Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerability in the Mac Zoom client allows malicious websites to enable camera

medium.com

Post reply on HN
Print view View original

131–140 of 473 posts

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#131

Post by pjc50 »

chrisfosterelli wrote: post #99

Not sure I follow the CORS angle. The linked stackoverflow question mostly seemed to be someone who was confused about how CORS works, and the issue in the Google Chrome tracker was closed as WontFix because they couldn't reproduce it and said it should work. I'm nearly positive that CORS from localhost works OK. I set this up all the time for local development. For example, I run a client CRA app on localhost:3000 a…

Am I right in thinking that CORS only applies to Javascript-initiated requests? This trick uses an embedded image to make the request.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#132

Post by Renevith »

XMPPwocky wrote: post #41
CaliforniaKarl wrote: post #6

The article’s actual title is: Zoom Zero Day: 4+ Million Webcams & maybe an RCE? Just get them to visit your website! But, assuming I’m reading it correctly, the “maybe an RCE?” part seems like fear-mongering, because it would require that Zoom lose control of one of the domains that they trust for transparent client installs/upgrades. I’m also a little concerned about how some parts of the article don’t match up. Fo…

Dangling domains happen all the time. As long as the main one that's actually used is still controlled by the org, others can quite easily slip through the cracks, not renewed while still present in the codebase.

Indeed! It's not even a hypothetical in this case. According to the article, Zoom was just 5 days away from letting one of the domains expire when the author told them.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#133

Post by lanrh1836 »

pjc50 wrote: post #130
lanrh1836 wrote: post #97

This feels material, which is why I’m surprised there’s 0 movement in their stock price after hours. Why do you think that is?

Stock markets very rarely care about security, unless it's somehow front page news.

Investors would care if they thought Zoom’s customers cared enough to switch. I personally think this is terrible, but investors don’t seem to think Zoom’s customers care enough to change to a competitor, which makes me second guess whether or not this is actually a big deal to large customers.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#134

Post by vinay_ys »

On my Mac, I have uBlockOrigin installed in my browser and I have it configured to always block 3rdparty and 3rdparty frames and it prevents both the POCs completely.

I have one browser that I use for work email and video conference, where system grants access to camera/microphone to the browser and browser allows Google Meet to access camera.

I have another browser where system does not grant access to any of the devices - camera, microphone, USB etc - and I use that for web surfing.

And I strictly don't install any plugins for video calls. I have refused to join meetings where people try to make me install random binary software on my machine. There's always phone call for such situations.

I feel better about dedicated apps on iPhone where again I can install and grant permissions before the call and then uninstall the app completely. On iPhone I don't do any web surfing. I have Firefox Focus for occasional emergencies to open the unknown web.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#135

Post by anaphor »

cobbzilla wrote: post #96

I'm trying to think of the real-world implications and how this would play out. Normally this would be pretty obvious, wouldn't it? Users would see Zoom open into some weird meeting, and close it. Presuming the exploit cannot avoid bringing the Zoom app to the foreground when it joins the meeting and activates the camera/mic. If it can do that and stay in the background, all bets are off. In spite of its obviousness,…

> Activate the Zoom link and hope the person is AFK. Spy on their home/office/whatever. Also a violation.

I think this is the most likely scenario. There are ways you could potentially delay it (e.g. they leave a tab open and you don't open the link until a certain time)

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#136

Post by illumin8 »

megablast wrote: post #109
spaceribs wrote: post #100

Earlier quoted context omitted.

If you want to really break down their viewpoint on the situation, lets translate their PR statement line by line: > Zoom believes in giving our customers the power to choose how they want to Zoom. Zoom believes if their app isn't convenient to use, their customers have the power to leave their ass, as they are in an incredibly competitive market. > This includes whether they want a seamless experience in joining a m…

Oh come on. There is no easy way to send people without the app to a installer page, that is the issue. And that is something every single person wants.

Good point. Maybe MacOS/iOS should have a feature where, just like going to a custom service that can launch an already installed app, such as zoomus://123456789, they can allow software vendors to register an install URL that users who don't have the app already installed will be directed to. Let the OS handle security, where it should be, and still make the first install user experience good.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#137

Post by jhiesey »

tcoff91 wrote: post #94
georgewfraser wrote: post #50

Why isn't zoom running fully in the web browser at this point? Meet does this, and as far as I can tell the quality is indistinguishable from Zoom. Can someone with a better understanding of the underlying protocols shed light on why Zoom continues to ship a separate desktop app?

You can do so much better using a native app than a webapp. UDP transport is really important for real-time communication.

WebRTC typically does use UDP. But it certainly isn't as flexible as what you can do with a native app.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#138

Post by punnerud »

vinay_ys wrote: post #134

On my Mac, I have uBlockOrigin installed in my browser and I have it configured to always block 3rdparty and 3rdparty frames and it prevents both the POCs completely. I have one browser that I use for work email and video conference, where system grants access to camera/microphone to the browser and browser allows Google Meet to access camera. I have another browser where system does not grant access to any of the de…

HN part of the unknown web?

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#140

Post by Thorrez »

tlb wrote: post #81
keithwinstein wrote: post #47

Earlier quoted context omitted.

Finally, note that Zoom effectively does not pay for bug bounties, so researchers should think twice about donating their expertise to a selfish for-profit corporation I've read this a few times and am curious if this has really become the prevailing view about what security researchers are doing (i.e., uncompensated labor) when they notify vendors about security vulnerabilities. The traditional view (which I think w…

I can't imagine selling bugs to the highest bidder ever becoming ethically acceptable. You can't pretend not to know that the high bidder is probably a cybercriminal. If you do this, your hat is clearly black. Once upon a time, vulnerabilities were just nuisances and people could justify some gray-hat casuistry when the damage was just some sysadmin overtime to clean up. But now there are serious organized crime ring…

>you must disclose it responsibly.

While most people agree selling a vulnerability is immoral, there is much debate on whether "full disclosure" is ok, and whether "responsible disclosure" is a term anyone should ever say (some argue the correct term is "coordinated disclosure").

https://news.ycombinator.com/item?id=18233897

Post reply on HN