Nothing can beat piece of duct tape
Vulnerability in the Mac Zoom client allows malicious websites to enable camera
141–150 of 473 posts
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#142Earlier quoted context omitted.
Oh come on. There is no easy way to send people without the app to a installer page, that is the issue. And that is something every single person wants.
Good point. Maybe MacOS/iOS should have a feature where, just like going to a custom service that can launch an already installed app, such as zoomus://123456789, they can allow software vendors to register an install URL that users who don't have the app already installed will be directed to. Let the OS handle security, where it should be, and still make the first install user experience good.
They have the opposite starting with Catalina and iOS, Universal Links that lets an app register to take the first pass at handling zoom.us URLs. Android always had this with their intent system.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#143What blows my mind the most about all of this is how such a successful company has managed to engineer such a shitty solution to this very common problem. I’m not even speaking from a security standpoint (which is a catastrophe) but this feels like some holier than though neckbeard wanting to literally reinvent the wheel on everything. Encoding enum’s as images served from a local web server with various pixel widths??? You can’t make this up. I never liked their UX and now I guess I don’t like what’s under the hood either. Good riddance.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#144What blows my mind the most about all of this is how such a successful company has managed to engineer such a shitty solution to this very common problem. I’m not even speaking from a security standpoint (which is a catastrophe) but this feels like some holier than though neckbeard wanting to literally reinvent the wheel on everything. Encoding enum’s as images served from a local web server with various pixel widths…
[deleted]
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#145Zoom's official response to this issue: https://assets.zoom.us/docs/pdf/Zoom+Response+Video-On+Vulne...
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#146The Zoom client on Linux used to (?) have a nasty command injection. The URL for joining a meeting got passed to some bash reinvocation (so they could set the library path if my memory serves me). A specially crafted URL could execute commands on the system. I haven't been too interested in using Zoom since seeing that.
For the longest time the Linux client would just crash randomly. It also tends to heat up your laptop and use all of your cores at 100% if you're looking at someone's screen.
Just run `strace -f zoom 2> wtf.zoom` to see all of the shit it does (looks like it is polling for events like crazy).
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#147How do you recommend uninstalling this?
From the article: > To shut down the web server, run lsof -i :19421 to get the PID of the process, then do kill -9 [process number]. Then you can delete the ~/.zoomus directory to remove the web server application files. > To prevent this server from being restored after updates you can execute the following in your terminal: rm -rf ~/.zoomus touch ~/.zoomus
Not sure why he didn't just give us
kill -9 $(lsof -i :19421)Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#148[deleted]
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#149From the article: "To shut down the web server, run lsof -i :19421 to get the PID of the process, then do kill -9 [process number]. Then you can delete the ~/.zoomus directory to remove the web server application files."
Does osx not have the fuser command? It lets you find and kill a process by its tcp port (also file handles) in one command.
On Linux I use something like 'fuser -k 19421/tcp' to kill server processes all the time. It is super useful when working with local dev servers etc!
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#150macOS and iOS both support custom schemes, and have done forever. What feature does Zoom actually want?
Not having to cede control of the experience to the system, presumably.
Not having to cede control to the user. If the user wanted/wants your software they know how to install software at this point. They also have a much better mental model of what that means.