Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom fixes major Mac webcam security flaw with emergency patch

theverge.com

Post reply on HN
Print view View original

71–80 of 151 posts

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#71

Post by colechristensen »

tambourine_man wrote: post #60

The more a think about it, the more a I come to the conclusion that we need a mixed computing paradigm. For many tasks (probably most and certainly for most people) the iOS model is the best. It is, however way too restrictive for a number of use cases. Prohibitively so. Imagine two very different and isolated environments. Terminal, compilers, file managers in one, most other software in the other. With perhaps shar…

I want a web browser with fewer functions and permissions that is aligned with my interests to dominate most of my computer interactions. That would handle most things that most people do on their computers.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#72

Post by jomar »

notafraudster wrote: post #13

Of the main facets of the problem, the vulnerability bothered me less than their obviously poor attitude towards fixing it in a responsible timeline, and that bothered me less than the discovery that they were running an always-active webserver to assist call launches and reinstallation. Is that a common thing that programs do? Should I be expected to portscan myself frequently to see if software is unexpectedly runn…

> running an always-active webserver

It's one thing to run a webserver while your software is running.

It's quite another to leave it installed and running even after the user has uninstalled your application.

And to actively evade the user's attempts to remove the webserver component. Until this update, if you removed ZoomOpener from your Login Items and via `rm -rf ~/.zoomus`, it would miraculously reappear every time you participated in another Zoom meeting. (To stop this, you had to touch .zoomus as a file or otherwise make it harder to recreate as a directory. But if they had chosen to, Zoom could have coded around these countermeasures thus leading to an arms race, at least for a while.)

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#73

Post by xref »

colechristensen wrote: post #68
vinay_ys wrote: post #62

Let us be clear. Running a local helper agent that accepts properly formatted requests (includes authn/authz) to provide a valid expected functionality is a perfectly valid architectural choice for a full-fledged desktop computer and we shouldn't throw out this capability. The mistakes I see here are: - UX Dark Patterns – making uninstall hard/duplicitous - Helper process having security vulnerability - unauthenticat…

Helper agents are dark patterns. Unless installing an always running service on my device is directly related to the intended functionality of your software, setting one up is unwelcome and deceptive. Especially when it is done to work around existing security controls.

That’s the meat of it, Zoom wanted an app feature macOS said was a no-no so they coded up an insecure workaround. On iOS that would get your app pulled at the least.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#74

Post by vinay_ys »

colechristensen wrote: post #68
vinay_ys wrote: post #62

Let us be clear. Running a local helper agent that accepts properly formatted requests (includes authn/authz) to provide a valid expected functionality is a perfectly valid architectural choice for a full-fledged desktop computer and we shouldn't throw out this capability. The mistakes I see here are: - UX Dark Patterns – making uninstall hard/duplicitous - Helper process having security vulnerability - unauthenticat…

Helper agents are dark patterns. Unless installing an always running service on my device is directly related to the intended functionality of your software, setting one up is unwelcome and deceptive. Especially when it is done to work around existing security controls.

I disagree with declaring all helper agents as dark patterns.

From a regular user point of view, it would be acceptable to have a helper agent as long as it follows:

- platform provided background process methodology (example: launchd could launch your process when you hit the socket),

- and it is made clearly apparent that such a thing is installed on your system (say, via system preferences panel, via status bar icon menu, and via in-app preferences panel),

- and it does cleanly uninstall as part of a simple standard regular uninstall.

And from a technical/security point of view, it would be acceptable if it:

- has minimal necessary privileges and proper separation of concerns.

- and does only what it needs to provide a user-expected functionality and doesn't do random egregious things.

- has secure ways to allow only expected/authorized caller to talk to it.

- does not violate any platform guidelines or tries to circumvent protections.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#75

Post by colechristensen »

larrysalibra wrote: post #69
colechristensen wrote: post #68

Earlier quoted context omitted.

Helper agents are dark patterns. Unless installing an always running service on my device is directly related to the intended functionality of your software, setting one up is unwelcome and deceptive. Especially when it is done to work around existing security controls.

Absolutely. If the user indicates they don't want your software running anymore, it should stop. In Zoom's case, if the user exits the app, the web server keeps running. When the user uninstalled the app, the web server still keeps running. The user twice said "I don't want Zoom's software running on my computer and both times Zoom ignored the user's request. This behavior is both unethical AND malicious. Edit: wrote…

I don't want the web server running when Zoom is running either.

Video conferencing has nothing to do with a web server or any server listening to ports.

When I install a video conferencing client its only function should be me initiating a connection.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#76

Post by colechristensen »

xref wrote: post #73
colechristensen wrote: post #68

Earlier quoted context omitted.

Helper agents are dark patterns. Unless installing an always running service on my device is directly related to the intended functionality of your software, setting one up is unwelcome and deceptive. Especially when it is done to work around existing security controls.

That’s the meat of it, Zoom wanted an app feature macOS said was a no-no so they coded up an insecure workaround. On iOS that would get your app pulled at the least.

I want an operating system with a permissions model which specifically forbids this kind of thing.

My Linux desktops are also always full of processes which I have to dig to figure the purpose, unless I build my own distribution it's hard to make anything work which feels satisfactorily under control.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#77

Post by colechristensen »

vinay_ys wrote: post #74
colechristensen wrote: post #68

Earlier quoted context omitted.

Helper agents are dark patterns. Unless installing an always running service on my device is directly related to the intended functionality of your software, setting one up is unwelcome and deceptive. Especially when it is done to work around existing security controls.

I disagree with declaring all helper agents as dark patterns. From a regular user point of view, it would be acceptable to have a helper agent as long as it follows: - platform provided background process methodology (example: launchd could launch your process when you hit the socket), - and it is made clearly apparent that such a thing is installed on your system (say, via system preferences panel, via status bar ic…

But for what?

My caveat is that a helper service is acceptable when it is doing something necessary for the basic function of the software.

Virus scanners, file sync, and things which are obviously servers fit the bill. Not much else I can think of does.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#78

Post by Deimorz »

diafygi wrote: post #42

I'm confused. Does the patch now make it to where if you drag the app to the trash, it actually uninstalls?

According to one of the updates in their response blog post (https://blog.zoom.us/wordpress/2019/07/08/response-to-video-...), you need to choose it through the Zoom menu bar:

> We’re adding a new option to the Zoom menu bar that will allow users to manually and completely uninstall the Zoom client, including the local web server. Once the patch is deployed, a new menu option will appear that says, “Uninstall Zoom.” By clicking that button, Zoom will be completely removed from the user’s device along with the user’s saved settings.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#79

Post by ben0x539 »

tambourine_man wrote: post #60

The more a think about it, the more a I come to the conclusion that we need a mixed computing paradigm. For many tasks (probably most and certainly for most people) the iOS model is the best. It is, however way too restrictive for a number of use cases. Prohibitively so. Imagine two very different and isolated environments. Terminal, compilers, file managers in one, most other software in the other. With perhaps shar…

And then every clown shop would insist that you install their agent program inside the trusted partition.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#80

Post by rvp-x »

Phlarp wrote: post #61
crazysim wrote: post #58

Earlier quoted context omitted.

What's scary is that they have a bounty program but it comes with a gag catch.

Most corporate bounty programs are going to include an NDA and following their release schedule. No corporate legal department is going to sign off on a bounty program that would both pay third parties for bugs and allow outside researchers to unilaterally decide when to disclose the bug to a wider audience.

They weren't going to fix it without the bug being made public.
Post reply on HN