Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerability in the Mac Zoom client allows malicious websites to enable camera

medium.com

Post reply on HN
Print view View original

51–60 of 473 posts

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#51

Post by kevinchen »

tuananh wrote: post #30
seandougall wrote: post #26

> This vulnerability leverages the amazingly simple Zoom feature where you can just send anyone a meeting link (for example https://zoom.us/j/492468757 ) and when they open that link in their browser their Zoom client is magically opened on their local machine. I was curious about how this amazing bit of functionality was implemented and how it had been implemented securely. Come to find out, it really hadn’t been im…

below down the post, zoom team said that this feat exists because Safari doesn’t have custom url scheme.

When I clicked the PoC link in Safari, it launched the Zoom app using a URL scheme. ("open in ...?" dialog put up by Safari)

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#52

Post by alkhatib »

seandougall wrote: post #26

> This vulnerability leverages the amazingly simple Zoom feature where you can just send anyone a meeting link (for example https://zoom.us/j/492468757 ) and when they open that link in their browser their Zoom client is magically opened on their local machine. I was curious about how this amazing bit of functionality was implemented and how it had been implemented securely. Come to find out, it really hadn’t been im…

Once you deleted the localhost server they have running, they actually fallback to using the protocol.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#53

Post by amluto »

I don’t get Mozilla and Chromium’s responses. I can think of few cases in which a website should be allowed to issue requests (CORS, img, or otherwise) to an address on the local network and none whatsoever in which a website should be able to contact localhost.

The fix seems straightforward. Require user permission to access the local network (subject to appropriate heuristics as to what “local” means). Require a config option and user permission to access localhost. Problem solved.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#54

Post by rrdharan »

CaliforniaKarl wrote: post #31
eeeeeeeeeeeee wrote: post #24

Earlier quoted context omitted.

This is the issue. It’s on by default.

I’m sorry, I am really confused. The box says “Turn off my video...”. So, I think having it on by default is a good thing.

The default is that the box is unchecked - i.e. the Zoom client will, by default, automatically turn on your camera when you join a meeting. You can opt out of that behavior by checking this box, but that behavior is the default.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#55

Post by jwdavidson »

cjbprime wrote: post #48
autoexec wrote: post #8

Earlier quoted context omitted.

I guess this depends on your definition of responsible. Something like this however is bad enough that users should be informed right away so that they can take steps necessary to secure themselves. Assuming they were responsive I'd have given them the 10 days to confirm it was an actual issue, but I'd have expected them to notify the pubic and their users of the issue and mitigation steps within a week.

> users should be informed right away so that they can take steps necessary to secure themselves For the record, this could be accomplished by a trustworthy source announcing "there is a critical vulnerability in Zoom's macOS software and you should uninstall it immediately pending vendor response". Some researchers do this already -- Tavis Ormandy has, for example. It's not a binary choice between no disclosure and…

Unfortunately in this case "uninstall it immediately" does not actually mitigate the vulnerability, since it will just reinstall itself if you come across a triggering link.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#56

Post by olliej »

olliej wrote: post #36

Note that the server persists after the app is removed, so there’s that as well. Follow on: What are they talking about regarding custom url handlers? That’s a standard OS X feature...

Ok, so the article says

"According to the Zoom team, the only reason this localhost server continues to exist is that Apple’s Safari doesn’t support URI handlers."

Which is simply wrong. macOS (and i*OS) have supported custom URIs forever. What feature are they wanting? Do they want random websites to be able to install URI handlers?

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#58

Post by upofadown »

>" rel="nofollow">http://localhost:xxxxx/launch?action=join&confno=492468757"/...

So a browser allows a random remote website access to stuff running on the localhost interface? Is this a good idea? Stuff like camera access I can at least disable...

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#59

Post by nradov »

Jlleitschuh wrote: post #27

Hi I'm the author, AMA Or come hang out in the party chat! Use the exploit to join: https://jlleitschuh.org/zoom_vulnerability_poc/zoompwn_ifram...

Have your checked for similar vulnerabilities in competing products such as GoToMeeting and WebEx? They have the same basic features.
Post reply on HN