Vulnerability in the Mac Zoom client allows malicious websites to enable camera

Safari asks you if you want to open an app that owns a URL scheme to prevent webpages from automatically triggering behavior you might not want.

Zoom decided they know better than the Safari team and decided to install this local webserver specifically to bypass the operating system's security policies, supposedly because "it is their key differentiator" or whatever.

Basically their product managers decided they wanted it to work a certain way and demanded someone do whatever nasty hacks were necessary to make it happen.

It turns out their nasty hack doesn't set the proper CORS policy so any random webpage can force you to join a meeting.

It also turns out they don't do what mac apps are supposed to do: keep this crap inside the app bundle so dragging the app to the trash effectively uninstalls everything. Instead they install to ~/.zoomus, don't document that fact, and if you hit a zoom link after "uninstalling" they automatically reinstall themselves.

Oh and they let the registration for one of their domains expire and nearly lost control of it, which would make this a RCE because their client doesn't do anything to validate their update packages as far as anyone can tell.

I think that about covers it?

Zoom’s response to this[1] is a wonderful example of how not to respond to security issues. It includes the classic tropes:

* Our users don’t care about security.

> Our video-first platform is a key benefit to our users around the world, and our customers have told us that they choose Zoom for our frictionless video communications experience.

* We have no way of knowing if this has been exploited in the wild, so it’s probably fine

> Also of note, we have no indication that this has ever happened.

* Other products have the same vulnerability

> We are not alone among video conferencing providers in implementing this solution.

* We decided not to fix it

> Ultimately, Zoom decided not to change the application functionality

And also a lovely one I haven’t seen before:

* We tried to buy the researcher’s silence, but he refused

> Upon his initial communication to Zoom, the researcher asked whether Zoom provides bounties for security vulnerability submissions. Zoom invited the researcher to join our private paid bug bounty program, which he declined because of non-disclosure terms. It is common industry practice to require non-disclosure for private bug bounty programs.

1. https://blog.zoom.us/wordpress/2019/07/08/response-to-video-...

Yeah, it's a tradeoff by nature. This applies to security in general, not just computers. Having to unlock the door to your house when your hands are full with shopping is annoying, but the alternative is leaving your house unlocked all the time and trusting nobody will walk in.

Depending on the context (location, is there usually someone home anyway, value of stuff within the house) you may or may not find the tradeoff makes sense and voluntarily opt for the worse 'UX'.

It silently reinstalls if you follow any Zoom meeting link.

> Our users don’t care about security.

They're not wrong. Empirically, users explicitly preferred Zoom because it lacked the "ask the user" step before starting a session. Less security is a user visible advantage.