It's pretty convenient for Zoom that this occurs after the IPO.
Vulnerability in the Mac Zoom client allows malicious websites to enable camera
101–110 of 473 posts
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#102Positively terrible... Kudos to this researcher. I liked Zoom when I used it a couple of times, but the reinstall “feature” is a huge violation of my trust. Software from the company behind it will not touch my system anymore. Too bad really, because properly working video chat is hard to find. The App Store model is not my favorite, but at times like these, a forced sandbox and inspection by a trusted third party st…
If you had a sandbox, you wouldn't even need anyone to inspect it - since all the app's files would be contained in one place, uninstalling it would remove everything, and there wouldn't be a way to leave a server behind.
This just in: Bad behavior is still bad behavior when it's possible to mitigate it on the user side.
Consider how many people use Zoom and don't even know that Hacker News exists.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#103Why isn't zoom running fully in the web browser at this point? Meet does this, and as far as I can tell the quality is indistinguishable from Zoom. Can someone with a better understanding of the underlying protocols shed light on why Zoom continues to ship a separate desktop app?
You can do so much better using a native app than a webapp. UDP transport is really important for real-time communication.
Google meet uses UDP: https://support.google.com/a/answer/1279090?hl=en
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#104Hi I'm the author, AMA Or come hang out in the party chat! Use the exploit to join: https://jlleitschuh.org/zoom_vulnerability_poc/zoompwn_ifram...
If you want to see some part of this fixed, please UPVOTE this issue:
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#105Note: "Zoom" is a videoconfrerencing app, not a built-in Mac OS accessibility feature for "zoom". The article does not clearly state this, ceding a plain English word to a corporation, enabling a takeover of human language. P.S.: This part > Apr 26, 2019 — Video call with Mozilla and Zoom Security Teams is funny, and would be way funnier if it was an non-consensual video call. Finally, note that Zoom effectively does…
> The article does not clearly state this, ceding a plain English word to a corporation, enabling a takeover of human language.
English usually wins.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#106Earlier quoted context omitted.
The problem with asking permission is dialog fatigue and similar. As far as supporting local content: Historically a lot of terrible (read: Enterprise, H&R Block tax software, etc) apps are glorified webpages, coupled with a local server that provides things like FS access and malware installation. Those apps use a kludge of remote and localhost urls, and generally expect to work. I suspect at this point though that…
> The problem with asking permission is dialog fatigue and similar. That’s why I suggested config option and permission. There’s no dialog fatigue if you never see the dialog. That being said, there really ought to be a little menu of permissions that can be granted to a website such that the website cannot make it blink, flash, or otherwise draw attention to it. Crud like “allow push notifications” could go there. G…
In my experience if you tell users "to use this awesome thing, you need to enable this option", a reasonable portion will do it.
It sounds like what you're saying is that there should be a dialog, but only if you've already enabled a setting, which raises the question of "if this feature is so bad you don't want it exposed, why would you have it available at all?".
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#107Earlier quoted context omitted.
If you had a sandbox, you wouldn't even need anyone to inspect it - since all the app's files would be contained in one place, uninstalling it would remove everything, and there wouldn't be a way to leave a server behind.
This just in: Bad behavior is still bad behavior when it's possible to mitigate it on the user side. Consider how many people use Zoom and don't even know that Hacker News exists.
Right, I agree! My point is that preventing this situation from happening in the first place, through better sandboxing restrictions, is both more fair and more effective than having each app be individually approved. If you try to mitigate this just with app review, then 1) you're going to miss apps that do bad things, and 2) It introduces huge conflicts of interest for the reviewer. But if you were to have effective sandboxing, it wouldn't be possible for Zoom or any other app to do this in the first place, so that you would be able to trust the apps that you install even if they haven't been reviewed.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#108Note: "Zoom" is a videoconfrerencing app, not a built-in Mac OS accessibility feature for "zoom". The article does not clearly state this, ceding a plain English word to a corporation, enabling a takeover of human language. P.S.: This part > Apr 26, 2019 — Video call with Mozilla and Zoom Security Teams is funny, and would be way funnier if it was an non-consensual video call. Finally, note that Zoom effectively does…
Finally, note that Zoom effectively does not pay for bug bounties, so researchers should think twice about donating their expertise to a selfish for-profit corporation I've read this a few times and am curious if this has really become the prevailing view about what security researchers are doing (i.e., uncompensated labor) when they notify vendors about security vulnerabilities. The traditional view (which I think w…
I would say the 'first view' you've described is what the bulk of professionals in the information security industry would still espouse as the ideal.
In my opinion this second view you are observing is carried by a vocal minority of participants in bug bounty programs and would be good fodder for a computer-ethics course.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#109Earlier quoted context omitted.
Ah, yeah, the flow for when the app isn’t installed makes particular sense (at least as a motivation for why someone would implement something so awful). Thanks!
If you want to really break down their viewpoint on the situation, lets translate their PR statement line by line: > Zoom believes in giving our customers the power to choose how they want to Zoom. Zoom believes if their app isn't convenient to use, their customers have the power to leave their ass, as they are in an incredibly competitive market. > This includes whether they want a seamless experience in joining a m…
Oh come on. There is no easy way to send people without the app to a installer page, that is the issue. And that is something every single person wants.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#110Earlier quoted context omitted.
Have your checked for similar vulnerabilities in competing products such as GoToMeeting and WebEx? They have the same basic features.
bluejeans video installs a nasty daemon that runs at boot too. I'll never attend a bluejeans meeting again
Anyone know what port the Bluejeans server is running on and/or how to kill it in a manner similar to the Zoom workaround?