Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerability in the Mac Zoom client allows malicious websites to enable camera

medium.com

Post reply on HN
Print view View original

451–460 of 473 posts

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#451

Post by picklemorty »

robinhouston wrote: post #183

Zoom’s response to this[1] is a wonderful example of how not to respond to security issues. It includes the classic tropes: * Our users don’t care about security. > Our video-first platform is a key benefit to our users around the world, and our customers have told us that they choose Zoom for our frictionless video communications experience. * We have no way of knowing if this has been exploited in the wild, so it’s…

>> Ultimately, Zoom decided not to change the application functionality

Yeah "functionality".

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#452

Post by wbl »

pryce wrote: post #440
clinta wrote: post #256

Earlier quoted context omitted.

Bad behavior for unknown protocols is not a MacOS specific problem. Instead of registering things with Apple, a link to the handler should be included in the protocol link and the OS should send the user there if a handler is not installed. Something like " rel="nofollow">https://zoom.us/install">

Your proposal is the closest thing to the best solution I have seen. It still has at least several issues: * When Zoom is already installed: - should be able to handle most instances - needs to account for version management, eg installed version zoom could still be version that is too old to process the uri correctly. Version could be in the uri. When Zoom is not installed: - an information dialog needs to be someho…

The UA could go to the handler site which would be a landing page.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#454

Post by cozzyd »

fluffything wrote: post #447
rahoulb wrote: post #267

Earlier quoted context omitted.

I realised I had a paid account, so I've cancelled that too. And I've also reported them to Apple, after seeing that the ZoomOpener app reinstalls the client - which is completely and utterly unacceptable.

Yeah, when I read this, I said WAT. How on earth does Apple allow this ? I'm not excusing Zoom, but this is Apples fault.

I'm not sure how this can be construed as Apple's fault (and I've never owned any Apple products). A general purpose OS runs what the user installs. This is purely on zoom for backdooring the system. I'm not sure how many Mac users bother running ps every once in a while, but it seems like it wouldn't be that hard to detect either.

That said I have to say zoom's the only businessy meeting client I've used that doesn't require running through hoops on Linux. Maybe I should check if there are any devious backdoors installed on my system...

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#455

Post by vtrips »

saganus wrote: post #160
Jlleitschuh wrote: post #27

Hi I'm the author, AMA Or come hang out in the party chat! Use the exploit to join: https://jlleitschuh.org/zoom_vulnerability_poc/zoompwn_ifram...

Stayed on that call for over 3 hours and I just have to say that it was one of the best experiences I've had on the internet in years . People behaved pretty good considering it was a random public Zoom call (except for a few trolls, but nothing really bad). It just felt like the internet of yore where random people would meet and chat and just be nice to each other. Lots of interesting topics, people from all over t…

I listened for a long time, learned a lot as well.

This made me think - is there any website that facilitates you to do such public conferences on zoom like clients. Basically a bunch of people who are interested in a certain topic could join and chime in - go from topic to topic. It could be a very healthy discussion. People could post and schedule meetings and essentially anyone who wants to learn could join. I do listen to podcasts often, but such meetings would be pretty different than podcasts. Does this already exist?

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#456

Post by smarx007 »

kccqzy wrote: post #430
smarx007 wrote: post #384

Here is how I fixed the problem for myself temporarily: 1. Quit Zoom. 2. Kill the ZoomOpener process. 3. cd ~; mv .zoomus/ .zoomus.off/ 4. mkdir .zoomus && sudo chown root .zoomus; sudo chmod 600 .zoomus Now, the Safari permission prompt will show up every time you click on a Zoom link.

It should be pointed that an empty directory (even if owned by root) placed in your home directory can still be deleted by you, without requiring root. You need to place a file into the directory. Or if you want something drastic, run chflags simmutable ~/.zoomus as root. This will make sure that not even root can delete it.

That is actually true, just tested it. There is always something new to learn!

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#457

Post by dclowd9901 »

wl wrote: post #298
robbiemitchell wrote: post #294

Can’t Zoom add their own simple prompt to the local server which gets confirmation from the user that they want to join the meeting? Just one more click and not “nasty”. It could even be 4 different Join buttons: - Video & Audio - Video Only - Audio Only - No Video or Audio

Without the local webserver, they fall back to Safari's URL handler, which asks whether or not you wan't to start the application in question. They went through a lot of trouble to implement this ridiculous solution to avoid the kind of thing you describe.

Which is why they're doubling down on not fixing it.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#458

Post by dclowd9901 »

abvdasker wrote: post #438

I always thought it was paranoid to keep tape over your webcam, but this makes a pretty good case for doing that as a last line of defense. I also want to express my complete disbelief that Zoom basically installed a back door on all its users' machines. It's hard to imagine a competent engineer not understanding the security implications of building something like this. I have no special security expertise, so when…

In this day and age, I wish Apple and other laptop manufacturers had a hardwired power switch on the camera.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#459

Post by dclowd9901 »

etaioinshrdlu wrote: post #139

Has anyone torn down recent-era Macbooks to see if the camera LED is still hardwired to the camera power and a reliable indicator that can't be software disabled?

I don't know what you mean by "still". Apparently it was software disable-able up to the 2011 mbps.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#460

Post by smarx007 »

smarx007 wrote: post #384

Here is how I fixed the problem for myself temporarily: 1. Quit Zoom. 2. Kill the ZoomOpener process. 3. cd ~; mv .zoomus/ .zoomus.off/ 4. mkdir .zoomus && sudo chown root .zoomus; sudo chmod 600 .zoomus Now, the Safari permission prompt will show up every time you click on a Zoom link.

UPDATE no need to do this any more. Zoom actually conceded they were wrong and pushed out an update that removes the local webserver: https://imgur.com/gallery/INvYaH4 (from the discussion below in the thread).
Post reply on HN