Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom fixes major Mac webcam security flaw with emergency patch

theverge.com

Post reply on HN
Print view View original

61–70 of 151 posts

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#61

Post by Phlarp »

crazysim wrote: post #58
eeeeeeeeeeeee wrote: post #25

Glad to see the company is changing course, but I’m not sure it would have happened without the public shaming. I want companies to fix things because something is insecure and it endangers the public, not because they have their feet to the fire. I know companies don’t always respond right the first time, I know I haven’t, but Zoom had over 90 days to consider their responses and possible options / software changes.…

What's scary is that they have a bounty program but it comes with a gag catch.

Most corporate bounty programs are going to include an NDA and following their release schedule. No corporate legal department is going to sign off on a bounty program that would both pay third parties for bugs and allow outside researchers to unilaterally decide when to disclose the bug to a wider audience.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#62

Post by vinay_ys »

Let us be clear. Running a local helper agent that accepts properly formatted requests (includes authn/authz) to provide a valid expected functionality is a perfectly valid architectural choice for a full-fledged desktop computer and we shouldn't throw out this capability.

The mistakes I see here are:

- UX Dark Patterns – making uninstall hard/duplicitous

- Helper process having security vulnerability - unauthenticated requests, providing unnecessary privileged operations like update/reinstall etc.

- Providing the control of participant video on/off to meeting host

- Not acknowledging the mistakes quickly and fixing them fast. Being defensive and using 'others do it too' excuse.

Also, in an internal fight for resources/prioritization and just plain philosophical alignment between security vulnerabilities vs UX funnel optimization (reduce number of clicks), in a company like Zoom, I am not at all surprised that UX side own always and security side lost and it took public pressure the shift the balance. Anyone here who has been in this situation knows what I'm talking about.

Unless the cost equation changes, it is hard to get business users to change their priority – from their perspective, they didn't understand what the heck their internal security guy was talking about. It would have been one person/security-team who they normally don't interact with. So why will they listen to that guy over the UX Product guy who they interact with daily, who they see as the one who built the hockey stick growth in their customer NPS scores and that guy wasn't happy about adding the extra click back.

So, only workable answer I see is public outrage like this (still not very scalable or consistent) and better yet, legal protections/regulations that make it extremely expensive for companies to ignore this stuff.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#63

Post by pdkl95 »

yumraj wrote: post #38

I wonder if instead of the usual 90-day notice a slightly better approach would be an initial partial public disclosure of the issue, without divulging the actual exploit, and the fact that it had been communicated to the company so that a public countdown of the 90-day window can happen. The exploit can then be divulged to the public, automatically, on the expiration of the 90-day window, regardless of whether it's…

There isn't a 1-size-fits-all solution to this type of situation. Giving the company a reasonable time[1] to fix it is a good guideline to start with, but determining the best approach to use requires making several judgment calls.

Is the exploit already being used in the wild? Should affected users be doing something asap to protect themselves? How quickly could someone transform your disclosure into something malicious? How much risk are we forcing the users to bear while we wait for a self-imposed arbitrary time limit to expire. Is there an actual benefit to be gained by delaying public disclosure? (Is the company using the time responsibly to implement a fix, or are they denying the problem exists?

Handling a public disclosure meas adapting to the specific risks of the situation.

[1] I would say 30 days is more appropriate, with the option to delay the public announcement if the company has handled the situation well and is working on the fix, but needs more time for a legitimate technical reason.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#64

Post by Jedi72 »

pavs wrote: post #51
Jedi72 wrote: post #28

The security flaw isnt even the outrageous part. It was secretly installing webservers that dont even remove themselves when you uninstall the app that makes them scum.

Dropbox also does this, so does a lot of other popular programs. do `lsof -i | grep LISTEN` to find out what server is running on your machine.

In my case there isnt anything I didnt expect. Also closing the apps that were running e.g. RabbitMQ actually stopped the webservers.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#65

Post by oil25 »

Jedi72 wrote: post #28

The security flaw isnt even the outrageous part. It was secretly installing webservers that dont even remove themselves when you uninstall the app that makes them scum.

> It was secretly installing webservers that dont even remove themselves when you uninstall the app that makes them scum.

To be fair, dragging an "app" to Trash does not constitute un-installation. It was a poor design decision to implement features using a local web server, but let's not be so quick to attribute covert, malicious intentions.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#66

Post by Phlarp »

Jedi72 wrote: post #28

The security flaw isnt even the outrageous part. It was secretly installing webservers that dont even remove themselves when you uninstall the app that makes them scum.

That's not a bug, it's a feature! The server can "seamlessly" (surreptitiously) re-install the app when hitting one of their "join room" links.

At least some of the reason for putting it there in the first place is so it can hang around and be insecure in case they want to use it later.

The really insidious part is that users who uninstalled it previously won't receive this update removing it now. And a vanishingly small percentage of those will see this and respond by removing it.

I certainly won't ever hit the install button on a video conferencing browser extension ever again. If Zoom was doing this I have zero confidence in

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#67

Post by oil25 »

tambourine_man wrote: post #60

The more a think about it, the more a I come to the conclusion that we need a mixed computing paradigm. For many tasks (probably most and certainly for most people) the iOS model is the best. It is, however way too restrictive for a number of use cases. Prohibitively so. Imagine two very different and isolated environments. Terminal, compilers, file managers in one, most other software in the other. With perhaps shar…

Qubes OS is an operating system which pursues exactly these design goals, and unlike iOS, it is free and open source.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#68

Post by colechristensen »

vinay_ys wrote: post #62

Let us be clear. Running a local helper agent that accepts properly formatted requests (includes authn/authz) to provide a valid expected functionality is a perfectly valid architectural choice for a full-fledged desktop computer and we shouldn't throw out this capability. The mistakes I see here are: - UX Dark Patterns – making uninstall hard/duplicitous - Helper process having security vulnerability - unauthenticat…

Helper agents are dark patterns.

Unless installing an always running service on my device is directly related to the intended functionality of your software, setting one up is unwelcome and deceptive. Especially when it is done to work around existing security controls.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#69

Post by larrysalibra »

colechristensen wrote: post #68
vinay_ys wrote: post #62

Let us be clear. Running a local helper agent that accepts properly formatted requests (includes authn/authz) to provide a valid expected functionality is a perfectly valid architectural choice for a full-fledged desktop computer and we shouldn't throw out this capability. The mistakes I see here are: - UX Dark Patterns – making uninstall hard/duplicitous - Helper process having security vulnerability - unauthenticat…

Helper agents are dark patterns. Unless installing an always running service on my device is directly related to the intended functionality of your software, setting one up is unwelcome and deceptive. Especially when it is done to work around existing security controls.

Absolutely. If the user indicates they don't want your software running anymore, it should stop.

In Zoom's case, if the user exits the app, the web server keeps running. When the user uninstalled the app, the web server still keeps running.

The user twice said "I don't want Zoom's software running on my computer and both times Zoom ignored the user's request.

This behavior is both unethical AND malicious.

Edit: wrote up more thoughts on this: https://salibra.com/p/viral-growth-doesnt-mean-writing-virus...

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#70

Post by oil25 »

diafygi wrote: post #42

I'm confused. Does the patch now make it to where if you drag the app to the trash, it actually uninstalls?

A macOS "app" is just a directory with an executable binary and some convenient helper files for Finder. Dragging it to the trash does not remove artifacts, such as logs, supporting binaries, even methods of persistence, which may get placed somewhere else on the filesystem as part of a typical installation. This is not unique to Zoom or even Apple operating systems.
Post reply on HN