Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerability in the Mac Zoom client allows malicious websites to enable camera

medium.com

Post reply on HN
Print view View original

371–380 of 473 posts

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#371

Post by chadlavi »

spaceribs wrote: post #247
HelloNurse wrote: post #229

Earlier quoted context omitted.

> The UX team You seem to imply that they have an UX team but not a security team, so nobody convinced anybody else that this wasn't a good idea. Without genuine security orientation, even if an expert realizes there is a security problem, who wants to be the boring paranoid pessimist who wastes time and attempts to ruin products, only to be staved off by the efforts of more productive employees that focus on adding…

A sustainable company isn't built on velocity, lack of conflict, and willful ignorance. Decisions need to be made between strong opinions about the right path forward. There needs to be balance and respect between these aspects. Reading the PR statement, I highly doubt the people who have those strong opinions about security are being given a fair voice. They are probably there, but they have zero power to change any…

> A sustainable company isn't built on velocity, lack of conflict, and willful ignorance.

> Decisions need to be made between strong opinions about the right path forward. There needs to be balance and respect between these aspects.

tell that to literally every VC

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#372

Post by chrisfosterelli »

fokinsean wrote: post #353
sombremesa wrote: post #344

Earlier quoted context omitted.

CORS is set up to protect data from being given to a third party, e.g. JS requests obtaining and being able to observe data they shouldn't have access to. Since images are being loaded by the browser (second party), there is no such protection, since a third party should not be able to read them anyway (barring some other vulnerability). It's assumed the first party is correctly doing what it's supposed to, an exampl…

Hmm I still don't understand why they have to use the image hack. Since they control the server on localhost they can set the CORS headers to allow all domains, then JS from a site could access localhost right?

Yes. I don't think there is any good reason to use the image hack. Further, they could have made the CORS lock only the production zoom domain for better security...

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#373

Post by thijsvandien »

migueltarga wrote: post #326
thijsvandien wrote: post #297

Earlier quoted context omitted.

Zoom

Yes, my comment was about RingCentral Meetings

Sorry, never heard of that, and since the rest of the story was so similar, it didn't really register in my brain as something entirely different.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#374

Post by Kalium »

elliekelly wrote: post #357
robinhouston wrote: post #183

Zoom’s response to this[1] is a wonderful example of how not to respond to security issues. It includes the classic tropes: * Our users don’t care about security. > Our video-first platform is a key benefit to our users around the world, and our customers have told us that they choose Zoom for our frictionless video communications experience. * We have no way of knowing if this has been exploited in the wild, so it’s…

> Zoom invited the researcher to join our private paid bug bounty program, which he declined because of non-disclosure terms. It is common industry practice to require non-disclosure for private bug bounty programs. Is an NDA really "common industry practice" for bug bounty programs? I know NDAs are common for pen-testing but it seems like an odd (and kind of dishonest) requirement for a bug bounty program.

Some kind of NDA terms are not unheard-of. Like a 1-3 month period in which to work on things during which disclosures won't go out.

That said, there's a slight disconnect between Zoom's two statements here. The first is that the researcher declined out of concerns over Zoom's NDA. The second is that NDAs are common. What this doesn't say is that Zoom's NDA is cookie-cutter or what the specific terms are.

If I were to guess, Zoom was using some unusual NDA and attempting to buy permanent silence.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#375

Post by nerdjon »

robinhouston wrote: post #183

Zoom’s response to this[1] is a wonderful example of how not to respond to security issues. It includes the classic tropes: * Our users don’t care about security. > Our video-first platform is a key benefit to our users around the world, and our customers have told us that they choose Zoom for our frictionless video communications experience. * We have no way of knowing if this has been exploited in the wild, so it’s…

It's exactly how you want to respond if you plan on sharing it publicly on Twitter in the hopes of fooling those not in tech.

If my mom stumbled into that article, she would likely think they perfectly explained everything (well... she would likely contact me but, still).

Given this news is already not sticking near the top of hacker news and barely reported elsewhere, it feels like they are already getting away with it for the most part.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#376

Post by bloopernova »

mstade wrote: post #237
feketegy wrote: post #235

Click on the app icon, hold, move to Trash.

Which isn't actually enough, since the surreptitiously installed server will happily go and reinstall the Zoom client for you whenever you load a zoom link, or a malicious link. You have to kill the server, and remove the ~/.zoomus directory as well. This is all pretty damning to be honest.

I would have loved to be a fly on the wall of the meetings where that policy was designed and approved.

Did no one at all speak up and say "hey, running secret webservers on obscure ports without telling the user is shady stuff"?

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#378

Post by darkarmani »

elliekelly wrote: post #357
robinhouston wrote: post #183

Zoom’s response to this[1] is a wonderful example of how not to respond to security issues. It includes the classic tropes: * Our users don’t care about security. > Our video-first platform is a key benefit to our users around the world, and our customers have told us that they choose Zoom for our frictionless video communications experience. * We have no way of knowing if this has been exploited in the wild, so it’s…

> Zoom invited the researcher to join our private paid bug bounty program, which he declined because of non-disclosure terms. It is common industry practice to require non-disclosure for private bug bounty programs. Is an NDA really "common industry practice" for bug bounty programs? I know NDAs are common for pen-testing but it seems like an odd (and kind of dishonest) requirement for a bug bounty program.

Will they pay the rest of your team and your spouse as well? "I've already sent these results to a few colleagues around the world to test out, but don't worry, they won't disclose anything for 90 days".

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#379

Post by elliekelly »

Kalium wrote: post #374
elliekelly wrote: post #357

Earlier quoted context omitted.

> Zoom invited the researcher to join our private paid bug bounty program, which he declined because of non-disclosure terms. It is common industry practice to require non-disclosure for private bug bounty programs. Is an NDA really "common industry practice" for bug bounty programs? I know NDAs are common for pen-testing but it seems like an odd (and kind of dishonest) requirement for a bug bounty program.

Some kind of NDA terms are not unheard-of. Like a 1-3 month period in which to work on things during which disclosures won't go out. That said, there's a slight disconnect between Zoom's two statements here. The first is that the researcher declined out of concerns over Zoom's NDA. The second is that NDAs are common. What this doesn't say is that Zoom's NDA is cookie-cutter or what the specific terms are. If I were t…

Thanks for the explanation. That makes sense and seems pretty reasonable. The company should certainly have the opportunity to fix the vulnerability before it's made public and could be exploited.

> If I were to guess, Zoom was using some unusual NDA and attempting to buy permanent silence.

Considering that Zoom ultimately decided not to correct the issue I suspect you're right.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#380

Post by bloopernova »

ilikepi wrote: post #340
kofejnik wrote: post #322

Earlier quoted context omitted.

you forgot one more thing: they don't distribute their crap as a regular self-contained .app, they give you a .pkg which asks for elevated privileges during installation (this is why I don't have it installed)

It's not to hard to extract the app bundle from the .pkg file. This is how I've always installed it. Do this from an empty directory, though, since it will just spray files everywhere... * Use `xar` to extract the contents of the .pkg file: $ xar -xf Zoom.pkg * Use `cpio` to extract the payload, which is in a file oddly named "Scripts": $ mkdir payload && cd payload $ cpio -i -d * The app bundle is compressed within…

This is good info, thank you for sharing it.
Post reply on HN