Vulnerability in the Mac Zoom client allows malicious websites to enable camera

Post by Shivetya » Tue, Jul 09, 2019, 9:29 AM UTC

vinay_ys wrote: post #134

On my Mac, I have uBlockOrigin installed in my browser and I have it configured to always block 3rdparty and 3rdparty frames and it prevents both the POCs completely. I have one browser that I use for work email and video conference, where system grants access to camera/microphone to the browser and browser allows Google Meet to access camera. I have another browser where system does not grant access to any of the de…

Post by addandsubtract » Tue, Jul 09, 2019, 9:35 AM UTC

jen729w wrote: post #194

franky47 wrote: post #166

No amount of security features can rival a small piece of black tape over the camera. It also makes crypto-phishing (you've been recorded doing X, pay Y BTC) much harder to fall for. Where software could (and eventually will) be compromised, the attacker would have to physically access the machine to remove that tape.

One assumes that this activates the green camera light? It's not perfect but I can't imagine not noticing that it had come on. Not that it helps if you're, ahem , in the middle of something when the nefarious 3rd party opens the line.

Post by CaptainMarvel » Tue, Jul 09, 2019, 9:51 AM UTC

kowdermeister wrote: post #161

thijsvandien wrote: post #7

Positively terrible... Kudos to this researcher. I liked Zoom when I used it a couple of times, but the reinstall “feature” is a huge violation of my trust. Software from the company behind it will not touch my system anymore. Too bad really, because properly working video chat is hard to find. The App Store model is not my favorite, but at times like these, a forced sandbox and inspection by a trusted third party st…

What reinstall feature?

Post by m0dest » Tue, Jul 09, 2019, 9:57 AM UTC

filleokus wrote: post #201

seandougall wrote: post #26

> This vulnerability leverages the amazingly simple Zoom feature where you can just send anyone a meeting link (for example https://zoom.us/j/492468757 ) and when they open that link in their browser their Zoom client is magically opened on their local machine. I was curious about how this amazing bit of functionality was implemented and how it had been implemented securely. Come to find out, it really hadn’t been im…

If Universal Links was supported on macOS we could get the best of both worlds. The web server basically presents meta-data in a JSON-file (in the .well-known directory) which Safari/iOS uses to launch the app if it is installed, and otherwise just renders the webpage [0]. The app contains information about which domains it allows itself to be opened from which would fix this issue. [0]: https://developer.apple.com/l…

Post by dwaite » Tue, Jul 09, 2019, 9:58 AM UTC

swish_bob wrote: post #184

spaceribs wrote: post #122

Earlier quoted context omitted.

Ah, but that's an interesting question right? do they WANT to be asked? If you only had to make one click to join a meeting, doesn't that FEEL better?

In fairness, I get irritated about the fact I need to tell WebEx to use my computer's audio to join the call every damn time I join a meeting quite annoying. If only there was some happy middle ground between never asking and always asking ...