Zoom RCE from Pwn2Own 2021 • Hacker News Board

Re: Zoom RCE from Pwn2Own 2021

#21

Post by meibo » Sat, Aug 28, 2021, 7:56 PM UTC

wereHamster wrote: post #13

lima wrote: post #9

Earlier quoted context omitted.

Unfortunately, Zoom deliberately cripples their web app to the point of being unusable. If your employer uses Zoom, there's no way to avoid the native app.

lol we use Zoom for most of our meetings and I always used the web app, without any issues.

Sitting in a meeting and saying a few words is like 10% of what Zoom can do - there's webinars, breakout rooms, Q&A, polls, moderation, and a lot of other smaller features which are incomplete or unavailable on the web client.

Re: Zoom RCE from Pwn2Own 2021

#22

Post by e12e » Sat, Aug 28, 2021, 7:57 PM UTC

sriram_sun wrote: post #15

FTA: "Using a combination of proxies, modified DNS records, sslsplit and a new CA certificate installed in Windows, we were able to inspect all traffic, including HTTP and XMPP, in our test environment." I have setup wireshark for troubleshooting. That's about it. What's the role of proxies, modified DNS records etc. in this setup? How can I duplicate this? Thanks.

In addition to what others have mentioned - you could probably find the session keys in ram - but for a system without debug knobs, injecting your own certificate authority is probably easier.

For stuff using nss(Firefox)/openssl/gnutls - you can usually just ask nicely for a copy:

> The key log file is a text file generated by applications such as Firefox, Chrome and curl when the SSLKEYLOGFILE environment variable is set. To be precise, their underlying library (NSS, OpenSSL or boringssl) writes the required per-session secrets to a file. This file can subsequently be configured in Wireshark

https://wiki.wireshark.org/TLS#TLS_Decryption

https://gnutls.org/manual/html_node/Debugging-and-auditing.h...

Re: Zoom RCE from Pwn2Own 2021

#23

Post by brundolf » Sat, Aug 28, 2021, 8:13 PM UTC

koolba wrote: post #20

skrebbel wrote: post #11

Earlier quoted context omitted.

To be frank, if Zoom was a web only app (or maybe web plus web-in-a-electron like eg Slack and WhatsApp) there'd be a vocal HN crowd complaining that there was no proper native app.

Last I checked you didn’t have to install anything. I’m not sure about more advanced usage like screen sharing or how many timing options their are, but for generic “see me, see you” it works fine in the browser.

It does have a web app, but they make it incredibly hard to find. I’m not surprised that some don’t even know about it

Re: Zoom RCE from Pwn2Own 2021

#24

Post by [deleted] » Sat, Aug 28, 2021, 8:15 PM UTC

swiley wrote: post #2

No one should be installing native apps for this now that we have WebRTC.

[deleted]

Re: Zoom RCE from Pwn2Own 2021

#25

Post by brundolf » Sat, Aug 28, 2021, 8:15 PM UTC

lima wrote: post #9

swiley wrote: post #2

No one should be installing native apps for this now that we have WebRTC.

Unfortunately, Zoom deliberately cripples their web app to the point of being unusable. If your employer uses Zoom, there's no way to avoid the native app.

That’s why I keep it quarantined to my work computer. If friends/family want to use it, I use it on there.

Re: Zoom RCE from Pwn2Own 2021

#26

Post by makeworld » Sat, Aug 28, 2021, 8:19 PM UTC

This is why I only run Zoom in Firejail.

Re: Zoom RCE from Pwn2Own 2021

#27

Post by underscore_ku » Sat, Aug 28, 2021, 8:25 PM UTC

makeworld wrote: post #26

This is why I only run Zoom in Firejail.

i run the snap Zoom on Ubuntu

Re: Zoom RCE from Pwn2Own 2021

#28

Post by travoc » Sat, Aug 28, 2021, 8:25 PM UTC

makeworld wrote: post #26

This is why I only run Zoom in Firejail.

I just decline Zoom meetings while politely saying “our cyber security division does not allow us to use Zoom.” Then send an alternative invitation. So far it seems to work just fine.

Re: Zoom RCE from Pwn2Own 2021

#29

Post by 1vuio0pswjnm7 » Sat, Aug 28, 2021, 8:32 PM UTC

sriram_sun wrote: post #15

FTA: "Using a combination of proxies, modified DNS records, sslsplit and a new CA certificate installed in Windows, we were able to inspect all traffic, including HTTP and XMPP, in our test environment." I have setup wireshark for troubleshooting. That's about it. What's the role of proxies, modified DNS records etc. in this setup? How can I duplicate this? Thanks.

With DNS one can avoid having to use the firewall for redirection

sslsplit documentation actually suggests DNS as an alternative to using firewall

Theres a number of easy-to-use UNIX firewalls. Not sure about Windows

Proxies allow easy inspection of HTTP traffic, among other things. Arguably sslsplit is itself a proxy, specifically a forward proxy

There are many ways to monitor HTTP traffic. More than one way to do it

Why doesnt Zoom use certificate pinning

(I avoid using sites/apps that force use of third-party controlled pinned certificates. What are they trying to hide from the user)

Re: Zoom RCE from Pwn2Own 2021

#30

Post by Wowfunhappy » Sat, Aug 28, 2021, 8:37 PM UTC

1vuio0pswjnm7 wrote: post #29

sriram_sun wrote: post #15

FTA: "Using a combination of proxies, modified DNS records, sslsplit and a new CA certificate installed in Windows, we were able to inspect all traffic, including HTTP and XMPP, in our test environment." I have setup wireshark for troubleshooting. That's about it. What's the role of proxies, modified DNS records etc. in this setup? How can I duplicate this? Thanks.

With DNS one can avoid having to use the firewall for redirection sslsplit documentation actually suggests DNS as an alternative to using firewall Theres a number of easy-to-use UNIX firewalls. Not sure about Windows Proxies allow easy inspection of HTTP traffic, among other things. Arguably sslsplit is itself a proxy, specifically a forward proxy There are many ways to monitor HTTP traffic. More than one way to do i…

Certificate pinning makes it impossible to examine what the software on my own machine is sending over my network! Please don't do that.