[deleted]
Vulnerability in the Mac Zoom client allows malicious websites to enable camera
281–290 of 473 posts
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#282Click on the app icon, hold, move to Trash.
It is mentioned in the third paragraph already, highlighted in green. They don't offer a method of clean removal to their users. They run a web server on your machine that will reinstall Zoom on your macOS whenever it is convenient for them (secretly, without asking you first). See here: https://apple.stackexchange.com/questions/358651/unable-to-c... That web server is exploitable, as explained in the article. Note t…
I do NOT appear to have the web server running, but I did have the ~/.zoomus folder and the ZoomOpener app there.
Is this because I'm scrupulous about killing LaunchAgents and LaunchDaemons?
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#283It appears that two of Zoom's competitors, Blue Jeans and Webex, also use web servers on localhost:
https://twitter.com/anthonypjshaw/status/1148470933901864960
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#284These meeting apps feel like the browser plugins of the 2000's. There are so many that do almost the same thing they now resort to seriously insecure methods to make sure you have theirs installed and never remove it.
Apparently one less click is a competitive advantage, whatever the cost.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#285I've lost all trust in Zoom at this point
(prior reply deleted once I read about the fucking local webserver & phantom reinstallation bullshit. Fuck zoom.)
It's ridiculous to install a constantly running web service that uses tricks to circumvent CORS protection and to get around Safari's protections, which were both rightly created to improve user's security.
It's not a "so-called vulnerability". As the article describes, this could be used in concert with another vulnerability to achieve RCE. Combining vulnerabilities is often how RCE is attained.
These actions undo the thoughtful work of information security professionals to protect users. It's astonishing to me that people can't see what's wrong here.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#286Not sure I follow the CORS angle. The linked stackoverflow question mostly seemed to be someone who was confused about how CORS works, and the issue in the Google Chrome tracker was closed as WontFix because they couldn't reproduce it and said it should work. I'm nearly positive that CORS from localhost works OK. I set this up all the time for local development. For example, I run a client CRA app on localhost:3000 a…
You're 100% correct, and while someone has pointed out the proper headers that need to be set on the bug report here: https://bugs.chromium.org/p/chromium/issues/detail?id=67743 , it's been drowned out by people who don't seem to understand the issue: http://williambert.online/2013/06/allow-cors-with-localhost-... CORS is hard, I've struggled on it several times, and I'm not surprised an engineer gave up trying to fi…
Can confirm, CORS (Origin: ramdomsite.tld to localhost) works just fine in Chrome.
If you have a CORS enable server on localhost you can make requests to it from http://www.test-cors.org
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#287I've lost all trust in Zoom at this point
(prior reply deleted once I read about the fucking local webserver & phantom reinstallation bullshit. Fuck zoom.)
Jonathan pointed out something important on the chat last night. In many cases, the auto-join is a vulnerability it itself even if the video doesn't turn on.
It allows the attacker to potentially unmask your identity if you are logged into Zoom. When you join the call, you will show up in the participants list.
This is definitely something that you would not want to happen on various parts of the web. It kills your ability to browse privately.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#288Well, the company and product are dead to me now, gonna hassle our CTO to switch. I just really hope theres some dev at Zoom who hated this whole installing backdoors idea who's gonna have the greatest "I told you so" day at the office tomorrow.
Interesting to me that this would be your CTO’s decision.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#289Zoom is why my shiny 27" Retina iMac is decorated with a small square of black electrical tape.
It always makes me wonder why people keep tape on camera sensor but don't care about microphones. Maybe I'm wrong but I think things you and other people around say can be of more value to the attacker than what you do or how you look like.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#290If you're interested in seeing if you're vulnerable to this, visit this website: http://zoomzeroday.com