Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerability in the Mac Zoom client allows malicious websites to enable camera

medium.com

Post reply on HN
Print view View original

391–400 of 473 posts

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#391

Post by paultopia »

muraiki wrote: post #285
ubermonkey wrote: post #272

Earlier quoted context omitted.

(prior reply deleted once I read about the fucking local webserver & phantom reinstallation bullshit. Fuck zoom.)

It's ridiculous to install a constantly running web service that uses tricks to circumvent CORS protection and to get around Safari's protections, which were both rightly created to improve user's security. It's not a "so-called vulnerability". As the article describes, this could be used in concert with another vulnerability to achieve RCE. Combining vulnerabilities is often how RCE is attained. These actions undo t…

Yeah, I wouldn't even call this a vulnerability. I'd call it malware. Nothing should secretly reinstall deleted apps without user interaction. Never. The user expressed the intention to delete the app, and you're undoing it without their permission? Deliberately defeating expressed user intent. Malware. Period. It's the Zoom Trojan.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#392

Post by codazoda »

smarx007 wrote: post #384

Here is how I fixed the problem for myself temporarily: 1. Quit Zoom. 2. Kill the ZoomOpener process. 3. cd ~; mv .zoomus/ .zoomus.off/ 4. mkdir .zoomus && sudo chown root .zoomus; sudo chmod 600 .zoomus Now, the Safari permission prompt will show up every time you click on a Zoom link.

This worked for me...

In order to verify that the opener was running, I ran the following command.

ps aux | grep zoom

To kill the opener I ran the following.

killall zoom

Then I followed the rest of the instructions above to create a locked down version of the directory. You could also create a file called .zoomus instead (similar to the suggestions made farther down this comment thread).

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#394

Post by amichal »

fokinsean wrote: post #363
amichal wrote: post #358

Earlier quoted context omitted.

They do not. The reason for that is that at the time CORS was designed lots of sites loaded images from other sites and because images where considered static content that didn't change the server this was at worst a information leak. What Zoom has done here is abuse a HTTP GET via a tag (which is not supposed to change anything) as a way to trigger a privileged local process to INSTALL software (among other things).…

Thanks for the info! I still don't fully understand _why_ they had to do this hack if they own the localhost server. They could just set CORS to be '*' and lax their CSP. Then they would be able to get data with JS. For example this website can see any localserver on your network with open CORS since it appears they laxed their CSP. http://http.jameshfisher.com/2019/05/26/i-can-see-your-local...

my understanding (have not tested this) is that CORS "" does not work in all browsers between `localhost` and other domains. This is also AFAIK an intentional security feature. Even so CORS "" would be even more explictly bad behaviour. The whole point of CORS is to prevent XSS from random sites linking to your end points.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#395

Post by jonny_eh »

melon_madness wrote: post #222
pcr0 wrote: post #205

Earlier quoted context omitted.

As in security against stalling lead to a UX disaster that caused planes to dive into the ground? I'd argue the moral of that story was to redesign the plane, instead of piling on hacks to save costs in the short run.

As I understand it, they tried to design a new plane that wouldn't require pilots to be re-trained on how to use it, if they'd already been trained on an older model. That's the UX I'm referring to.

Certainly a (bad) trade-off, but I wouldn't classify it as UX. It's more of a safety vs sales trade-off.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#396

Post by outworlder »

muraiki wrote: post #285
ubermonkey wrote: post #272

Earlier quoted context omitted.

(prior reply deleted once I read about the fucking local webserver & phantom reinstallation bullshit. Fuck zoom.)

It's ridiculous to install a constantly running web service that uses tricks to circumvent CORS protection and to get around Safari's protections, which were both rightly created to improve user's security. It's not a "so-called vulnerability". As the article describes, this could be used in concert with another vulnerability to achieve RCE. Combining vulnerabilities is often how RCE is attained. These actions undo t…

> It's ridiculous to install a constantly running web service that uses tricks to circumvent CORS protection and to get around Safari's protections, which were both rightly created to improve user's security.

All of this to avoid an extra click. I know UX is important, but it is not more so than security.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#397

Post by dragonwriter »

_pmf_ wrote: post #189

> Our users don’t care about security. They're not wrong. Empirically, users explicitly preferred Zoom because it lacked the "ask the user" step before starting a session. Less security is a user visible advantage.

> Less security is a user visible advantage.

No, less friction is a user-visible advantage, less security isn't user-visible, for most users, until sometime after the vulnerabilities exposed thereby are exploited and, when it becomes user-visible, is very much not considered an advantage.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#398

Post by favorited »

kofejnik wrote: post #322
xenadu02 wrote: post #181

Earlier quoted context omitted.

Safari asks you if you want to open an app that owns a URL scheme to prevent webpages from automatically triggering behavior you might not want. Zoom decided they know better than the Safari team and decided to install this local webserver specifically to bypass the operating system's security policies, supposedly because "it is their key differentiator" or whatever. Basically their product managers decided they want…

you forgot one more thing: they don't distribute their crap as a regular self-contained .app, they give you a .pkg which asks for elevated privileges during installation (this is why I don't have it installed)

I almost never run .pkg installers either. Maybe 1% of apps need elevated installation privileges.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#399

Post by seax »

jwr wrote: post #354
rahoulb wrote: post #176

I asked Zoom support about this and they sent me to this page: https://blog.zoom.us/wordpress/2019/07/08/response-to-video-... The key thing here is they think this is a fair trade-off because Safari asks if you want to open Zoom. > This is a workaround to a change introduced in Safari 12 that requires a user to confirm that they want to start the Zoom client prior to joining every meeting. The local web server enabl…

> I think they need to be made aware that this isn't acceptable. Oh, definitely. I cancelled my subscription because of this, but I wonder if the reason will make it through the corporate fog. What is worrying is that more and more companies think it is fine to install "helpers", "openers" and other cruft. I recently removed several, and I still have to use software that scares me sometimes (DYMO web printing, Brothe…

> I wonder if the reason will make it through the corporate fog

I really doubt it. Given the change control policies of huge corps and how awful it is to get anything new/get rid of anything they'll just toe the zoom party line and keep it.

Post reply on HN