Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerability in the Mac Zoom client allows malicious websites to enable camera

medium.com

Post reply on HN
Print view View original

171–180 of 473 posts

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#171

Post by sneak »

vinay_ys wrote: post #134

On my Mac, I have uBlockOrigin installed in my browser and I have it configured to always block 3rdparty and 3rdparty frames and it prevents both the POCs completely. I have one browser that I use for work email and video conference, where system grants access to camera/microphone to the browser and browser allows Google Meet to access camera. I have another browser where system does not grant access to any of the de…

Refusing to install software for video calls is a good policy. Also, having a throwaway workstation for such things (also Skype, which is spyware of the worst kind) is useful too, for when it’s a pre-sales call and security can’t outweigh closing a six+ figure deal.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#173

Post by lozenge »

davej wrote: post #162
seandougall wrote: post #26

> This vulnerability leverages the amazingly simple Zoom feature where you can just send anyone a meeting link (for example https://zoom.us/j/492468757 ) and when they open that link in their browser their Zoom client is magically opened on their local machine. I was curious about how this amazing bit of functionality was implemented and how it had been implemented securely. Come to find out, it really hadn’t been im…

I have some experience with this, you can use javascript on the https:// meeting link to detect if the app protocol (zoom:// or whatever) exists. If the app protocol exists then go straight to the app protocol link. If it doesn’t then prompt the user to download and install Zoom. The JS is a bit messy and requires a few different approaches but it works on all popular browsers on Windows and Mac (Linux support wasn’t…

Citrix Workspace does exactly this and it works fine

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#174

Post by barrkel »

omk wrote: post #155
spaceribs wrote: post #39

Earlier quoted context omitted.

A custom URI wouldn't work as seamlessly as zoom's UX team would have liked. If you hadn't installed zoom, either a nasty message would tell you the protocol wasn't supported, or it would redirect you to a google search. Their answer was to send people to a URL they controlled and brought you through the install process as easily as possible, but the issue they needed to solve was determining if you needed to have an…

Am I the only one seeing the pattern here. Most security loop holes I have witness have existed at the cost of providing a better user experience.

This is the security - usability tradeoff and is as old as the hills.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#175

Post by Jlleitschuh »

saganus wrote: post #160
Jlleitschuh wrote: post #27

Hi I'm the author, AMA Or come hang out in the party chat! Use the exploit to join: https://jlleitschuh.org/zoom_vulnerability_poc/zoompwn_ifram...

Stayed on that call for over 3 hours and I just have to say that it was one of the best experiences I've had on the internet in years . People behaved pretty good considering it was a random public Zoom call (except for a few trolls, but nothing really bad). It just felt like the internet of yore where random people would meet and chat and just be nice to each other. Lots of interesting topics, people from all over t…

Thanks for being cool!

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#176

Post by rahoulb »

I asked Zoom support about this and they sent me to this page: https://blog.zoom.us/wordpress/2019/07/08/response-to-video-...

The key thing here is they think this is a fair trade-off because Safari asks if you want to open Zoom.

> This is a workaround to a change introduced in Safari 12 that requires a user to confirm that they want to start the Zoom client prior to joining every meeting. The local web server enables users to avoid this extra click before joining every meeting. We feel that this is a legitimate solution to a poor user experience problem, enabling our users to have faster, one-click-to-join meetings. We are not alone among video conferencing providers in implementing this solution.

I do not believe that this is a fair trade-off given that any website can act on this locally installed server.

EDIT: I think they need to be made aware that this isn't acceptable. My reply to their support team: I do not believe this is a fair trade-off - allowing any arbitrary web site local control of privileged software installed on my machine - because Safari offers a security prompt (specifically so that any arbitrary web site does not gain control of privileged software on my machine). I will be switching ~/.zoomus/ZoomOpener.app off, and considering other options until it has been fixed.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#178

Post by ljm »

bigiain wrote: post #114
cobbzilla wrote: post #96

I'm trying to think of the real-world implications and how this would play out. Normally this would be pretty obvious, wouldn't it? Users would see Zoom open into some weird meeting, and close it. Presuming the exploit cannot avoid bringing the Zoom app to the foreground when it joins the meeting and activates the camera/mic. If it can do that and stay in the background, all bets are off. In spite of its obviousness,…

I wonder if this works in an electron app (like Slack maybe) displaying it? Maybe you could intentionally send this link to someone shown as inactive on Slack, and have the WSlack webpage preview thing run enough javascript to pop open Zoom with the camera and mic running... I'd test it myself, but I deleted Zoom and the sneaky localhost web server while I read the article...

It says that the server sends an image with certain dimensions back as an error code, so I wonder what you could do if you served some simple HTML that uses the local server as a meta tag that renders in the preview?

I imagine slack would do that on the client since it’s built on electron.

Unless it requires more than loading a URL.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#179

Post by azernik »

The most damning part of the conclusions:

> This being said, I also recommend that any researcher that finds a vulnerability in Zoom’s software does not directly report the vulnerability to Zoom. Instead, I recommend that researchers report these vulnerabilities via the Zero Day Initiative (ZDI). The ZDI disclosure program gives vendors 120 days to resolve the vulnerability, the ZDI will pay researchers for their work, and researchers have the ability to publicly disclose their findings.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#180

Post by rahoulb »

closeparen wrote: post #44
seandougall wrote: post #26

> This vulnerability leverages the amazingly simple Zoom feature where you can just send anyone a meeting link (for example https://zoom.us/j/492468757 ) and when they open that link in their browser their Zoom client is magically opened on their local machine. I was curious about how this amazing bit of functionality was implemented and how it had been implemented securely. Come to find out, it really hadn’t been im…

The basic problem is that you enter a meeting by loading a URL, and loading URLs is something any website can do. There probably needs to be a confirmation step before joining a meeting.

They put this in place precisely to avoid Safari's "Do you want to open this in Zoom" confirmation prompt
Post reply on HN