"safer" until the next zero-day is uncovered
Zoom zero-day discovery
31–40 of 246 posts
Re: Zoom zero-day discovery
#32Yet another (relative) win for the browser environment: "We also know that the method works on the Windows and Mac version of the Zoom software, but does not affect the browser version."
We don't know much about the RCE. It may have been able to do something in the browser, with more effort, e̶s̶p̶e̶c̶i̶a̶l̶l̶y̶ ̶g̶i̶v̶e̶n̶ ̶t̶h̶a̶t̶ ̶t̶h̶e̶ ̶"̶n̶a̶t̶i̶v̶e̶ ̶a̶p̶p̶"̶ ̶h̶e̶r̶e̶ ̶i̶s̶ ̶a̶n̶ ̶E̶l̶e̶c̶t̶r̶o̶n̶ ̶a̶p̶p̶. Perhaps they stopped once they saw they had done enough for the $200k bounty. Edit: Not an electron app.
[deleted]
Re: Zoom zero-day discovery
#33Earlier quoted context omitted.
We don't know much about the RCE. It may have been able to do something in the browser, with more effort, e̶s̶p̶e̶c̶i̶a̶l̶l̶y̶ ̶g̶i̶v̶e̶n̶ ̶t̶h̶a̶t̶ ̶t̶h̶e̶ ̶"̶n̶a̶t̶i̶v̶e̶ ̶a̶p̶p̶"̶ ̶h̶e̶r̶e̶ ̶i̶s̶ ̶a̶n̶ ̶E̶l̶e̶c̶t̶r̶o̶n̶ ̶a̶p̶p̶. Perhaps they stopped once they saw they had done enough for the $200k bounty. Edit: Not an electron app.
> It may have been able to do something in the browser, with more effort, especially given that the "native app" here is an Electron app. Zoom is a C++ / Qt app
Ah, thanks. I was fooled by the presence of an Electron SDK from Zoom.
Re: Zoom zero-day discovery
#34Earlier quoted context omitted.
I'm still upset they try to force you to use their plugin. These would be less scary if it were jst a web app.
They do? I don't have any plugin installed and use Zoom in Firefox without major issues
Lol, I forgot that it could even be run in a web browser!
Re: Zoom zero-day discovery
#35Earlier quoted context omitted.
I'm still upset they try to force you to use their plugin. These would be less scary if it were jst a web app.
You can force it to use a web app by declining permission to run locally. The web-app has fewer capabilities (no gallery view, last I used it), but works great. Also, Meet is fully-featured and runs entirely in-browser.
I've wondered whether things like the gallery view limitation were actual technical hurdles, or just the modern equivalent of nagware to boost the app download metrics.
Re: Zoom zero-day discovery
#36Earlier quoted context omitted.
We don't know much about the RCE. It may have been able to do something in the browser, with more effort, e̶s̶p̶e̶c̶i̶a̶l̶l̶y̶ ̶g̶i̶v̶e̶n̶ ̶t̶h̶a̶t̶ ̶t̶h̶e̶ ̶"̶n̶a̶t̶i̶v̶e̶ ̶a̶p̶p̶"̶ ̶h̶e̶r̶e̶ ̶i̶s̶ ̶a̶n̶ ̶E̶l̶e̶c̶t̶r̶o̶n̶ ̶a̶p̶p̶. Perhaps they stopped once they saw they had done enough for the $200k bounty. Edit: Not an electron app.
> It may have been able to do something in the browser, with more effort, especially given that the "native app" here is an Electron app. Zoom is a C++ / Qt app
Oh, really?! But then, why does it suck so much at "window management" (especially the "chat" feature) ??
Re: Zoom zero-day discovery
#37Earlier quoted context omitted.
I'm still upset they try to force you to use their plugin. These would be less scary if it were jst a web app.
You can force it to use a web app by declining permission to run locally. The web-app has fewer capabilities (no gallery view, last I used it), but works great. Also, Meet is fully-featured and runs entirely in-browser.
Is the lack of a gallery view a genuine technical constraint, or an artificial one introduced to get users to use the plugin?
Re: Zoom zero-day discovery
#38Yet another (relative) win for the browser environment: "We also know that the method works on the Windows and Mac version of the Zoom software, but does not affect the browser version."
I don't think this is the right conclusion to jump to. Browsers have a mountain of issues in their own right.
Of course they do. I have in mind the choice that we're often given these days, between a native (or pseudo-native) desktop app and an in-browser version with comparable functionality. Perhaps I should have been clearer about that in my earlier comment.
Re: Zoom zero-day discovery
#39give zoom some slack, critics. At least they honour their bounties, unlike Apple. https://news.ycombinator.com/item?id=26664714
Re: Zoom zero-day discovery
#40Zoom's dark patterns trying to get you to install the app on your system (which demands administrator privileges, natch) are reason enough to resist ever running unsandboxed software from them. Their continued history of major security issues (remember that time that they had a local webserver offering RCE by design as part of the desktop client) is even more.
Their browser app does not have feature parity; recently I had to participate in a conference and the browser version fucked up my camera's aspect ratio, a problem that doesn't exist in their full client. A burner laptop was required, and was wiped immediately after.
Avoid Zoom whenever possible. Don't ask others to use it.