Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom RCE from Pwn2Own 2021

sector7.computest.nl

Post reply on HN
Print view View original

121–126 of 126 posts

Re: Zoom RCE from Pwn2Own 2021

#121

Post by TobTobXX »

sriram_sun wrote: post #15

FTA: "Using a combination of proxies, modified DNS records, sslsplit and a new CA certificate installed in Windows, we were able to inspect all traffic, including HTTP and XMPP, in our test environment." I have setup wireshark for troubleshooting. That's about it. What's the role of proxies, modified DNS records etc. in this setup? How can I duplicate this? Thanks.

Not entirely sure if this I'm understanding this correctly (since it doesn't really make sense to me), but this is what they wrote almost at the end:

> Anything we did differently could influence the heap layout. For example, we noticed that adding network interception could have some effect on how network requests were allocated, changing the heap layout.

Re: Zoom RCE from Pwn2Own 2021

#122

Post by UncleMeat »

userbinator wrote: post #119
UncleMeat wrote: post #75

Earlier quoted context omitted.

I do not believe it is remotely reasonable to say that our software should be deliberately insecure so that people have the ability to root their own devices. That problem can be solved with other means, without exposing all of our devices to anybody else in the world who can send the same payload. If I can root my device through an exploit then I am not at the mercy of the company that made the device. But I am now…

That problem can be solved with other means That's what they always say --- so how about solving that problem first, before thrusting ourselves head-first into advocating for full authoritarianism? But I am now at the mercy of every single criminal or oppressive state that wants to use that exploit to harm me. Good. That means power is not centralised. You can defend yourself instead. Besides, do you really want to b…

> That's what they always say --- so how about solving that problem first, before thrusting ourselves head-first into advocating for full authoritarianism?

Expecting more secure applications is "advocating for full authoritarianism"? If anything, security vulnerabilities place individuals at far greater risk to authoritarianism since it exposes them to the people who have guns and can throw them in prison.

And software written in memory-safe languages is very very far from "perfectly secure". It just closes a very common class of vulnerability.

If you really want, you can use FLOSS for everything. Your use case of "I really want the ability to change any piece of code running on my device" is supported. Not well, since few people actually want this, but it is supported.

Re: Zoom RCE from Pwn2Own 2021

#123

Post by 1vuio0pswjnm7 »

Thorrez wrote: post #97
1vuio0pswjnm7 wrote: post #49

Earlier quoted context omitted.

As an employer I would prefer employees not to use the corporate network for personal email. The network exists for business use. As an employee I prefer not to use the corporate network for truly personal email. If I am the employer that responsibly monitors the traffic to and from our network, including TLS traffic, an employee that uses our network for personal use with a surveillance "tech" company service such a…

I assume you're talking only about employees using corporate devices on the corporate network. If the employee can connect a personal device to the corporate network the employee will be safe from the MITM.

"If the employee can connect a personal device to the corporate network..."

Why not use the cellular network.

Re: Zoom RCE from Pwn2Own 2021

#124

Post by Thorrez »

1vuio0pswjnm7 wrote: post #123
Thorrez wrote: post #97

Earlier quoted context omitted.

I assume you're talking only about employees using corporate devices on the corporate network. If the employee can connect a personal device to the corporate network the employee will be safe from the MITM.

"If the employee can connect a personal device to the corporate network..." Why not use the cellular network.

It's slower, and you have to pay for cell data.

But anyways, my point is not whether or not you should use a personal device on a corporate network, my point is that if you do use a personal device on a corporate network you will be secure from MITMs.

Re: Zoom RCE from Pwn2Own 2021

#125

Post by 1vuio0pswjnm7 »

Thorrez wrote: post #124
1vuio0pswjnm7 wrote: post #123

Earlier quoted context omitted.

"If the employee can connect a personal device to the corporate network..." Why not use the cellular network.

It's slower, and you have to pay for cell data. But anyways, my point is not whether or not you should use a personal device on a corporate network, my point is that if you do use a personal device on a corporate network you will be secure from MITMs.

Why shouldnt you pay. If its personal use why should the employer subsidise that.

My point is if you dont use a personal device on the corporate network paid for by your employer and instead use the personal device on the cellular network you pay for, then you will be "secure from MITMs".

More than one way to be "secure from MITMs".

Re: Zoom RCE from Pwn2Own 2021

#126

Post by Thorrez »

1vuio0pswjnm7 wrote: post #125
Thorrez wrote: post #124

Earlier quoted context omitted.

It's slower, and you have to pay for cell data. But anyways, my point is not whether or not you should use a personal device on a corporate network, my point is that if you do use a personal device on a corporate network you will be secure from MITMs.

Why shouldnt you pay. If its personal use why should the employer subsidise that. My point is if you dont use a personal device on the corporate network paid for by your employer and instead use the personal device on the cellular network you pay for, then you will be "secure from MITMs". More than one way to be "secure from MITMs".

I'm not saying the employer should subsidize it. Some employers might. If your employer provides that perk, it might make sense to use it. Similar to how if a restaurant provides free wifi it might make sense to use it.

I think the real way to be secure from MITMs is to use a device that you control the root CAs of. If you control the root CAs, you'll be safe no matter what network you're on. If you don't control the root CAs, you'll be vulnerable no matter what network you're on (but some networks will carry a higher likelihood of an attack).

Post reply on HN