Vulnerability in the Mac Zoom client allows malicious websites to enable camera

Post by clebio » Tue, Jul 09, 2019, 5:34 AM UTC

bfdm wrote: post #85

keithwinstein wrote: post #47

Earlier quoted context omitted.

Finally, note that Zoom effectively does not pay for bug bounties, so researchers should think twice about donating their expertise to a selfish for-profit corporation I've read this a few times and am curious if this has really become the prevailing view about what security researchers are doing (i.e., uncompensated labor) when they notify vendors about security vulnerabilities. The traditional view (which I think w…

Beyond just a prevailing "view", this duty to public safety is actually explicitly codified in the laws and regulations of most professional engineering organizations. To act otherwise would be a) unethical and subsequently b) grounds for loss of license to practice.

Post by josteink » Tue, Jul 09, 2019, 5:56 AM UTC

seandougall wrote: post #26

> This vulnerability leverages the amazingly simple Zoom feature where you can just send anyone a meeting link (for example https://zoom.us/j/492468757 ) and when they open that link in their browser their Zoom client is magically opened on their local machine. I was curious about how this amazing bit of functionality was implemented and how it had been implemented securely. Come to find out, it really hadn’t been im…

Post by omk » Tue, Jul 09, 2019, 6:00 AM UTC

spaceribs wrote: post #39

seandougall wrote: post #26

> This vulnerability leverages the amazingly simple Zoom feature where you can just send anyone a meeting link (for example https://zoom.us/j/492468757 ) and when they open that link in their browser their Zoom client is magically opened on their local machine. I was curious about how this amazing bit of functionality was implemented and how it had been implemented securely. Come to find out, it really hadn’t been im…

A custom URI wouldn't work as seamlessly as zoom's UX team would have liked. If you hadn't installed zoom, either a nasty message would tell you the protocol wasn't supported, or it would redirect you to a google search. Their answer was to send people to a URL they controlled and brought you through the install process as easily as possible, but the issue they needed to solve was determining if you needed to have an…

Post by chrisfosterelli » Tue, Jul 09, 2019, 6:03 AM UTC

pjc50 wrote: post #131

chrisfosterelli wrote: post #99

Not sure I follow the CORS angle. The linked stackoverflow question mostly seemed to be someone who was confused about how CORS works, and the issue in the Google Chrome tracker was closed as WontFix because they couldn't reproduce it and said it should work. I'm nearly positive that CORS from localhost works OK. I set this up all the time for local development. For example, I run a client CRA app on localhost:3000 a…

Am I right in thinking that CORS only applies to Javascript-initiated requests? This trick uses an embedded image to make the request.

Post by Iv » Tue, Jul 09, 2019, 6:10 AM UTC

omk wrote: post #155

spaceribs wrote: post #39

Earlier quoted context omitted.

A custom URI wouldn't work as seamlessly as zoom's UX team would have liked. If you hadn't installed zoom, either a nasty message would tell you the protocol wasn't supported, or it would redirect you to a google search. Their answer was to send people to a URL they controlled and brought you through the install process as easily as possible, but the issue they needed to solve was determining if you needed to have an…

Am I the only one seeing the pattern here. Most security loop holes I have witness have existed at the cost of providing a better user experience.