461–470 of 473 posts
If you do this audio-only there isn’t a telltale LED on the camera to give away that you are doing it. I’m way more worried about audio bugging than a webcam (which really only has the user’s face)
Earlier quoted context omitted.
Stayed on that call for over 3 hours and I just have to say that it was one of the best experiences I've had on the internet in years . People behaved pretty good considering it was a random public Zoom call (except for a few trolls, but nothing really bad). It just felt like the internet of yore where random people would meet and chat and just be nice to each other. Lots of interesting topics, people from all over t…
I listened for a long time, learned a lot as well. This made me think - is there any website that facilitates you to do such public conferences on zoom like clients. Basically a bunch of people who are interested in a certain topic could join and chime in - go from topic to topic. It could be a very healthy discussion. People could post and schedule meetings and essentially anyone who wants to learn could join. I do…
However what I fear is that they will become like any other modern forum in that you will need heavy moderation, people will try to troll, etc.
The beautiful thing about Jonathan's call was it's spontaneity I think, and that everyone was so excited to talk about the vulnerability that the group had a single focus.
I might be too cynical so maybe it's a good idea, and if someone suggest a place/site/forum to have these kind of discussions I would definitely try it out.
Earlier quoted context omitted.
> Remove the local web server entirely Thank goodness. Sanity has prevailed. You know you've blown it when the following appears in a buzzfeed article about your software: > open the application called, “Terminal.” Copy and paste this text: lsof -i :19421. Press enter. You’ll get a string of mumbo jumbo. Underneath the text “PID,” copy the string of numbers underneath. Then type “kill -9” (without the quotes), add a…
Verified that the patch removes the web server. What I'd really like to see now is them addressing the fact that their initial response to this was terrible , as if whoever was making the decision had no idea how bad this design was from a security standpoint.
These factors point to a company that fundamentally doesn't take security very seriously. That's not a fast, easy, or cheap thing to change. I suspect it won't any time soon.
Earlier quoted context omitted.
Yes. I don't think there is any good reason to use the image hack. Further, they could have made the CORS lock only the production zoom domain for better security...
A user on Reddit suggested the image url hack was a way to bypass mixed content blocking from the zoom https site to the local http server: https://www.reddit.com/r/programming/comments/cavblo/zoom_ze... > One potential hiccup I encountered was that Firefox blocked my XHR request due to a policy against "mixed active content". This was because my origin site was accessed through an HTTPS connection and the localhost…
> This vulnerability leverages the amazingly simple Zoom feature where you can just send anyone a meeting link (for example https://zoom.us/j/492468757 ) and when they open that link in their browser their Zoom client is magically opened on their local machine. I was curious about how this amazing bit of functionality was implemented and how it had been implemented securely. Come to find out, it really hadn’t been im…
below down the post, zoom team said that this feat exists because Safari doesn’t have custom url scheme.
Has anyone torn down recent-era Macbooks to see if the camera LED is still hardwired to the camera power and a reliable indicator that can't be software disabled?
I don't know what you mean by "still". Apparently it was software disable-able up to the 2011 mbps.
In response to all of the well-deserved criticism, Zoom just made two updates to their blog post[1] to announce that they will be completely removing the webserver for all macOS users in a new release tonight , and also adding an option prompt going forward: JULY 9 PATCH: The patch planned for tonight (July 9) at or before 12:00 AM PT will do the following: 1. Remove the local web server entirely, once the Zoom clien…
Earlier quoted context omitted.
It should be pointed that an empty directory (even if owned by root) placed in your home directory can still be deleted by you, without requiring root. You need to place a file into the directory. Or if you want something drastic, run chflags simmutable ~/.zoomus as root. This will make sure that not even root can delete it.
That is actually true, just tested it. There is always something new to learn!
I'm no infosec expert, If I wanted to figure out more about what this process was up to, how would I go about it?