party daemon of any sort, and would just be a regular application that the user could trivially uninstall.
Is there a security hole there that I'm missing? Or have I misunderstood the author's point?
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#27Hi I'm the author, AMA
Or come hang out in the party chat!
Use the exploit to join: https://jlleitschuh.org/zoom_vulnerability_poc/zoompwn_ifram...
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#28Note: "Zoom" is a videoconfrerencing app, not a built-in Mac OS accessibility feature for "zoom". The article does not clearly state this, ceding a plain English word to a corporation, enabling a takeover of human language. P.S.: This part > Apr 26, 2019 — Video call with Mozilla and Zoom Security Teams is funny, and would be way funnier if it was an non-consensual video call. Finally, note that Zoom effectively does…
> Offered and declined a financial bounty for the report due to policy on not being able to publicly disclose even after the vulnerability was patched.
They seem to pay bug bounties if you agree to keep it down.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#29How to protect yourself: "Disable the ability for Zoom to turn on your webcam when joining a meeting." It's under Settings->Video in Zoom, check "Turn off my video when joining a meeting".
What if you have uninstalled Zoom? It seems that it leaves a web server on your machine that will re-install Zoom if it receives a request to join a meeting.
Really? That’s nuts. Makes you appreciate the iOS app model a bit more.
Everything sandboxed, delete an app and all traces of it are gone.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#30> This vulnerability leverages the amazingly simple Zoom feature where you can just send anyone a meeting link (for example https://zoom.us/j/492468757 ) and when they open that link in their browser their Zoom client is magically opened on their local machine. I was curious about how this amazing bit of functionality was implemented and how it had been implemented securely. Come to find out, it really hadn’t been im…
below down the post, zoom team said that this feat exists because Safari doesn’t have custom url scheme.