Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom fixes major Mac webcam security flaw with emergency patch

theverge.com

Post reply on HN
Print view View original

21–30 of 151 posts

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#21

Post by olliej »

anaphor wrote: post #14

This is why full disclosure is so effective. Nothing else works quite like dropping a full PoC and details of an exploit publicly to light a fire under their ass to fix it.

Well it’s an argument for responsible disclosure - you tell them, give them plenty of time to fix it, and publish.

But responsible disclosure absolutely does not mean “no disclosure”. It means give them a chance to fix it. If they choose not to you disclose so that people know that they need to take steps to protect themselves.

The important thing is that the disclosure must become public. It doesn’t matter that they pushed an update, as none of the victims who had deleted/“uninstalled” zoom will get the update, and without the update they’ll still be running the server.

The only way anyone would know about it is with the details being public.

I’m waiting for Apple to use xprotect to kill the server on all machines, as that’s the only true solution for the uninstalled victims

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#22

Post by runn1ng »

notafraudster wrote: post #13

Of the main facets of the problem, the vulnerability bothered me less than their obviously poor attitude towards fixing it in a responsible timeline, and that bothered me less than the discovery that they were running an always-active webserver to assist call launches and reinstallation. Is that a common thing that programs do? Should I be expected to portscan myself frequently to see if software is unexpectedly runn…

Yeah, lots of programs do that. The problem is (1) what kind of things the daemon did, (2) how they reacted to the disclosure with PR bullshit

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#24

Post by notatoad »

notafraudster wrote: post #13

Of the main facets of the problem, the vulnerability bothered me less than their obviously poor attitude towards fixing it in a responsible timeline, and that bothered me less than the discovery that they were running an always-active webserver to assist call launches and reinstallation. Is that a common thing that programs do? Should I be expected to portscan myself frequently to see if software is unexpectedly runn…

Not only is it common, there was an article about "how to write performant electron apps" at the top of HN last week explaining exactly why you should do that.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#25

Post by eeeeeeeeeeeee »

Glad to see the company is changing course, but I’m not sure it would have happened without the public shaming. I want companies to fix things because something is insecure and it endangers the public, not because they have their feet to the fire.

I know companies don’t always respond right the first time, I know I haven’t, but Zoom had over 90 days to consider their responses and possible options / software changes. Instead, they were dismissive of the entire thing and only changed course after loud public pressure.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#26

Post by smaili »

> But we also recognize and respect the view of others that say they don’t want to have an extra process installed on their local machine. So that’s why we made the decision to remove that component — despite the fact that it’s going to require an extra click from Safari.

Am I reading this correctly, their CIO believes it's the "extra process" that people are concerned about -- not the webcam vulnerability?

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#27

Post by asveikau »

notafraudster wrote: post #13

Of the main facets of the problem, the vulnerability bothered me less than their obviously poor attitude towards fixing it in a responsible timeline, and that bothered me less than the discovery that they were running an always-active webserver to assist call launches and reinstallation. Is that a common thing that programs do? Should I be expected to portscan myself frequently to see if software is unexpectedly runn…

> How much battery am I losing to this stuff?

Unless they coded something very stupidly, a listening socket that nobody connects to is not going to be on the CPU. It will be asleep waiting to be woken up by actual activity.

Not sure if any operating system would use that socket as a reason not to enter a low power state but I kind of doubt that.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#29

Post by asveikau »

graeme wrote: post #15
notafraudster wrote: post #13

Of the main facets of the problem, the vulnerability bothered me less than their obviously poor attitude towards fixing it in a responsible timeline, and that bothered me less than the discovery that they were running an always-active webserver to assist call launches and reinstallation. Is that a common thing that programs do? Should I be expected to portscan myself frequently to see if software is unexpectedly runn…

The verge article mentions it's reasonably common and mentions some programs that do it. From the article, a tweet -------- They are far from alone, a quick `lsof -i | grep LISTEN` shows that I have: Spotify, Keybase, KBFS, iTunes, Numi, https://t.co/MVSAJgN9yY… All running locally listening web servers. — Matthew Gregg (@braintube) July 9, 2019

Did they just imply that every listening socket is a web server?

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#30

Post by Bluestrike2 »

smaili wrote: post #26

> But we also recognize and respect the view of others that say they don’t want to have an extra process installed on their local machine. So that’s why we made the decision to remove that component — despite the fact that it’s going to require an extra click from Safari. Am I reading this correctly, their CIO believes it's the "extra process" that people are concerned about -- not the webcam vulnerability?

Amusingly enough, they never actually describe that part as a vulnerability in their blog post. It's a "concern" about a "seamless join process." The word only gets used with regards to the DOS vulnerability, which is only part of the problem. I get the need to at least try and spin things, but it's kind of obvious in this example. And given how people tend to get antsy when they start thinking about possibly being spied on through their webcams, downplaying it is probably counterproductive.
Post reply on HN