Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom zero-day discovery

blog.malwarebytes.com

Post reply on HN
Print view View original

191–200 of 246 posts

Re: Zoom zero-day discovery

#191

Post by jrockway »

BlueTemplar wrote: post #36
jcelerier wrote: post #29

Earlier quoted context omitted.

> It may have been able to do something in the browser, with more effort, especially given that the "native app" here is an Electron app. Zoom is a C++ / Qt app

Oh, really?! But then, why does it suck so much at "window management" (especially the "chat" feature) ??

I don't think Qt has ever pretended to look native. I remember using KDE back in the early 2000s and most Qt apps that didn't explicitly integrate with KDE didn't look "native" either. The other desktop OSes are not even internally consistent -- look at Windows's "settings" vs. "control panel". Which one is native? The answer is they both are, sort of, but there are simply two UI kits bundled with the OS. One is deprecated, the other isn't ready yet. Qt is not going to solve that problem for you.

(I'll also point out that even if you have a Win32ChatWidget in the library, that doesn't many anyone is going to use it. Zoom simply did a bad job implementing chat, which is why it's so bad. The UI toolkit library is neither the problem nor the solution. Caring about making chat good is the solution.)

Re: Zoom zero-day discovery

#192

Post by chollida1 »

jacquesm wrote: post #44
dathinab wrote: post #14

Seems fair, through "less insecure" would be generally more appropriate (independent of it being Zoom). But then I have lost all trust in Zoom due to the history involved with it. And I also don't thing Zoom will regain the trust, because due to the way they lost trust again and again and also acted in-honest it's pretty hard for them to convey that they changed (instead of just pretending they did).

Same here, zoom is on our 'ban' list. And MS teams is getting there, what a load of crap that is, it is so buggy it is embarrassing.

I get that your just some random internet person but I'll bit and assume I'm not being trolled.....

what's so bad about team's security that its almost on your ban list?

Re: Zoom zero-day discovery

#193

Post by netsec_burn »

chollida1 wrote: post #192
jacquesm wrote: post #44

Earlier quoted context omitted.

Same here, zoom is on our 'ban' list. And MS teams is getting there, what a load of crap that is, it is so buggy it is embarrassing.

I get that your just some random internet person but I'll bit and assume I'm not being trolled..... what's so bad about team's security that its almost on your ban list?

Why do you assume you are being trolled? And the last wormable, zero click RCE in Microsoft teams was only 4 months ago.

Re: Zoom zero-day discovery

#194

Post by jefftk »

ISL wrote: post #30
swiley wrote: post #25

Earlier quoted context omitted.

I'm still upset they try to force you to use their plugin. These would be less scary if it were jst a web app.

You can force it to use a web app by declining permission to run locally. The web-app has fewer capabilities (no gallery view, last I used it), but works great. Also, Meet is fully-featured and runs entirely in-browser.

The web client now has gallery view

Re: Zoom zero-day discovery

#195

Post by neolog »

AlexCoventry wrote: post #186

I use the zoom web client, when I have to use zoom. It has fewer features, but I'm more comfortable running badly written software in an environment designed for hostile code. Just change the /j/ in the url to /wc/, and insert /join after the meeting id. https://devforum.zoom.us/t/launch-zoom-client-from-browser-w...

Try stracing the desktop client.

Re: Zoom zero-day discovery

#196

Post by jacobolus »

AlexCoventry wrote: post #186

I use the zoom web client, when I have to use zoom. It has fewer features, but I'm more comfortable running badly written software in an environment designed for hostile code. Just change the /j/ in the url to /wc/, and insert /join after the meeting id. https://devforum.zoom.us/t/launch-zoom-client-from-browser-w...

The zoom web client has extremely buggy audio support. It regularly breaks in all of the browsers on my computer, and I end up listening to meetings only able to contribute via the text chat.

Re: Zoom zero-day discovery

#197

Post by chollida1 »

netsec_burn wrote: post #193
chollida1 wrote: post #192

Earlier quoted context omitted.

I get that your just some random internet person but I'll bit and assume I'm not being trolled..... what's so bad about team's security that its almost on your ban list?

Why do you assume you are being trolled? And the last wormable, zero click RCE in Microsoft teams was only 4 months ago.

> Why do you assume you are being trolled?

Well I did say I assume I'm not being trolled so I'm not sure what you're referring to. As a teams user I asked a good faith question to try and flesh out her reasons for considering banning Teams.

But to give you a reason why someone might assume a troll

- random internet stranger

- Microsoft mentioned, some people just don't like them as a company

- no actual reason given, just a comment with zero supporting evidence.

How many more reasons would you like?

Re: Zoom zero-day discovery

#198

Post by xvector »

TwoBit wrote: post #147
Rendello wrote: post #91

Earlier quoted context omitted.

I wonder if the OS world will move towards lightweight but unforgiving sandboxing like OpenBSD's `pledge` and `unveil` system calls. It's crazy to me that most software is still completely fine to run around and set things as fire the instant it's compromised! This is about the implementation in the SerenityOS but it's my favourite explanation so far: https://awesomekling.github.io/pledge-and-unveil-in-Serenity...

I don't see how the large majority of security problems could be solved by any OS design. Human failures would just account for 95% of breaches instead of the current 85% (made up numbers). Not saying the OS improvements aren't useful nevertheless..

See Qubes. Your compromised app can’t do much without a Xen hypervisor zero-day.

Re: Zoom zero-day discovery

#199

Post by HaggardFinical »

neither_color wrote: post #139
walrus01 wrote: post #55

Zoom is entirely banned at the two companies that are my day job, and probably 90% of partners. If you do any work adjacent to anything that's ITAR controlled you should also not be surprised to see the same policy from partner companies. This has been in place for quite some time since the initial security problem that was so egregiously bad apple had to resort to using the malware removal tool to remove zoom's bina…

I think we're a bit naive in the west and most often assume good faith from certain other business cultures. We're not used to companies that engage in calculated perfidy that have their sorry prepared long before you've discovered the problem. To put another way, "It's better to ask for forgiveness than to ask for permission", or to beat around the bush even more: I disagree with Hanlon's razor.

So people contributing to western business culture don't act exactly like Mark Zuckerberg? There's a lot of this stuff in "the west" too.

Re: Zoom zero-day discovery

#200

Post by AlexCoventry »

jacobolus wrote: post #196
AlexCoventry wrote: post #186

I use the zoom web client, when I have to use zoom. It has fewer features, but I'm more comfortable running badly written software in an environment designed for hostile code. Just change the /j/ in the url to /wc/, and insert /join after the meeting id. https://devforum.zoom.us/t/launch-zoom-client-from-browser-w...

The zoom web client has extremely buggy audio support. It regularly breaks in all of the browsers on my computer, and I end up listening to meetings only able to contribute via the text chat.

Ah, I didn't know that. I always phone in, and only use the computer audio as a failover.
Post reply on HN