241–250 of 473 posts
I really wish physical switches that cut power to mics and cameras were standard on everything. I know that would be change from how hardware works / is designed now but it also seems like the only reliable line of defense.
On my Mac, I have uBlockOrigin installed in my browser and I have it configured to always block 3rdparty and 3rdparty frames and it prevents both the POCs completely. I have one browser that I use for work email and video conference, where system grants access to camera/microphone to the browser and browser allows Google Meet to access camera. I have another browser where system does not grant access to any of the de…
and I am in the crowd of mac users who tape over their camera. when it comes to video conferences at most I have ever seen the desktop shared. what type of work do you do that uses the video for portions other than the presentation?
I'm trying to think of the real-world implications and how this would play out. Normally this would be pretty obvious, wouldn't it? Users would see Zoom open into some weird meeting, and close it. Presuming the exploit cannot avoid bringing the Zoom app to the foreground when it joins the meeting and activates the camera/mic. If it can do that and stay in the background, all bets are off. In spite of its obviousness,…
Another small thing (big for me) Zoom does is register their app as the handler for `tel:` links every time you launch it, with seemingly no way to disable that. Companies that make themselves the default for something on your machine by force are not to be trusted. I’m not surprised they start a web server from under their users, and that their response to the vulnerability was lacklustre.
Click on the app icon, hold, move to Trash.
See here: https://apple.stackexchange.com/questions/358651/unable-to-c...
That web server is exploitable, as explained in the article.
Note that most Zoom users (probably lots of business people) won't be capable of following the uninstall steps necessary at the moment..
Earlier quoted context omitted.
A custom URI wouldn't work as seamlessly as zoom's UX team would have liked. If you hadn't installed zoom, either a nasty message would tell you the protocol wasn't supported, or it would redirect you to a google search. Their answer was to send people to a URL they controlled and brought you through the install process as easily as possible, but the issue they needed to solve was determining if you needed to have an…
> The UX team You seem to imply that they have an UX team but not a security team, so nobody convinced anybody else that this wasn't a good idea. Without genuine security orientation, even if an expert realizes there is a security problem, who wants to be the boring paranoid pessimist who wastes time and attempts to ruin products, only to be staved off by the efforts of more productive employees that focus on adding…
Decisions need to be made between strong opinions about the right path forward. There needs to be balance and respect between these aspects.
Reading the PR statement, I highly doubt the people who have those strong opinions about security are being given a fair voice. They are probably there, but they have zero power to change anything within their product.
Another small thing (big for me) Zoom does is register their app as the handler for `tel:` links every time you launch it, with seemingly no way to disable that. Companies that make themselves the default for something on your machine by force are not to be trusted. I’m not surprised they start a web server from under their users, and that their response to the vulnerability was lacklustre.
You might be able to remove this with https://github.com/Lord-Kamina/SwiftDefaultApps
Hi I'm the author, AMA Or come hang out in the party chat! Use the exploit to join: https://jlleitschuh.org/zoom_vulnerability_poc/zoompwn_ifram...
Huh, I'm on Windows and it auto-joined the meeting too, with video enabled. I wonder if this is because at some point in the past I opened a Zoom meeting and allowed Chrome to open the Zoom URI in the Zoom app?