Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom zero-day discovery

blog.malwarebytes.com

Post reply on HN
Print view View original

151–160 of 246 posts

Re: Zoom zero-day discovery

#151

Post by HappyTypist »

TwoBit wrote: post #147
Rendello wrote: post #91

Earlier quoted context omitted.

I wonder if the OS world will move towards lightweight but unforgiving sandboxing like OpenBSD's `pledge` and `unveil` system calls. It's crazy to me that most software is still completely fine to run around and set things as fire the instant it's compromised! This is about the implementation in the SerenityOS but it's my favourite explanation so far: https://awesomekling.github.io/pledge-and-unveil-in-Serenity...

I don't see how the large majority of security problems could be solved by any OS design. Human failures would just account for 95% of breaches instead of the current 85% (made up numbers). Not saying the OS improvements aren't useful nevertheless..

Good design can dramatically reduce, if not eliminate, most human vulnerabilities.

For example, phishing sites would be radically less effective if passwords are not a thing, and everyone logged in using hardware keys (e.g. Yubikeys) which cryptographically prevent phishing.

Re: Zoom zero-day discovery

#152

Post by dmix »

temp667 wrote: post #124
whatgoodisaroad wrote: post #121

Earlier quoted context omitted.

Maybe the zero-day isn't disclosed from this pwn2own itself, but importantly, we now know it exists, which means we should consider how many bad actors are already independently aware of it and are exploiting it. Responsibe disclosure processes are just as much about closing the vectors that we can't prove are under active exploit.

the Pwn2Own exploits have generally not already been out there. There have been a long history of these, including some incredible chrome exploits! So the disclosure process tends to work out OK.

Agreed, just because it exists doesn’t mean it was being exploited.

And these help patch not just the specific hole but the general approach of the exploit chain may expose a whole area the development team had not previously considered.

Re: Zoom zero-day discovery

#153

Post by whimsicalism »

neither_color wrote: post #139
walrus01 wrote: post #55

Zoom is entirely banned at the two companies that are my day job, and probably 90% of partners. If you do any work adjacent to anything that's ITAR controlled you should also not be surprised to see the same policy from partner companies. This has been in place for quite some time since the initial security problem that was so egregiously bad apple had to resort to using the malware removal tool to remove zoom's bina…

I think we're a bit naive in the west and most often assume good faith from certain other business cultures. We're not used to companies that engage in calculated perfidy that have their sorry prepared long before you've discovered the problem. To put another way, "It's better to ask for forgiveness than to ask for permission", or to beat around the bush even more: I disagree with Hanlon's razor.

> I think we're a bit naive in the west

How does the West have anything to do with this? Moreover, the West is the birthplace of the "move fast and break things" ideology.

Re: Zoom zero-day discovery

#154

Post by HappyTypist »

sitzkrieg wrote: post #60
walrus01 wrote: post #55

Zoom is entirely banned at the two companies that are my day job, and probably 90% of partners. If you do any work adjacent to anything that's ITAR controlled you should also not be surprised to see the same policy from partner companies. This has been in place for quite some time since the initial security problem that was so egregiously bad apple had to resort to using the malware removal tool to remove zoom's bina…

this was the case here too, but just yesterday got on a usaf hosted zoom that said 'gov' and hosted in CONUS so they seem to have some offering at least DoD is ok with now, appears to only be fedramp https://www.zoomgov.com/

Note that the DoD Authorization only covers Zoom for public, not even FOUO, data.

For sensitive data, only Cisco and Microsoft are allowed.

Re: Zoom zero-day discovery

#155

Post by jimmont »

dylan604 wrote: post #74
bezoz wrote: post #49

The positive "tilt" in this article is honestly amusing and unusual for such articles "zero-day discovery makes calls safer" "Understandably, Zoom has not yet had the time to issue a patch for the vulnerability" "This event, and the procedures and protocols that surround it, demonstrate very nicely how white-hat hackers work" Imagine if that was your run of the mill well-hated big corp "Yet another security vulnerabi…

Wait, are you saying Zoom isn't hated? It's crap. I refuse to install its PoS app and all of the security holes it came with (don't care if they are fixed or not). Launching a zoom meeting in my browser totally bogs the browser down. The zoom site is so slow that proving I'm a human is at least 10x slower than on other sites. In my use case, nobody on the zoom call is even using video, yet it still runs this badly.

Agree and have a similar experience so I use Jitsi https://jitsi.org/ instead and recommend it. If clients insist I simply ask they enable joining from a web client, otherwise unable to join. Jitsi works well and find it odd how remarkable mindsets become locked into options regardless of the accessibility and benefit of alternatives (great material for comedy, psychosocial study, etc). From React to iOS default apps to Zoom, it's an odd disadvantage of our human condition.

Re: Zoom zero-day discovery

#156

Post by lostgame »

bezoz wrote: post #49

The positive "tilt" in this article is honestly amusing and unusual for such articles "zero-day discovery makes calls safer" "Understandably, Zoom has not yet had the time to issue a patch for the vulnerability" "This event, and the procedures and protocols that surround it, demonstrate very nicely how white-hat hackers work" Imagine if that was your run of the mill well-hated big corp "Yet another security vulnerabi…

>> Imagine if that was your run of the mill well-hated big corp

Zoom is one of my, and several of my coder friends', top-five well-hated big corps.

This far into the pandemic, I take personal pride that I hadn't installed what for a while was essentially reported as Chinese spyware on my machines. :)

Re: Zoom zero-day discovery

#157

Post by Moodles »

pydry wrote: post #64
bezoz wrote: post #49

The positive "tilt" in this article is honestly amusing and unusual for such articles "zero-day discovery makes calls safer" "Understandably, Zoom has not yet had the time to issue a patch for the vulnerability" "This event, and the procedures and protocols that surround it, demonstrate very nicely how white-hat hackers work" Imagine if that was your run of the mill well-hated big corp "Yet another security vulnerabi…

>Imagine if that was your run of the mill well-hated big corp Microsoft seems to be the one banging the "zoom is insecure" drum hardest and teams had, like, 4 zero days and paid < 30K for them IIRC.

... including an RCE in the very same competition https://www.bleepingcomputer.com/news/security/microsofts-wi...

Re: Zoom zero-day discovery

#158

Post by smoldesu »

codefreakxff wrote: post #81
dylan604 wrote: post #74

Earlier quoted context omitted.

Wait, are you saying Zoom isn't hated? It's crap. I refuse to install its PoS app and all of the security holes it came with (don't care if they are fixed or not). Launching a zoom meeting in my browser totally bogs the browser down. The zoom site is so slow that proving I'm a human is at least 10x slower than on other sites. In my use case, nobody on the zoom call is even using video, yet it still runs this badly.

We run zoom calls with over 200 participants and no problems. It sounds like their browser experience is poor, I don’t know if that’s a browser limitation or bad design, but their app on Windows and Mac performs quite well. Mistakes were made with security early in their product. It’s clear that has turned a lot of potential users against them. I’m curious why companies like Facebook get more acceptance over terrible…

It also has an unexpectedly great Linux app, IMO.

Re: Zoom zero-day discovery

#159

Post by spinny »

Not surprising. I just wonder how trivial is to exploit it and if it's not one of many "honest mistakes" that some companies sometimes commit. Some trivially exploitable and very reliable stack overflows on some routers come to mind ...

Re: Zoom zero-day discovery

#160

Post by whatgoodisaroad »

temp667 wrote: post #124
whatgoodisaroad wrote: post #121

Earlier quoted context omitted.

Maybe the zero-day isn't disclosed from this pwn2own itself, but importantly, we now know it exists, which means we should consider how many bad actors are already independently aware of it and are exploiting it. Responsibe disclosure processes are just as much about closing the vectors that we can't prove are under active exploit.

the Pwn2Own exploits have generally not already been out there. There have been a long history of these, including some incredible chrome exploits! So the disclosure process tends to work out OK.

I think that's right that pwn2own exploits are generally new to the public, but that only means it's not provably out there.

Just to be clear, I think programs like this are great and they do improve safety, but only because they result in patches. This news shouldn't make users feel safe until there is a patch.

Post reply on HN