Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom fixes major Mac webcam security flaw with emergency patch

theverge.com

Post reply on HN
Print view View original

131–140 of 151 posts

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#131

Post by bancars »

eeeeeeeeeeeee wrote: post #25

Glad to see the company is changing course, but I’m not sure it would have happened without the public shaming. I want companies to fix things because something is insecure and it endangers the public, not because they have their feet to the fire. I know companies don’t always respond right the first time, I know I haven’t, but Zoom had over 90 days to consider their responses and possible options / software changes.…

This is typically what laws are for. Sadly, those of us in the Land of the Free will probably have to wait a decade or two to get anything reasonable, so I fully expect this trend to continue as-is for now.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#132

Post by vorpalhex »

Sahhaese wrote: post #113
akersten wrote: post #11

Stories like this are wonderful evidence of the effectiveness of public disclosure of security vulnerabilities, and are always heartwarming to see. Remember, 90-day disclosure windows are just a courtesy .

This is why I consider bug bounty programs problematic, because they've been co-opted from a system to manage responsible disclosure to a system to contain and manage non-disclosure.

Bug bounty programs can be great tools to help reward researchers, secure products and help align new and amateur researchers who may not have ever reported a bug before to standards.

But like all things, they can also be used to keep software insecure, hide issues, and instead buy off researchers.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#134

Post by lawnchair_larry »

gok wrote: post #52
lawnchair_larry wrote: post #36

Earlier quoted context omitted.

Responsible disclosure doesn’t mean anything. It’s an obsolete term. You’re referring to coordinated disclosure. https://blogs.technet.microsoft.com/ecostrat/2010/07/22/coor...

This case is actually a really great demonstration of why this often-repeated claim is false. This was responsible, but not coordinated, disclosure.

There’s nothing false about it. The term “Responsible Disclosure” was invented by a vendor as a self-serving PR tool to cover their own ass. “Responsible” is subjective and loaded, so it’s not useful terminology, and professionals in the field do not use it.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#135

Post by aarbor989 »

I could be wrong, but it looks like they are doing a server-side redirect to their custom zoommtg:// URI protocol now instead of making a call to the localhost server. Couldn't anyone still drop this on their website and force you to join through a redirect just as zoom is? I don't see how that particular concern of the disclosure could be avoided unless browsers force confirmation, as Safari has done.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#136

Post by ubermonkey »

eeeeeeeeeeeee wrote: post #25

Glad to see the company is changing course, but I’m not sure it would have happened without the public shaming. I want companies to fix things because something is insecure and it endangers the public, not because they have their feet to the fire. I know companies don’t always respond right the first time, I know I haven’t, but Zoom had over 90 days to consider their responses and possible options / software changes.…

Yeah this, like Superhuman, is about damage control, not a fundamental desire to do the right thing.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#137

Post by AgloeDreams »

aarbor989 wrote: post #135

I could be wrong, but it looks like they are doing a server-side redirect to their custom zoommtg:// URI protocol now instead of making a call to the localhost server. Couldn't anyone still drop this on their website and force you to join through a redirect just as zoom is? I don't see how that particular concern of the disclosure could be avoided unless browsers force confirmation, as Safari has done.

MacOS as a whole forces confirmation on deeplinks. The old solution skipped the OS confirmation dialog.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#138

Post by tablethnuser »

I uninstalled this software yesterday and it's not going back on my machine.

I have the same criticisms as others do about a company like Zoom that only responds to security issues after they wait-and-see if it will impact the bottom line. And that quick peek behind the curtain where their own employees view this as a "PR crisis" (their exact words in the article) rather than something more tells me everything I need to know about their leadership's DNA. Buyer beware.

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#139

Post by aarbor989 »

AgloeDreams wrote: post #137
aarbor989 wrote: post #135

I could be wrong, but it looks like they are doing a server-side redirect to their custom zoommtg:// URI protocol now instead of making a call to the localhost server. Couldn't anyone still drop this on their website and force you to join through a redirect just as zoom is? I don't see how that particular concern of the disclosure could be avoided unless browsers force confirmation, as Safari has done.

MacOS as a whole forces confirmation on deeplinks. The old solution skipped the OS confirmation dialog.

Hmm..but I'm not getting a confirmation prompt on Firefox or Chrome? Visiting a zoom link in either of those browsers takes me directly into the meeting

Re: Zoom fixes major Mac webcam security flaw with emergency patch

#140

Post by diegoperini »

oil25 wrote: post #65
Jedi72 wrote: post #28

The security flaw isnt even the outrageous part. It was secretly installing webservers that dont even remove themselves when you uninstall the app that makes them scum.

> It was secretly installing webservers that dont even remove themselves when you uninstall the app that makes them scum. To be fair, dragging an "app" to Trash does not constitute un-installation. It was a poor design decision to implement features using a local web server, but let's not be so quick to attribute covert, malicious intentions.

> To be fair, dragging an "app" to Trash does not constitute un-installation.

Dragging an app to Trash MUST constitute uninstallation. If it doesn't, it is a bug.

Leaving configuration files in home folder for easier on-boarding after a reinstall is not the same thing as leaving a self replicating rootkit running all the time.

> It was a poor design decision to implement features using a local web server, but let's not be so quick to attribute covert, malicious intentions.

Zoom, with all its advertised features, works like a charm from the user's standpoint. It is not that easy to craft such seamless video conferencing apps which makes me believe the team behind it is formed by really experienced people. If this assumption is true, "the poor decision" is actually the true intention and is probably a feature in case zoom needs to install extra software on my device when their business needs change. It feels more like a back up plan than a dirty hack.

In my humble opinion, experts ignoring the ethical consequences of such decision are dangerous to society and their intention can be considered malicious if not criminal.

I'm sick of seeing the blame always belonging to the business people. Unless taken hostage and forced to act despite not giving consent, the developer should be equally responsible. We don't treat murderers, burglars and scammers the same when they work under a boss.

P.S: I probably strawmanned your answer to express my own opinion. English isn't my native language, sorry if my words sounded offensive.

Post reply on HN