111–120 of 473 posts
Earlier quoted context omitted.
Have your checked for similar vulnerabilities in competing products such as GoToMeeting and WebEx? They have the same basic features.
bluejeans video installs a nasty daemon that runs at boot too. I'll never attend a bluejeans meeting again
> This vulnerability leverages the amazingly simple Zoom feature where you can just send anyone a meeting link (for example https://zoom.us/j/492468757 ) and when they open that link in their browser their Zoom client is magically opened on their local machine. I was curious about how this amazing bit of functionality was implemented and how it had been implemented securely. Come to find out, it really hadn’t been im…
Once you deleted the localhost server they have running, they actually fallback to using the protocol.
> This vulnerability leverages the amazingly simple Zoom feature where you can just send anyone a meeting link (for example https://zoom.us/j/492468757 ) and when they open that link in their browser their Zoom client is magically opened on their local machine. I was curious about how this amazing bit of functionality was implemented and how it had been implemented securely. Come to find out, it really hadn’t been im…
Once you deleted the localhost server they have running, they actually fallback to using the protocol.
I'm trying to think of the real-world implications and how this would play out. Normally this would be pretty obvious, wouldn't it? Users would see Zoom open into some weird meeting, and close it. Presuming the exploit cannot avoid bringing the Zoom app to the foreground when it joins the meeting and activates the camera/mic. If it can do that and stay in the background, all bets are off. In spite of its obviousness,…
Maybe you could intentionally send this link to someone shown as inactive on Slack, and have the WSlack webpage preview thing run enough javascript to pop open Zoom with the camera and mic running...
I'd test it myself, but I deleted Zoom and the sneaky localhost web server while I read the article...
Earlier quoted context omitted.
Ah, yeah, the flow for when the app isn’t installed makes particular sense (at least as a motivation for why someone would implement something so awful). Thanks!
If you want to really break down their viewpoint on the situation, lets translate their PR statement line by line: > Zoom believes in giving our customers the power to choose how they want to Zoom. Zoom believes if their app isn't convenient to use, their customers have the power to leave their ass, as they are in an incredibly competitive market. > This includes whether they want a seamless experience in joining a m…
> This vulnerability leverages the amazingly simple Zoom feature where you can just send anyone a meeting link (for example https://zoom.us/j/492468757 ) and when they open that link in their browser their Zoom client is magically opened on their local machine. I was curious about how this amazing bit of functionality was implemented and how it had been implemented securely. Come to find out, it really hadn’t been im…
Once you deleted the localhost server they have running, they actually fallback to using the protocol.
Earlier quoted context omitted.
Have your checked for similar vulnerabilities in competing products such as GoToMeeting and WebEx? They have the same basic features.
RingCentral Meetings uses zoom.us engine but the local server runs on port 19424 instead. I'm able to replicate the issue on it. PoC: http://localhost:19424/launch?action=join&confno=3535353535
I was taken into Miguel's meeting, but since the host wasn't presented, it simply let me know it was waiting for him (It also had a friendly notice "Your video will turn ON automatically when the meeting starts".
I've changed my settings in Video > Meetings, just like in Zoom, to turn off my vid when joining. Also confirmed that the server is running on port 19424 (via terminal command 'lsof -i :19424').
Not sure I follow the CORS angle. The linked stackoverflow question mostly seemed to be someone who was confused about how CORS works, and the issue in the Google Chrome tracker was closed as WontFix because they couldn't reproduce it and said it should work. I'm nearly positive that CORS from localhost works OK. I set this up all the time for local development. For example, I run a client CRA app on localhost:3000 a…
http://williambert.online/2013/06/allow-cors-with-localhost-...
CORS is hard, I've struggled on it several times, and I'm not surprised an engineer gave up trying to fix it because of deadlines.