Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerability in the Mac Zoom client allows malicious websites to enable camera

medium.com

Post reply on HN
Print view View original

81–90 of 473 posts

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#81

Post by tlb »

keithwinstein wrote: post #47
gowld wrote: post #5

Note: "Zoom" is a videoconfrerencing app, not a built-in Mac OS accessibility feature for "zoom". The article does not clearly state this, ceding a plain English word to a corporation, enabling a takeover of human language. P.S.: This part > Apr 26, 2019 — Video call with Mozilla and Zoom Security Teams is funny, and would be way funnier if it was an non-consensual video call. Finally, note that Zoom effectively does…

Finally, note that Zoom effectively does not pay for bug bounties, so researchers should think twice about donating their expertise to a selfish for-profit corporation I've read this a few times and am curious if this has really become the prevailing view about what security researchers are doing (i.e., uncompensated labor) when they notify vendors about security vulnerabilities. The traditional view (which I think w…

I can't imagine selling bugs to the highest bidder ever becoming ethically acceptable. You can't pretend not to know that the high bidder is probably a cybercriminal. If you do this, your hat is clearly black.

Once upon a time, vulnerabilities were just nuisances and people could justify some gray-hat casuistry when the damage was just some sysadmin overtime to clean up. But now there are serious organized crime rings and rogue nation-states using vulnerabilities to steal and extort billions and ruin people's lives.

It's OK to choose not to work on products with no bug bounties, but if you do find a bug in one you must disclose it responsibly.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#82

Post by amluto »

olliej wrote: post #63
amluto wrote: post #53

I don’t get Mozilla and Chromium’s responses. I can think of few cases in which a website should be allowed to issue requests (CORS, img, or otherwise) to an address on the local network and none whatsoever in which a website should be able to contact localhost. The fix seems straightforward. Require user permission to access the local network (subject to appropriate heuristics as to what “local” means). Require a co…

The problem with asking permission is dialog fatigue and similar. As far as supporting local content: Historically a lot of terrible (read: Enterprise, H&R Block tax software, etc) apps are glorified webpages, coupled with a local server that provides things like FS access and malware installation. Those apps use a kludge of remote and localhost urls, and generally expect to work. I suspect at this point though that…

> The problem with asking permission is dialog fatigue and similar.

That’s why I suggested config option and permission. There’s no dialog fatigue if you never see the dialog.

That being said, there really ought to be a little menu of permissions that can be granted to a website such that the website cannot make it blink, flash, or otherwise draw attention to it. Crud like “allow push notifications” could go there. Granting push notification permission to a site is fine, but I don’t think sites should be able to ask for push notification permission.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#85

Post by bfdm »

keithwinstein wrote: post #47
gowld wrote: post #5

Note: "Zoom" is a videoconfrerencing app, not a built-in Mac OS accessibility feature for "zoom". The article does not clearly state this, ceding a plain English word to a corporation, enabling a takeover of human language. P.S.: This part > Apr 26, 2019 — Video call with Mozilla and Zoom Security Teams is funny, and would be way funnier if it was an non-consensual video call. Finally, note that Zoom effectively does…

Finally, note that Zoom effectively does not pay for bug bounties, so researchers should think twice about donating their expertise to a selfish for-profit corporation I've read this a few times and am curious if this has really become the prevailing view about what security researchers are doing (i.e., uncompensated labor) when they notify vendors about security vulnerabilities. The traditional view (which I think w…

Beyond just a prevailing "view", this duty to public safety is actually explicitly codified in the laws and regulations of most professional engineering organizations. To act otherwise would be a) unethical and subsequently b) grounds for loss of license to practice.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#87

Post by seandougall »

spaceribs wrote: post #39
seandougall wrote: post #26

> This vulnerability leverages the amazingly simple Zoom feature where you can just send anyone a meeting link (for example https://zoom.us/j/492468757 ) and when they open that link in their browser their Zoom client is magically opened on their local machine. I was curious about how this amazing bit of functionality was implemented and how it had been implemented securely. Come to find out, it really hadn’t been im…

A custom URI wouldn't work as seamlessly as zoom's UX team would have liked. If you hadn't installed zoom, either a nasty message would tell you the protocol wasn't supported, or it would redirect you to a google search. Their answer was to send people to a URL they controlled and brought you through the install process as easily as possible, but the issue they needed to solve was determining if you needed to have an…

Ah, yeah, the flow for when the app isn’t installed makes particular sense (at least as a motivation for why someone would implement something so awful). Thanks!

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#88

Post by tonymet »

I tested the repro-steps and found that the ZoomHelper was not listening, although it was installed . In this case i was prompted to download zoom.pkg rather than activate video.

I'm guessing it was because I have MacOS firewall = strict (no listening ports)

Also, here's a nice tip to show all listening apps (good habit while cleaning up)

  lsof -i -s tcp:listen |awk '{print $1 " "$8" " $9}'|sort|uniq
  COMMAND NODE NAME
  Google UDP *:mdns
  SystemUIS UDP *:*
  SystemUIS UDP *:53611
  UserEvent UDP *:*
  WiFiAgent UDP *:*
  identitys UDP *:*
  rapportd TCP *:49152
  rapportd UDP *:*
  sharingd UDP *:*

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#89

Post by dingo_bat »

georgewfraser wrote: post #50

Why isn't zoom running fully in the web browser at this point? Meet does this, and as far as I can tell the quality is indistinguishable from Zoom. Can someone with a better understanding of the underlying protocols shed light on why Zoom continues to ship a separate desktop app?

What's meet? A web search turns up nothing.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#90

Post by tzakrajs »

Jlleitschuh wrote: post #27

Hi I'm the author, AMA Or come hang out in the party chat! Use the exploit to join: https://jlleitschuh.org/zoom_vulnerability_poc/zoompwn_ifram...

Great chat, I think you were right when you said all vulnerabilities should have a video conference for Q&A after release. It was really helpful to get a better understanding of the platform and the threats facing it.
Post reply on HN