Stories like this are wonderful evidence of the effectiveness of public disclosure of security vulnerabilities, and are always heartwarming to see. Remember, 90-day disclosure windows are just a courtesy.
Zoom fixes major Mac webcam security flaw with emergency patch
11–20 of 151 posts
Re: Zoom fixes major Mac webcam security flaw with emergency patch
#12Good to see that they’ve turned around and fixed this issue the right way. I was gonna stop using Zoom otherwise.
You should anyway. They had 90 days to do this, they didn't.
Incompetent company. Incompetent management.
Re: Zoom fixes major Mac webcam security flaw with emergency patch
#13Of the main facets of the problem, the vulnerability bothered me less than their obviously poor attitude towards fixing it in a responsible timeline, and that bothered me less than the discovery that they were running an always-active webserver to assist call launches and reinstallation.
Is that a common thing that programs do? Should I be expected to portscan myself frequently to see if software is unexpectedly running web servers? How much battery am I losing to this stuff?
Re: Zoom fixes major Mac webcam security flaw with emergency patch
#14This is why full disclosure is so effective. Nothing else works quite like dropping a full PoC and details of an exploit publicly to light a fire under their ass to fix it.
Re: Zoom fixes major Mac webcam security flaw with emergency patch
#15Of the main facets of the problem, the vulnerability bothered me less than their obviously poor attitude towards fixing it in a responsible timeline, and that bothered me less than the discovery that they were running an always-active webserver to assist call launches and reinstallation. Is that a common thing that programs do? Should I be expected to portscan myself frequently to see if software is unexpectedly runn…
The verge article mentions it's reasonably common and mentions some programs that do it.
From the article, a tweet
--------
They are far from alone, a quick `lsof -i | grep LISTEN` shows that I have: Spotify, Keybase, KBFS, iTunes, Numi, https://t.co/MVSAJgN9yY… All running locally listening web servers.
— Matthew Gregg (@braintube) July 9, 2019
Re: Zoom fixes major Mac webcam security flaw with emergency patch
#16This is why no researcher should sign an NDA after to doing volunteer work for a for-profit Corp. If the reporter had agreed to the NDA required for the bug bounty, Zoom could have - and based on their earlier responses, would have - continued to ship this malware. But now because of the researcher signed an NDA they wouldn’t be able to inform the at risk public.
Will shenanigans like this (declaring a security breach as not a security breach) be caught and fined under GDPR? According to the regulation, companies need to declare breaches in under 72 hours without any unduly delay, but Zoom left this unpatched for months!
As a non-lawyer forum commentator I can say with absolute correctness that it will (or will not) maybe apply.
More seriously: I would guess no, as the GDPR is concerned with data collection and compromise, but I can’t imagine they store all the video they forward.
Of course I wouldn’t be surprised if someone sues them in the US (but given that the US sees companies as people for rights, but not punishment I imagine that they’ll be fine).
Re: Zoom fixes major Mac webcam security flaw with emergency patch
#17What about users who had previously uninstalled the Zoom client? Must they now reinstall Zoom in order to be able to fully remove it? Surely there are users that won’t perform the manual update and will remain vulnerable indefinitely.
Re: Zoom fixes major Mac webcam security flaw with emergency patch
#18Of the main facets of the problem, the vulnerability bothered me less than their obviously poor attitude towards fixing it in a responsible timeline, and that bothered me less than the discovery that they were running an always-active webserver to assist call launches and reinstallation. Is that a common thing that programs do? Should I be expected to portscan myself frequently to see if software is unexpectedly runn…
The verge article mentions it's reasonably common and mentions some programs that do it. From the article, a tweet -------- They are far from alone, a quick `lsof -i | grep LISTEN` shows that I have: Spotify, Keybase, KBFS, iTunes, Numi, https://t.co/MVSAJgN9yY… All running locally listening web servers. — Matthew Gregg (@braintube) July 9, 2019
The spotify one is for spotify connect most likely. I'm guessing (although not sure, someone could verify it) that spotify connect requires some sort of authorization to work.
Edit: here you go http://cgbystrom.com/articles/deconstructing-spotifys-builti...
Re: Zoom fixes major Mac webcam security flaw with emergency patch
#19The earlier discussion is at https://news.ycombinator.com/item?id=20387298 .
Specifically - OP is just the news that Zoom agreed to make the changes the security community demanded. Previous discussion is root discussion of the issue itself and of the Zoom response more generally.
Re: Zoom fixes major Mac webcam security flaw with emergency patch
#20Of the main facets of the problem, the vulnerability bothered me less than their obviously poor attitude towards fixing it in a responsible timeline, and that bothered me less than the discovery that they were running an always-active webserver to assist call launches and reinstallation. Is that a common thing that programs do? Should I be expected to portscan myself frequently to see if software is unexpectedly runn…
I've noticed that the Intel software update scan tool is a web page now, I presume it is a client side application that communicates with a local web server.
But I could be wrong.