Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerability in the Mac Zoom client allows malicious websites to enable camera

medium.com

Post reply on HN
Print view View original

201–210 of 473 posts

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#201

Post by filleokus »

seandougall wrote: post #26

> This vulnerability leverages the amazingly simple Zoom feature where you can just send anyone a meeting link (for example https://zoom.us/j/492468757 ) and when they open that link in their browser their Zoom client is magically opened on their local machine. I was curious about how this amazing bit of functionality was implemented and how it had been implemented securely. Come to find out, it really hadn’t been im…

If Universal Links was supported on macOS we could get the best of both worlds.

The web server basically presents meta-data in a JSON-file (in the .well-known directory) which Safari/iOS uses to launch the app if it is installed, and otherwise just renders the webpage [0].

The app contains information about which domains it allows itself to be opened from which would fix this issue.

[0]:https://developer.apple.com/library/archive/documentation/Ge...

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#202

Post by melon_madness »

davnicwil wrote: post #185
barrkel wrote: post #174

Earlier quoted context omitted.

This is the security - usability tradeoff and is as old as the hills.

Yeah, it's a tradeoff by nature. This applies to security in general, not just computers. Having to unlock the door to your house when your hands are full with shopping is annoying, but the alternative is leaving your house unlocked all the time and trusting nobody will walk in. Depending on the context (location, is there usually someone home anyway, value of stuff within the house) you may or may not find the trade…

See also: Boeing 737 Max

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#203

Post by simias »

_pmf_ wrote: post #189

> Our users don’t care about security. They're not wrong. Empirically, users explicitly preferred Zoom because it lacked the "ask the user" step before starting a session. Less security is a user visible advantage.

Same problem Microsoft faced when it added "UAC" in Vista. Admittedly the implementation might not have been the best from a usability perspective but I think any attempt at implementing proper privilege management in Windows would have had many users complaining and not seeing the point.

I guess the lesson here is not to give your users bad habits for the sake of convenience otherwise it'll backfire if you ever want to do things right later. MS had everybody run as root for decades before they finally decided that it might not be such a great idea after all, and then they had to face annoyed users and bad publicity.

That being said I can't really imagine how having a non-intrusive "do you want to start the call" dialog before initiating the call can be considered a deal breaker. I assume you could even reduce that annoyance further by adding a "don't ask me again for this website/user/whatever" checkbox. Do you really think that would hurt Zoom significantly? I've never used their product so I can't really form an educated opinion.

This is especially stupid because I have no doubt that now that it's been made public some people will abuse the vulnerability, if only for fun.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#204

Post by lawrencegs »

"Additionally, if you’ve ever installed the Zoom client and then uninstalled it, you still have a localhost web server on your machine that will happily re-install the Zoom client for you, without requiring any user interaction on your behalf besides visiting a webpage. This re-install ‘feature’ continues to work to this day."

So... what's the best way to really really uninstall Zoom client from our Mac?

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#205

Post by pcr0 »

melon_madness wrote: post #202
davnicwil wrote: post #185

Earlier quoted context omitted.

Yeah, it's a tradeoff by nature. This applies to security in general, not just computers. Having to unlock the door to your house when your hands are full with shopping is annoying, but the alternative is leaving your house unlocked all the time and trusting nobody will walk in. Depending on the context (location, is there usually someone home anyway, value of stuff within the house) you may or may not find the trade…

See also: Boeing 737 Max

As in security against stalling lead to a UX disaster that caused planes to dive into the ground?

I'd argue the moral of that story was to redesign the plane, instead of piling on hacks to save costs in the short run.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#207

Post by thijsvandien »

swish_bob wrote: post #187
kowdermeister wrote: post #161

Earlier quoted context omitted.

What reinstall feature?

It silently reinstalls if you follow any Zoom meeting link.

For which loading an iFrame by visiting a website or opening an email is enough...

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#208

Post by thijsvandien »

migueltarga wrote: post #78
nradov wrote: post #59

Earlier quoted context omitted.

Have your checked for similar vulnerabilities in competing products such as GoToMeeting and WebEx? They have the same basic features.

RingCentral Meetings uses zoom.us engine but the local server runs on port 19424 instead. I'm able to replicate the issue on it. PoC: http://localhost:19424/launch?action=join&confno=3535353535

In my case it's 19421 as written in the article.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#210

Post by CaptainMarvel »

zongitsrinzler wrote: post #188

Does anyone know of any working alternatives? We use Zoom a lot, it has the most hideous UI and the worst UX but so far it's been the only video platform that reliably works with tens and hundreds of attendees.

Jitsi Meet [0] is the simplest video conferencing solution that I have ever come across. To use it you go the website (or the mobile app) and that's it.

You have a free, private, end-to-end encrypted, efficient, multi-participant video chat which allows screen sharing and shared document editing. It works on every modern browser, you don't need to create an account, and you don't need to install an app (except maybe on mobile OS's). It's open-source and you can run your own server.

[0]: https://meet.jit.si/

Post reply on HN