381–390 of 473 posts
FTA, one step to clean this up is:
pkill "RingCentralOpener"; rm -rf ~/.ringcentralopener; touch ~/.ringcentralopener && chmod 000 ~/.ringcentralopener;
RingCentral and Zoom have a multiyear partnership.
https://www.ringcentral.com/whyringcentral/company/pressrele...
The notion that some random app can just spin up a server on localhost without my permission is completely insane. Also, this is why Gatekeeper, and the App Store "walled garden" are good---nothing should get the kind of permissions necessary to run a fucking localhost server that can reinstall a deleted app w/o user interaction!!
Earlier quoted context omitted.
Some kind of NDA terms are not unheard-of. Like a 1-3 month period in which to work on things during which disclosures won't go out. That said, there's a slight disconnect between Zoom's two statements here. The first is that the researcher declined out of concerns over Zoom's NDA. The second is that NDAs are common. What this doesn't say is that Zoom's NDA is cookie-cutter or what the specific terms are. If I were t…
Thanks for the explanation. That makes sense and seems pretty reasonable. The company should certainly have the opportunity to fix the vulnerability before it's made public and could be exploited. > If I were to guess, Zoom was using some unusual NDA and attempting to buy permanent silence. Considering that Zoom ultimately decided not to correct the issue I suspect you're right.
> - Offered and declined a financial bounty for the report due to policy on not being able to publicly disclose even after the vulnerability was patched.
1. Quit Zoom.
2. Kill the ZoomOpener process.
3. cd ~; mv .zoomus/ .zoomus.off/
4. mkdir .zoomus && sudo chown root .zoomus; sudo chmod 600 .zoomus
Now, the Safari permission prompt will show up every time you click on a Zoom link.
Earlier quoted context omitted.
some computers have this e.g. raspberry pi
And the upcoming pinebook pro: comes with a hardware privacy switch for camera, microphones and bluetooth/wifi. For those who aren't familiar with pinebooks, they're $99 arm-based linux laptops.
Earlier quoted context omitted.
A sustainable company isn't built on velocity, lack of conflict, and willful ignorance. Decisions need to be made between strong opinions about the right path forward. There needs to be balance and respect between these aspects. Reading the PR statement, I highly doubt the people who have those strong opinions about security are being given a fair voice. They are probably there, but they have zero power to change any…
> A sustainable company isn't built on velocity, lack of conflict, and willful ignorance. > Decisions need to be made between strong opinions about the right path forward. There needs to be balance and respect between these aspects. tell that to literally every VC
Might I suggest: https://www.obdev.at/products/microsnitch/index.html
Micro Snitch is a small MacOS toolbar application which runs in the background looking for system calls made to the camera or the microphone. It visually indicates when either are being used and logs the activity to a file for future review.
Earlier quoted context omitted.
Could you further explain the CORS bypass? Why do they have to do the image hack if CORS if they open up CORS on the local server? At that point couldn't they retrieve data via JS instead?
CORS isn't supported to localhost, aka you can't do that; hence the image-size hack
On my Mac, I have uBlockOrigin installed in my browser and I have it configured to always block 3rdparty and 3rdparty frames and it prevents both the POCs completely. I have one browser that I use for work email and video conference, where system grants access to camera/microphone to the browser and browser allows Google Meet to access camera. I have another browser where system does not grant access to any of the de…
and I am in the crowd of mac users who tape over their camera. when it comes to video conferences at most I have ever seen the desktop shared. what type of work do you do that uses the video for portions other than the presentation?
Certain teams at my workplace use webcams all the time, others never. My team leverages them quite a bit, as our team is all over the world. It helped solidify our team members not just as random voices on a phone line, but as actual people who we will likely never meet in person.
Earlier quoted context omitted.
It is mentioned in the third paragraph already, highlighted in green. They don't offer a method of clean removal to their users. They run a web server on your machine that will reinstall Zoom on your macOS whenever it is convenient for them (secretly, without asking you first). See here: https://apple.stackexchange.com/questions/358651/unable-to-c... That web server is exploitable, as explained in the article. Note t…
I do NOT appear to have the web server running, but I did have the ~/.zoomus folder and the ZoomOpener app there. Is this because I'm scrupulous about killing LaunchAgents and LaunchDaemons?
ps aux | grep zoom
You'll probably see "ZoomOpener" there. It is running but it's not in the "Force Quit" menu. Then, to kill it run:
killall zoom
Then you can follow the other directions indicated by the previous poster who gave information about how to lock your ~/.zoomus directory down to root so that it can't install itself again.