71–80 of 473 posts
Ok here's the thing. Open Google Hangouts, or any other website that asks for permission to use your webcam, then close the tab. Go to terminal check if VDCAssistant is running using `lsof | grep -i VDC` it returns that it is running. I've had this issue since 2015 so I'm glad someone is talking about this now.. Is it just me?
Note: "Zoom" is a videoconfrerencing app, not a built-in Mac OS accessibility feature for "zoom". The article does not clearly state this, ceding a plain English word to a corporation, enabling a takeover of human language. P.S.: This part > Apr 26, 2019 — Video call with Mozilla and Zoom Security Teams is funny, and would be way funnier if it was an non-consensual video call. Finally, note that Zoom effectively does…
Finally, note that Zoom effectively does not pay for bug bounties, so researchers should think twice about donating their expertise to a selfish for-profit corporation I've read this a few times and am curious if this has really become the prevailing view about what security researchers are doing (i.e., uncompensated labor) when they notify vendors about security vulnerabilities. The traditional view (which I think w…
Earlier quoted context omitted.
Really? That’s nuts. Makes you appreciate the iOS app model a bit more. Everything sandboxed, delete an app and all traces of it are gone.
macOS is gradually adopting that starting with Catalina, e.g. System Extensions (that will replace Kernel Extensions) and DriverKit drivers too I assume, are installed with app bundles and uninstalled when the app is trashed.
Earlier quoted context omitted.
> users should be informed right away so that they can take steps necessary to secure themselves For the record, this could be accomplished by a trustworthy source announcing "there is a critical vulnerability in Zoom's macOS software and you should uninstall it immediately pending vendor response". Some researchers do this already -- Tavis Ormandy has, for example. It's not a binary choice between no disclosure and…
Unfortunately in this case "uninstall it immediately" does not actually mitigate the vulnerability, since it will just reinstall itself if you come across a triggering link.
Hi I'm the author, AMA Or come hang out in the party chat! Use the exploit to join: https://jlleitschuh.org/zoom_vulnerability_poc/zoompwn_ifram...
Have your checked for similar vulnerabilities in competing products such as GoToMeeting and WebEx? They have the same basic features.
Why isn't zoom running fully in the web browser at this point? Meet does this, and as far as I can tell the quality is indistinguishable from Zoom. Can someone with a better understanding of the underlying protocols shed light on why Zoom continues to ship a separate desktop app?
macOS and iOS both support custom schemes, and have done forever. What feature does Zoom actually want?
Hi I'm the author, AMA Or come hang out in the party chat! Use the exploit to join: https://jlleitschuh.org/zoom_vulnerability_poc/zoompwn_ifram...
Have your checked for similar vulnerabilities in competing products such as GoToMeeting and WebEx? They have the same basic features.
PoC: http://localhost:19424/launch?action=join&confno=3535353535
Positively terrible... Kudos to this researcher. I liked Zoom when I used it a couple of times, but the reinstall “feature” is a huge violation of my trust. Software from the company behind it will not touch my system anymore. Too bad really, because properly working video chat is hard to find. The App Store model is not my favorite, but at times like these, a forced sandbox and inspection by a trusted third party st…
I don’t get Mozilla and Chromium’s responses. I can think of few cases in which a website should be allowed to issue requests (CORS, img, or otherwise) to an address on the local network and none whatsoever in which a website should be able to contact localhost. The fix seems straightforward. Require user permission to access the local network (subject to appropriate heuristics as to what “local” means). Require a co…
The problem with asking permission is dialog fatigue and similar. As far as supporting local content: Historically a lot of terrible (read: Enterprise, H&R Block tax software, etc) apps are glorified webpages, coupled with a local server that provides things like FS access and malware installation. Those apps use a kludge of remote and localhost urls, and generally expect to work. I suspect at this point though that…
It’s as much the fault of browsers for leaving the hole as Zoom for doing a shady job exploiting it.
Very disappointed at Mozilla for their meh response.