Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom fixes major Mac webcam security flaw with emergency patch

theverge.com

Post reply on HN
Print view View original

81–90 of 151 posts

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#81

Post by snowwolf »

vinay_ys wrote: post #62

Let us be clear. Running a local helper agent that accepts properly formatted requests (includes authn/authz) to provide a valid expected functionality is a perfectly valid architectural choice for a full-fledged desktop computer and we shouldn't throw out this capability. The mistakes I see here are: - UX Dark Patterns – making uninstall hard/duplicitous - Helper process having security vulnerability - unauthenticat…

> Unless the cost equation changes, it is hard to get business users to change their priority

With GDPR getting teeth (see recent fines of BA and Marriott) for security breaches, I think this is the beginning of that cost equation changing.

But also bear in mind this is a company who have someone with the title Chief Information Security Officer. If alarm bells didn’t start ringing for that person when this vulnerability was reported, then they likely aren’t the right person for the job. Especially as Zoom have customers in the EU so that person is also likely their nominated Data Protection Officer and should therefore be well aware of the privacy requirements imposed by GDPR and the penalties for a privacy breach (which someone secretly recording webcam footage would surely qualify as).

As for local helper agents accessible from the internet, you only need to browse google project zero to see what a bad idea that is.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#82

Post by svenfaw »

asveikau wrote: post #29
graeme wrote: post #15

Earlier quoted context omitted.

The verge article mentions it's reasonably common and mentions some programs that do it. From the article, a tweet -------- They are far from alone, a quick `lsof -i | grep LISTEN` shows that I have: Spotify, Keybase, KBFS, iTunes, Numi, https://t.co/MVSAJgN9yY… All running locally listening web servers. — Matthew Gregg (@braintube) July 9, 2019

Did they just imply that every listening socket is a web server?

They are mixing apples and oranges indeed.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#83

Post by krageon »

o-__-o wrote: post #45
irq wrote: post #33

Earlier quoted context omitted.

And this is why anyone who trusts that organization in any way moving forward is a fool.

Nah leadership can change, see Microsoft and apple

Microsoft and Apple have barely changed in all the ways they are bad though. Specifically Microsoft has just moved to a different place in the embrace expand extinguish cycle. Give it a few years and everyone will hate them again (and maybe be surprised that it happened at all) because they did something unethical.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#84

Post by red_admiral »

asveikau wrote: post #27
notafraudster wrote: post #13

Of the main facets of the problem, the vulnerability bothered me less than their obviously poor attitude towards fixing it in a responsible timeline, and that bothered me less than the discovery that they were running an always-active webserver to assist call launches and reinstallation. Is that a common thing that programs do? Should I be expected to portscan myself frequently to see if software is unexpectedly runn…

> How much battery am I losing to this stuff? Unless they coded something very stupidly, a listening socket that nobody connects to is not going to be on the CPU. It will be asleep waiting to be woken up by actual activity. Not sure if any operating system would use that socket as a reason not to enter a low power state but I kind of doubt that.

> Unless they coded something very stupidly

In this particular case, I don't think we can exclude that possibliity.

In general of course I agree with you.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#85

Post by rossng »

rvp-x wrote: post #80
Phlarp wrote: post #61

Earlier quoted context omitted.

Most corporate bounty programs are going to include an NDA and following their release schedule. No corporate legal department is going to sign off on a bounty program that would both pay third parties for bugs and allow outside researchers to unilaterally decide when to disclose the bug to a wider audience.

They weren't going to fix it without the bug being made public.

This seems par for the course for their support. I tried to report that their signup form automatically, silently deletes spaces from your password (!?). After a painful process of trying to explain the issue, it was summarily ignored.

They didn't really seem to understand that it was a bug.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#86

Post by beobab »

rossng wrote: post #85
rvp-x wrote: post #80

Earlier quoted context omitted.

They weren't going to fix it without the bug being made public.

This seems par for the course for their support. I tried to report that their signup form automatically, silently deletes spaces from your password (!?). After a painful process of trying to explain the issue, it was summarily ignored. They didn't really seem to understand that it was a bug.

Is noisily deleting passwords acceptable in your eyes?

(i.e. "Your password contains spaces, which is disallowed by our policy. Please try again.")

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#87

Post by yoz-y »

oil25 wrote: post #70
diafygi wrote: post #42

I'm confused. Does the patch now make it to where if you drag the app to the trash, it actually uninstalls?

A macOS "app" is just a directory with an executable binary and some convenient helper files for Finder. Dragging it to the trash does not remove artifacts, such as logs, supporting binaries, even methods of persistence, which may get placed somewhere else on the filesystem as part of a typical installation. This is not unique to Zoom or even Apple operating systems.

One thing I'd like to see (and this is definitely doable on macOS side) is that if you trash a .app, the OS would automatically revoke all permissions to it.

If this were done then even with the sneaky reinstalling, the user would be alerted by a system dialog requesting access to their webcam.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#88

Post by kabwj »

ajna91 wrote: post #32
PunksATawnyFill wrote: post #7

Earlier quoted context omitted.

Exactly. My company is actively shopping for a conferencing tool, and Zoom just ensured that it's eliminated.

Anger is certainly justified, but it should give way to reconciliation once the offending party truly repents. Do we want a world of people who change their ways, even if for somewhat impure reasons, or a world in which no one ever does because it's pointless?

> Do we want a world of people who change their ways, even if for somewhat impure reasons, or a world in which no one ever does because it's pointless?

You forgot another option: not making the mistake in the first place.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#89

Post by rossng »

beobab wrote: post #86
rossng wrote: post #85

Earlier quoted context omitted.

This seems par for the course for their support. I tried to report that their signup form automatically, silently deletes spaces from your password (!?). After a painful process of trying to explain the issue, it was summarily ignored. They didn't really seem to understand that it was a bug.

Is noisily deleting passwords acceptable in your eyes? (i.e. "Your password contains spaces, which is disallowed by our policy. Please try again.")

It's annoying in either case. Passwords should be any string I want! You're just going to hash it anyway.

I found it particularly egregious that Zoom's form auto-trims any spaces from the end of the string - so they are deleted as you type with no feedback (unless you happen to be watching the dots flicker).

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#90

Post by LaGrange »

vinay_ys wrote: post #74
colechristensen wrote: post #68

Earlier quoted context omitted.

Helper agents are dark patterns. Unless installing an always running service on my device is directly related to the intended functionality of your software, setting one up is unwelcome and deceptive. Especially when it is done to work around existing security controls.

I disagree with declaring all helper agents as dark patterns. From a regular user point of view, it would be acceptable to have a helper agent as long as it follows: - platform provided background process methodology (example: launchd could launch your process when you hit the socket), - and it is made clearly apparent that such a thing is installed on your system (say, via system preferences panel, via status bar ic…

> From a regular user point of view, it would be acceptable

It would be not, stop pretending acquiring consent from a statistical model counts as acquiring consent from the actual user.

Thing you wrote may make it acceptable for you, but certainly ain't sufficient for me.

Post reply on HN