Zoom zero-day discovery • Hacker News Board

Re: Zoom zero-day discovery

#101

Post by Oddskar » Fri, Apr 09, 2021, 3:23 PM UTC

dreamcompiler wrote: post #96

AndyMcConachie wrote: post #65

I sometimes wonder if we're destined for a world where software companies decide they should employ QA staff. Or if we're destined for a world where the majority of QA gets oursourced to competitions.

Software companies used to have QA staff. But developers said "we can write our own tests and you can get rid of those expensive QA people who we hate" and here we are, in the land of forever-crappy software. It's our own damn fault for becoming over-reliant on CI to find all the bugs.

I squarely put this in the same compartment as "my code is self documenting". I've only seen management and devs who are less than stellar argue against having QAs.

Re: Zoom zero-day discovery

#102

Post by mdaniel » Fri, Apr 09, 2021, 3:23 PM UTC

DangerousPie wrote: post #78

_nickwhite wrote: post #50

Earlier quoted context omitted.

My biggest gripe about Teams is what a memory hog it is. Mine is currently sitting idle (been on vacation all week) at nearly 1GB. Compare this to Zoom, which is idling at just over 100MB. Teams is literally taking up 10 times more RAM than Zoom just running in the background.

I have never used Teams but is 1GB of memory usage really an issue in 2021, when most laptops have at least 16-32 gigs of memory? It's been years since the last time I actually worried about how much memory some software on my laptop was using.

In isolation, maybe not, but I don't get paid to have chat clients or screen share apps run, I get paid to add features or remove bugs from the bazillions of microservices and associated spa, which under ideal conditions requires running them locally. Every byte consumed by something useless is not a tradeoff I endorse.

That "ram is cheap and plentiful" is also seriously not true for Mac laptops, which both caps how much one can expand them and also charges unreasonable rates for the additions they do allow

Re: Zoom zero-day discovery

#103

Post by _underfl0w_ » Fri, Apr 09, 2021, 3:27 PM UTC

twobitshifter wrote: post #97

_nickwhite wrote: post #50

Earlier quoted context omitted.

My biggest gripe about Teams is what a memory hog it is. Mine is currently sitting idle (been on vacation all week) at nearly 1GB. Compare this to Zoom, which is idling at just over 100MB. Teams is literally taking up 10 times more RAM than Zoom just running in the background.

In Microsoft’s defense Teams is an electron (or electronesque) app and offers quite a bit more than Zoom in terms of features. The fact that it uses so much RAM is expected when you consider it as another copy of chrome.

"Expected" != "Acceptable" though, IMHO.

Re: Zoom zero-day discovery

#104

Post by kristjansson » Fri, Apr 09, 2021, 3:28 PM UTC

jtdev wrote: post #48

It sounds like a great deal for Zoom... Zoom would have paid far more for this research in any other scenario. The InfoSec community seems to be quite happy giving away their hard work, while the large security vendors make mountains of cash on snake oil solutions to enterprises. For context, Zoom certainly paid many multiples of $200k during any given month for firewall licensing.

OTOH, security researchers do inflate the value of any given exploit (chain) vs. broad mitigations.

Still, 200k seems _low_ for a bug that should imperil the reputation of a many-billion dollar company. And a few years ago it seems like that would have been $1000 and a firm handshake...

Re: Zoom zero-day discovery

#105

Post by teawrecks » Fri, Apr 09, 2021, 3:29 PM UTC

ajross wrote: post #75

bezoz wrote: post #49

The positive "tilt" in this article is honestly amusing and unusual for such articles "zero-day discovery makes calls safer" "Understandably, Zoom has not yet had the time to issue a patch for the vulnerability" "This event, and the procedures and protocols that surround it, demonstrate very nicely how white-hat hackers work" Imagine if that was your run of the mill well-hated big corp "Yet another security vulnerabi…

I don't think that's fair. The Pwn2Own contest rules specifically disallow disclosure. This isn't a "zero day" in any sense but marketing. It's a privately disclosed vulnerability under a managed embargo, just as if it had been reported by Project Zero or whoever. The ding is that, because it was a "public contest", the existence of the vulnerability is known. And that's probably a higher risk scenario in the abstrac…

I'm not seeing how your point relates to bezoz's point...

Re: Zoom zero-day discovery

#106

Post by jms703 » Fri, Apr 09, 2021, 3:36 PM UTC

ajross wrote: post #75

bezoz wrote: post #49

The positive "tilt" in this article is honestly amusing and unusual for such articles "zero-day discovery makes calls safer" "Understandably, Zoom has not yet had the time to issue a patch for the vulnerability" "This event, and the procedures and protocols that surround it, demonstrate very nicely how white-hat hackers work" Imagine if that was your run of the mill well-hated big corp "Yet another security vulnerabi…

I don't think that's fair. The Pwn2Own contest rules specifically disallow disclosure. This isn't a "zero day" in any sense but marketing. It's a privately disclosed vulnerability under a managed embargo, just as if it had been reported by Project Zero or whoever. The ding is that, because it was a "public contest", the existence of the vulnerability is known. And that's probably a higher risk scenario in the abstrac…

This. The article should have been less about 0days and more about supporting contests and programs that vulnerability researchers.

Re: Zoom zero-day discovery

#107

Post by dTal » Fri, Apr 09, 2021, 3:43 PM UTC

elric wrote: post #87

dylan604 wrote: post #74

Earlier quoted context omitted.

Wait, are you saying Zoom isn't hated? It's crap. I refuse to install its PoS app and all of the security holes it came with (don't care if they are fixed or not). Launching a zoom meeting in my browser totally bogs the browser down. The zoom site is so slow that proving I'm a human is at least 10x slower than on other sites. In my use case, nobody on the zoom call is even using video, yet it still runs this badly.

The browser experience is pretty decent IMO. And unlike, say, MS Teams, at least it works on all platforms with a reasonably modern browser.

I was shocked to find that on Windows, Teams refuses to run in any browser except Edge. On Linux, it runs quite happily under Chromium. It's the worst sort of anti-competitive behavior, in my view.

Re: Zoom zero-day discovery

#108

Post by II2II » Fri, Apr 09, 2021, 3:44 PM UTC

bezoz wrote: post #49

The positive "tilt" in this article is honestly amusing and unusual for such articles "zero-day discovery makes calls safer" "Understandably, Zoom has not yet had the time to issue a patch for the vulnerability" "This event, and the procedures and protocols that surround it, demonstrate very nicely how white-hat hackers work" Imagine if that was your run of the mill well-hated big corp "Yet another security vulnerabi…

> Imagine if that was your run of the mill well-hated big corp

I don't know what the general perception of Zoom is. Our opinions of it never really come up at work. The discussion I see of it online largely focuses upon the security issues so that is going to be negative. There is one thing I am grateful for though: it seems as though the masses settled on a product with decent cross-platform support for once. You rarely see that unless the product is intended for a niche market (e.g. science, engineering, software development). Heck, they even package it for Arch.

Re: Zoom zero-day discovery

#109

Post by c7DJTLrn » Fri, Apr 09, 2021, 3:44 PM UTC

bezoz wrote: post #49

The positive "tilt" in this article is honestly amusing and unusual for such articles "zero-day discovery makes calls safer" "Understandably, Zoom has not yet had the time to issue a patch for the vulnerability" "This event, and the procedures and protocols that surround it, demonstrate very nicely how white-hat hackers work" Imagine if that was your run of the mill well-hated big corp "Yet another security vulnerabi…

Chernobyl nuclear power plant explodes and paves way for safer reactor design!*

*citizens not yet evacuated from radiation zone

Re: Zoom zero-day discovery

#110

Post by saddlerustle » Fri, Apr 09, 2021, 3:46 PM UTC

Rendello wrote: post #91

oefrha wrote: post #42

Related, the two other $200k entries from Pwn2Own 2021:[1] - DEVCORE targeting Microsoft Exchange in the Server category (The DEVCORE team combined an authentication bypass and a local privilege escalation to complete take over the Exchange server.) - The researcher who goes by OV targeting Microsoft Teams in the Enterprise Communications category (OV combined a pair of bugs to demonstrate code execution on Microsoft…

I wonder if the OS world will move towards lightweight but unforgiving sandboxing like OpenBSD's `pledge` and `unveil` system calls. It's crazy to me that most software is still completely fine to run around and set things as fire the instant it's compromised! This is about the implementation in the SerenityOS but it's my favourite explanation so far: https://awesomekling.github.io/pledge-and-unveil-in-Serenity...

iOS, Android and ChromeOS are already there. But for exploits targeting Exchange or Teams it's far from a perfect solution because valuable private information is in the app being compromised.