Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom zero-day discovery

blog.malwarebytes.com

Post reply on HN
Print view View original

221–230 of 246 posts

Re: Zoom zero-day discovery

#221

Post by Black101 »

interestica wrote: post #175
vthallam wrote: post #57

Can we please edit the headline. This sounds disingenuous, a more appropriate headline would be something like "critical vulnerability in Zoom Video Calls that would have put millions of users at risk has been found". This feels like a straight up PR piece.

I really wish there was a changelog for headlines. Too often I see a critique like this and I have to figure out if the comment is referring to the current headline or a previous version. And, if the headline has already unknowingly been 'corrected', it leaves me wasting time trying to figure it out within that framing. And it shouldn't be the responsibility of the poster necessarily to quote it -- because there's no…

a change log of everything the admins do would be nice, because they control a lot of the content that you and me see... they move threads to other posts, they hide posts... etc... they don't like to let nature take its course.

Re: Zoom zero-day discovery

#222

Post by d110af5ccf »

Rendello wrote: post #91
oefrha wrote: post #42

Related, the two other $200k entries from Pwn2Own 2021:[1] - DEVCORE targeting Microsoft Exchange in the Server category (The DEVCORE team combined an authentication bypass and a local privilege escalation to complete take over the Exchange server.) - The researcher who goes by OV targeting Microsoft Teams in the Enterprise Communications category (OV combined a pair of bugs to demonstrate code execution on Microsoft…

I wonder if the OS world will move towards lightweight but unforgiving sandboxing like OpenBSD's `pledge` and `unveil` system calls. It's crazy to me that most software is still completely fine to run around and set things as fire the instant it's compromised! This is about the implementation in the SerenityOS but it's my favourite explanation so far: https://awesomekling.github.io/pledge-and-unveil-in-Serenity...

Doesn't the equivalent already exist in Linux? BPF seccomp filters have been around since ~2012 (https://lwn.net/Articles/656307). There's also SELinux and friends (ie Linux Security Modules).

Re: Zoom zero-day discovery

#223

Post by LocalPCGuy »

de6u99er wrote: post #173

It is being sold as if everybody ditched a bullet, while nobody can be 100% certain that this vulnurability has not been alreqdy exploited.

Even worse, it isn't even patched now, and now the bad guys are aware this exists, even if they don't know exactly how yet. And no reason to keep it quiet if they do figure it out - exploit away as long as you can cause they know it is going to be fixed relatively quickly.

Re: Zoom zero-day discovery

#225

Post by stjohnswarts »

idiotsecant wrote: post #4

What percentage of these kind of exploits does hn think are found by these kind of white hat exercises and what percentage are sitting out there in an intelligence service or private entity's 0-day database? I have always been curious.

I would guess at least 10:1

Re: Zoom zero-day discovery

#226

Post by stjohnswarts »

fouuler wrote: post #115

Naive question. I'm forced to use Zoom by my University, so I run it from a dedicated user (on Linux). That's fairly safe, right?

No, as this discussion points out you should use the browser version if at all possible. The snap version would also offer a little bit more sandboxing probably if you're willing to edit the config for how much access it has to your system.

Re: Zoom zero-day discovery

#227

Post by tatersolid »

xvector wrote: post #198
TwoBit wrote: post #147

Earlier quoted context omitted.

I don't see how the large majority of security problems could be solved by any OS design. Human failures would just account for 95% of breaches instead of the current 85% (made up numbers). Not saying the OS improvements aren't useful nevertheless..

See Qubes. Your compromised app can’t do much without a Xen hypervisor zero-day.

> Your compromised app can’t do much without a Xen hypervisor zero-day.

Of which there have been plenty.

Re: Zoom zero-day discovery

#228

Post by tatersolid »

cyberlab wrote: post #134

This reminds me of the Skype 'vuln' where you could see weird VPS/colocation servers scooping up links when you send them via their chat feature. /Nobody/ except the recipient and you should be visiting that link, yet it's still an issue. At first I thought it just wanted to generate a 'link preview' but it's more sinister than that. Some random surveillant is looking at every link.

This is an anti-malware/anti-phishing scan. Send a link via email, Slack, or any other “enterprise” system and you will see the same.

Re: Zoom zero-day discovery

#229

Post by aYsY4dDQ2NrcNzA »

interestica wrote: post #175
vthallam wrote: post #57

Can we please edit the headline. This sounds disingenuous, a more appropriate headline would be something like "critical vulnerability in Zoom Video Calls that would have put millions of users at risk has been found". This feels like a straight up PR piece.

I really wish there was a changelog for headlines. Too often I see a critique like this and I have to figure out if the comment is referring to the current headline or a previous version. And, if the headline has already unknowingly been 'corrected', it leaves me wasting time trying to figure it out within that framing. And it shouldn't be the responsibility of the poster necessarily to quote it -- because there's no…

> I really wish there was a changelog for headlines.

While we’re talking feature requests, I think each submission should offer an optional second weblink, reserved specifically for the “original” or “source” URL.

It bothers me when the link is changed after lots of comments reference the previous one.

Re: Zoom zero-day discovery

#230

Post by saagarjha »

temp667 wrote: post #124
whatgoodisaroad wrote: post #121

Earlier quoted context omitted.

Maybe the zero-day isn't disclosed from this pwn2own itself, but importantly, we now know it exists, which means we should consider how many bad actors are already independently aware of it and are exploiting it. Responsibe disclosure processes are just as much about closing the vectors that we can't prove are under active exploit.

the Pwn2Own exploits have generally not already been out there. There have been a long history of these, including some incredible chrome exploits! So the disclosure process tends to work out OK.

A fair number of submissions only received partial points because the vendor claimed they were aware of the bug already.
Post reply on HN