Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerability in the Mac Zoom client allows malicious websites to enable camera

medium.com

Post reply on HN
Print view View original

261–270 of 473 posts

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#261

Post by ilikepi »

lawrencegs wrote: post #204

"Additionally, if you’ve ever installed the Zoom client and then uninstalled it, you still have a localhost web server on your machine that will happily re-install the Zoom client for you, without requiring any user interaction on your behalf besides visiting a webpage. This re-install ‘feature’ continues to work to this day." So... what's the best way to really really uninstall Zoom client from our Mac?

It's mentioned in the article. After uninstalling the main application, you also have to kill the helper app named ZoomOpener. The article gives some Terminal commands to do this, but you should be able to find it in Activity Monitor if your more comfortable there. Once you kill ZoomOpener, remove it from the list of Login Items in System Preferences -> Users & Groups. Lastly delete the folder called .zoomus from your home directory. You can do this in Finder, but it'll be hidden by default, so you'll have to use Go -> Go to Folder... or some other trick to expose it.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#262

Post by wilde »

lanrh1836 wrote: post #97

This feels material, which is why I’m surprised there’s 0 movement in their stock price after hours. Why do you think that is?

If a company’s stock drops after a major vulnerability, you should buy. Equifax exposed everyone’s financial data and their stock is back above their pre-breach price.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#263

Post by ilikepi »

factorialboy wrote: post #206

Why don't people just use the web based Zoom client? I do this exclusively, have done so for a few months now. One of the main features of a browser is to provide a secure runtime.

There's a web client?

I'd guess the reason is that, if you don't have any of the native apps installed, and you click a Zoom meeting link, the browser will download the native client installer. There's no mention at all on the download page that there is a web client.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#264

Post by yoz-y »

Crinus wrote: post #230
simias wrote: post #203

Earlier quoted context omitted.

Same problem Microsoft faced when it added "UAC" in Vista. Admittedly the implementation might not have been the best from a usability perspective but I think any attempt at implementing proper privilege management in Windows would have had many users complaining and not seeing the point. I guess the lesson here is not to give your users bad habits for the sake of convenience otherwise it'll backfire if you ever want…

It wasn't bad habits, up to Windows XP which introduced user separation on consumer oriented Windows (NT and 2K were meant for businesses and businesses who had networked PCs were really meant to use those) all personal computers were fully controlled by their users without any notion of privilege separation - this is a behavior that traces its lineage back to the original Altair 8800. Computers weren't networked and…

I’ve had viruses and anti viruses years before I had internet. Getting a virus was trivial in the 90’s when windows had no security and any program could do anything.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#265

Post by sbarre »

Shivetya wrote: post #211
vinay_ys wrote: post #134

On my Mac, I have uBlockOrigin installed in my browser and I have it configured to always block 3rdparty and 3rdparty frames and it prevents both the POCs completely. I have one browser that I use for work email and video conference, where system grants access to camera/microphone to the browser and browser allows Google Meet to access camera. I have another browser where system does not grant access to any of the de…

and I am in the crowd of mac users who tape over their camera. when it comes to video conferences at most I have ever seen the desktop shared. what type of work do you do that uses the video for portions other than the presentation?

> what type of work do you do that uses the video for portions other than the presentation?

My department (of 400 people) is split between two cities. I am regularly in meetings with people from the other city.

Google Meet is a big part of our culture. It helps with team cohesion and collaboration to actually see each other's faces when we meet.

It is of course not _required_ but I really believe it is better than just audio.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#266

Post by Jedi72 »

Well, the company and product are dead to me now, gonna hassle our CTO to switch. I just really hope theres some dev at Zoom who hated this whole installing backdoors idea who's gonna have the greatest "I told you so" day at the office tomorrow.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#267

Post by rahoulb »

rahoulb wrote: post #176

I asked Zoom support about this and they sent me to this page: https://blog.zoom.us/wordpress/2019/07/08/response-to-video-... The key thing here is they think this is a fair trade-off because Safari asks if you want to open Zoom. > This is a workaround to a change introduced in Safari 12 that requires a user to confirm that they want to start the Zoom client prior to joining every meeting. The local web server enabl…

I realised I had a paid account, so I've cancelled that too. And I've also reported them to Apple, after seeing that the ZoomOpener app reinstalls the client - which is completely and utterly unacceptable.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#268

Post by Jedi72 »

ilikepi wrote: post #261
lawrencegs wrote: post #204

"Additionally, if you’ve ever installed the Zoom client and then uninstalled it, you still have a localhost web server on your machine that will happily re-install the Zoom client for you, without requiring any user interaction on your behalf besides visiting a webpage. This re-install ‘feature’ continues to work to this day." So... what's the best way to really really uninstall Zoom client from our Mac?

It's mentioned in the article. After uninstalling the main application, you also have to kill the helper app named ZoomOpener. The article gives some Terminal commands to do this, but you should be able to find it in Activity Monitor if your more comfortable there. Once you kill ZoomOpener, remove it from the list of Login Items in System Preferences -> Users & Groups. Lastly delete the folder called .zoomus from you…

Now go explain that to the folks in Marketing.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#269

Post by 0xDEFC0DE »

pjc50 wrote: post #130
lanrh1836 wrote: post #97

This feels material, which is why I’m surprised there’s 0 movement in their stock price after hours. Why do you think that is?

Stock markets very rarely care about security, unless it's somehow front page news.

Tavis Ormandy joked about buying those dips because of this and I really don't think either of you are wrong and I might start doing it myself.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#270

Post by palebluedot »

TACIXAT wrote: post #21

The Zoom client on Linux used to (?) have a nasty command injection. The URL for joining a meeting got passed to some bash reinvocation (so they could set the library path if my memory serves me). A specially crafted URL could execute commands on the system. I haven't been too interested in using Zoom since seeing that.

I hadn't heard of this, so I looked it up, and you are right: https://www.exploit-db.com/exploits/43354

At least that was patched. These sorts of issues are frustrating, because as a Linux user I really want to like Zoom -- I appreciate that the treat all platforms pretty equal (Mac, Windows, Linux, Android, iOS) with native apps. That is a rarity.

Post reply on HN