just came to say: lol
Vulnerability in the Mac Zoom client allows malicious websites to enable camera
441–450 of 473 posts
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#442Earlier quoted context omitted.
Yes. I don't think there is any good reason to use the image hack. Further, they could have made the CORS lock only the production zoom domain for better security...
A user on Reddit suggested the image url hack was a way to bypass mixed content blocking from the zoom https site to the local http server: https://www.reddit.com/r/programming/comments/cavblo/zoom_ze... > One potential hiccup I encountered was that Firefox blocked my XHR request due to a policy against "mixed active content". This was because my origin site was accessed through an HTTPS connection and the localhost…
Very interesting, thank you! This is definitely no excuse for not filtering the origins -- they just don't get it for free through passive but they still need to do it, or since they are a native app, generate and install a cert -- but it could be the motivation for the decision to go this route which is really useful to know.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#443Earlier quoted context omitted.
I did this: 1. killed by process name, and zoom app will 2. fail to start its opener and 3. fail to reinstall it: killall ZoomOpener chmod -x .zoomus/ZoomOpener.app/Contents/MacOS/ZoomOpener sudo chown -R nobody:nobody .zoomus/ZoomOpener.app
Doing it that way results in a nuisance prompt from Zoom every time you launch it complaining that it can't launch the opener. Here's a modified version that deletes the app, removes the LoginItem if it exists, and makes the ~/.zoomus directory unwritable, which achieves the same thing but avoids the nag: killall ZoomOpener osascript -e 'tell application "System Events" to delete login item "ZoomOpener"' rm -rf ~/.zo…
Interesting, I don't get this nuisance, even after their update.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#444> [UPDATE 2:35 pm PT, Tuesday 7/9] The July 9 patch to the Zoom app on Mac devices detailed below is now live. You may see a pop-up in Zoom to update your client, download it at zoom.us/download, or check for updates by opening your Zoom app window, clicking zoom.us in the top left corner of your screen, and then clicking Check for Updates.
--
Looks like Zoom have decided to remove the Web Server from MAC and pushed out an update directly to the clients (before this, you couldn't get the Zoom Client to check for updates automatically) - The popup appeared post meeting.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#445> This vulnerability leverages the amazingly simple Zoom feature where you can just send anyone a meeting link (for example https://zoom.us/j/492468757 ) and when they open that link in their browser their Zoom client is magically opened on their local machine. I was curious about how this amazing bit of functionality was implemented and how it had been implemented securely. Come to find out, it really hadn’t been im…
If Universal Links was supported on macOS we could get the best of both worlds. The web server basically presents meta-data in a JSON-file (in the .well-known directory) which Safari/iOS uses to launch the app if it is installed, and otherwise just renders the webpage [0]. The app contains information about which domains it allows itself to be opened from which would fix this issue. [0]: https://developer.apple.com/l…
Universal Links will be supported on macOS Catalina. Reference: https://developer.apple.com/videos/play/wwdc2019/717/
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#446Earlier quoted context omitted.
Bad behavior for unknown protocols is not a MacOS specific problem. Instead of registering things with Apple, a link to the handler should be included in the protocol link and the OS should send the user there if a handler is not installed. Something like " rel="nofollow">https://zoom.us/install">
Your proposal is the closest thing to the best solution I have seen. It still has at least several issues: * When Zoom is already installed: - should be able to handle most instances - needs to account for version management, eg installed version zoom could still be version that is too old to process the uri correctly. Version could be in the uri. When Zoom is not installed: - an information dialog needs to be someho…
Those are some interesting points. I'm not convinced that versions should be in scope for this sort of thing though. If I'm writing a protocol handler, I think it's my responsibility to make sure my software can update itself, and make the default behavior that it should check for updates if it is given a URI it doesn't understand.
Secondly, version checks assume that the user wants to run this specific protocol handler. I as the user might prefer to run an open source non-official zoom client. I think the OS should only be trying to help me if I don't have any handler.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#447I asked Zoom support about this and they sent me to this page: https://blog.zoom.us/wordpress/2019/07/08/response-to-video-... The key thing here is they think this is a fair trade-off because Safari asks if you want to open Zoom. > This is a workaround to a change introduced in Safari 12 that requires a user to confirm that they want to start the Zoom client prior to joining every meeting. The local web server enabl…
I realised I had a paid account, so I've cancelled that too. And I've also reported them to Apple, after seeing that the ZoomOpener app reinstalls the client - which is completely and utterly unacceptable.
Yeah, when I read this, I said WAT.
How on earth does Apple allow this ? I'm not excusing Zoom, but this is Apples fault.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#448GoToMeeting and Zoom are two things I always insist not to use. There are perfectly acceptable online-only counterparts that don't need to infect my computer.
I'm curious what your objection is to GTM. I've been using it for a decade and have really come to see it as the only reliable option for us.
Its installs are not incremental. How many versions of GTM are currently installed on your computer? Last time I cleaned it up, I had six.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#449If you're interested in seeing if you're vulnerable to this, visit this website: http://zoomzeroday.com
...no thanks. The author already mentions links you can use to check literally no reason to advertise this unless you, OP, are being malicious and/or didn't read the actual article.
I did read the article, and I don't have malicious intent. I was just trying to make a more easily sharable URL for people trying to test if they are vulnerable. I include links to the medium article and an update that there is now an update released to fix this web server issue.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#450I just received this message prompting me to "Update now."
Release notes of 4.4.53932.0709:
## Remove local web server
- We are discontinuing the use of a local web server on Mac devices. Following the update, the local web server will be completely removed from the Zoom installation Option to uninstall Zoom
- Zoom users can now uninstall the Zoom desktop application and all of its components through the settings menu