Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom fixes major Mac webcam security flaw with emergency patch

theverge.com

Post reply on HN
Print view View original

111–120 of 151 posts

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#111

Post by Jedi72 »

oil25 wrote: post #65
Jedi72 wrote: post #28

The security flaw isnt even the outrageous part. It was secretly installing webservers that dont even remove themselves when you uninstall the app that makes them scum.

> It was secretly installing webservers that dont even remove themselves when you uninstall the app that makes them scum. To be fair, dragging an "app" to Trash does not constitute un-installation. It was a poor design decision to implement features using a local web server, but let's not be so quick to attribute covert, malicious intentions.

Their latest patch they rushed out is basically just implementing uninstall the way it should be.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#112

Post by JadeNB »

krageon wrote: post #83
o-__-o wrote: post #45

Earlier quoted context omitted.

Nah leadership can change, see Microsoft and apple

Microsoft and Apple have barely changed in all the ways they are bad though. Specifically Microsoft has just moved to a different place in the embrace expand extinguish cycle. Give it a few years and everyone will hate them again (and maybe be surprised that it happened at all) because they did something unethical.

I think that we'll never see the same feelings about Microsoft as existed in its heyday precisely because those feelings weren't just about what Microsoft tried to do, but actually about what it did. Microsoft will (probably) never again enjoy the hegemony it once did; so, however evilly it acts, it'll never be able to translate its evil deeds into the same impact that they once had.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#113

Post by Sahhaese »

akersten wrote: post #11

Stories like this are wonderful evidence of the effectiveness of public disclosure of security vulnerabilities, and are always heartwarming to see. Remember, 90-day disclosure windows are just a courtesy .

This is why I consider bug bounty programs problematic, because they've been co-opted from a system to manage responsible disclosure to a system to contain and manage non-disclosure.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#114

Post by o-__-o »

colechristensen wrote: post #75
larrysalibra wrote: post #69

Earlier quoted context omitted.

Absolutely. If the user indicates they don't want your software running anymore, it should stop. In Zoom's case, if the user exits the app, the web server keeps running. When the user uninstalled the app, the web server still keeps running. The user twice said "I don't want Zoom's software running on my computer and both times Zoom ignored the user's request. This behavior is both unethical AND malicious. Edit: wrote…

I don't want the web server running when Zoom is running either. Video conferencing has nothing to do with a web server or any server listening to ports. When I install a video conferencing client its only function should be me initiating a connection.

Then why don’t you switch to webex?

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#115

Post by o-__-o »

colechristensen wrote: post #77
vinay_ys wrote: post #74

Earlier quoted context omitted.

I disagree with declaring all helper agents as dark patterns. From a regular user point of view, it would be acceptable to have a helper agent as long as it follows: - platform provided background process methodology (example: launchd could launch your process when you hit the socket), - and it is made clearly apparent that such a thing is installed on your system (say, via system preferences panel, via status bar ic…

But for what? My caveat is that a helper service is acceptable when it is doing something necessary for the basic function of the software. Virus scanners, file sync, and things which are obviously servers fit the bill. Not much else I can think of does.

Libreoffice has an agent that preloads java bins to make the startup time comparable to MS Office. There are valid uses for startup agents, please get over yourself

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#116

Post by latexr »

eeeeeeeeeeeee wrote: post #25

Glad to see the company is changing course, but I’m not sure it would have happened without the public shaming. I want companies to fix things because something is insecure and it endangers the public, not because they have their feet to the fire. I know companies don’t always respond right the first time, I know I haven’t, but Zoom had over 90 days to consider their responses and possible options / software changes.…

> but I’m not sure it would have happened without the public shaming.

It wouldn’t. From the article:

> The move is a surprise reversal of Zoom’s previous stance, in which the company treated the vulnerability as “low risk” and defended its use

They’re backpedaling because of the bad press, not because they think this is better for users. And if they don’t believe what they did was wrong (if they did, they would have never done it or would have fixed it previously), it’s just a matter of time until they pull other crap like this. This is not the only user-hostile behaviour of their app[1], it’s just the most egregious we know of.

[1]: https://news.ycombinator.com/item?id=20390613

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#117

Post by o-__-o »

dannyw wrote: post #106
colechristensen wrote: post #76

Earlier quoted context omitted.

I want an operating system with a permissions model which specifically forbids this kind of thing. My Linux desktops are also always full of processes which I have to dig to figure the purpose, unless I build my own distribution it's hard to make anything work which feels satisfactorily under control.

So how does your OS differenate between Apache and a local helper?

Well windows pops open a huge GD window that allows you to decide firewall rules if it notices a change

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#118

Post by o-__-o »

jomar wrote: post #72
notafraudster wrote: post #13

Of the main facets of the problem, the vulnerability bothered me less than their obviously poor attitude towards fixing it in a responsible timeline, and that bothered me less than the discovery that they were running an always-active webserver to assist call launches and reinstallation. Is that a common thing that programs do? Should I be expected to portscan myself frequently to see if software is unexpectedly runn…

> running an always-active webserver It's one thing to run a webserver while your software is running. It's quite another to leave it installed and running even after the user has uninstalled your application. And to actively evade the user's attempts to remove the webserver component. Until this update, if you removed ZoomOpener from your Login Items and via `rm -rf ~/.zoomus`, it would miraculously reappear every t…

Or be like me and kill all zoom processes after you leave because you are afraid someone may be watching your next wank session

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#119

Post by code4tee »

The Zoom security team has a lot to answer for on this one. They subverted built in security to only then fall victim to the very thing that would have been stopped by what they subverted.

Good on Zoom to do a rapid course reversal here although naturally trust is now damaged given they only came to their senses under strong public pressure. Also a good case study of how putting “user experience” over security can come back to burn you.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#120

Post by o-__-o »

enneff wrote: post #39
yumraj wrote: post #38

I wonder if instead of the usual 90-day notice a slightly better approach would be an initial partial public disclosure of the issue, without divulging the actual exploit, and the fact that it had been communicated to the company so that a public countdown of the 90-day window can happen. The exploit can then be divulged to the public, automatically, on the expiration of the 90-day window, regardless of whether it's…

More often than not announcing the existence of a vulnerability is enough to motivate people to find it. It’s much easier to find something that you know is there than to just experiment blindly.

Yes. I learned the security release process for a major open source software and it became trivial to determine when vulnerabilities are patched and knowledge of their build process gives you an exact window to exploit said 0-day
Post reply on HN