Zoom allow iframing the join page as well? Why are they not seeing X-Frame-Options‽
Vulnerability in the Mac Zoom client allows malicious websites to enable camera
121–130 of 473 posts
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#122Earlier quoted context omitted.
If you want to really break down their viewpoint on the situation, lets translate their PR statement line by line: > Zoom believes in giving our customers the power to choose how they want to Zoom. Zoom believes if their app isn't convenient to use, their customers have the power to leave their ass, as they are in an incredibly competitive market. > This includes whether they want a seamless experience in joining a m…
I'm unclear what subset of users are desktop only Zoom users that aren't also familiar with the same "Do you want to allow this app to access your camera/microphone?" dialogs on mobile devices. This can't be a large demographic, can it?
Ah, but that's an interesting question right? do they WANT to be asked? If you only had to make one click to join a meeting, doesn't that FEEL better?
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#123Note: "Zoom" is a videoconfrerencing app, not a built-in Mac OS accessibility feature for "zoom". The article does not clearly state this, ceding a plain English word to a corporation, enabling a takeover of human language. P.S.: This part > Apr 26, 2019 — Video call with Mozilla and Zoom Security Teams is funny, and would be way funnier if it was an non-consensual video call. Finally, note that Zoom effectively does…
Finally, note that Zoom effectively does not pay for bug bounties, so researchers should think twice about donating their expertise to a selfish for-profit corporation I've read this a few times and am curious if this has really become the prevailing view about what security researchers are doing (i.e., uncompensated labor) when they notify vendors about security vulnerabilities. The traditional view (which I think w…
The first view meets some sort of ideal (I guess) but causes all sorts of free riding problems. In larger society these sorts of problems are solved through regulations. For example if someone identifies a structural vulnerability in a bridge, the agency in charge of the bridge has a legal obligation to take steps to fix it. That sort of regulation doesn't exist in software land.
The second view as you describe it (selling to the highest bidder) is clearly black hat, but it is completely ethical for a researcher to disclose a vulnerability to the public if the vendor doesn't fix it in a reasonable amount of time. So Project Zero and this disclosure are both fine. Yes, ordinary users may be harmed in the crossfire, but the vendor should be liable for damages.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#124I'm trying to think of the real-world implications and how this would play out. Normally this would be pretty obvious, wouldn't it? Users would see Zoom open into some weird meeting, and close it. Presuming the exploit cannot avoid bringing the Zoom app to the foreground when it joins the meeting and activates the camera/mic. If it can do that and stay in the background, all bets are off. In spite of its obviousness,…
[deleted]
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#125Earlier quoted context omitted.
The problem with asking permission is dialog fatigue and similar. As far as supporting local content: Historically a lot of terrible (read: Enterprise, H&R Block tax software, etc) apps are glorified webpages, coupled with a local server that provides things like FS access and malware installation. Those apps use a kludge of remote and localhost urls, and generally expect to work. I suspect at this point though that…
Yes, but blocking browser access to localhost from non localhost pages would stop the attack by simply visiting a webpage. It’s as much the fault of browsers for leaving the hole as Zoom for doing a shady job exploiting it. Very disappointed at Mozilla for their meh response.
They have a web server on your machine. If the browsers did that, they would find some other way to handle this since they have a server running on your computer.
I don't think the browser vendors are to blame here.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#126Earlier quoted context omitted.
bluejeans video installs a nasty daemon that runs at boot too. I'll never attend a bluejeans meeting again
Anyone know what port the Bluejeans server is running on and/or how to kill it in a manner similar to the Zoom workaround?
BlueJeans 423 [...] TCP localhost:18171 (LISTEN)
$ nc 127.0.0.1 18171
GET / HTTP/1.0
HTTP/1.1 200 OK
Content-Length: 23
Server: Swifter 1.3.3
BlueJeansHelper ServiceRe: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#127Earlier quoted context omitted.
Unfortunately in this case "uninstall it immediately" does not actually mitigate the vulnerability, since it will just reinstall itself if you come across a triggering link.
Right, I'm talking about the working uninstall instructions in the Medium post.
Don't those steps effectively give away the vulnerability though?
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#128Here's a small script you can run to mitigate the issues described in the article: https://gist.github.com/notmyname/824db39350e3d39496de2ea930...
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#129Even if you have the camera disabled (and I never gave camera permissions to zoom to begin with), it will still join a random stranger's meeting, which will leak your name (or whatever name you have configured). This may be important for some.
yup, shocked me when i noticed. changed the name and unchecked the 'remember name' feature. but it turns out that unchecking that will prefill the user account name, and next time the remember name feature is checked again. so that the only two choices are: either remember the name used last, or, if you uncheck it, have it fill in the account name.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#130This feels material, which is why I’m surprised there’s 0 movement in their stock price after hours. Why do you think that is?
Stock markets very rarely care about security, unless it's somehow front page news.