Zoom RCE from Pwn2Own 2021 • Hacker News Board

Re: Zoom RCE from Pwn2Own 2021

#31

Post by Wowfunhappy » Sat, Aug 28, 2021, 8:40 PM UTC

swiley wrote: post #2

No one should be installing native apps for this now that we have WebRTC.

All of the apps that use WebRTC seem to have worse quality and latency than Zoom. Including the semi-hidden web version of Zoom.

This could just be a coincidence, but I suspect it's not. For all of its faults, Zoom calls are just much better than all of the other mainstream solutions I've tried, particularly with large groups.

Re: Zoom RCE from Pwn2Own 2021

#32

Post by fancy_pantser » Sat, Aug 28, 2021, 8:49 PM UTC

swiley wrote: post #2

No one should be installing native apps for this now that we have WebRTC.

There's a YC company that tries to make starting and scaling WebRTC super easy, which is far from trivial for a variety of clients/browsers or with 5+ participants simultaneously: https://www.daily.co

Re: Zoom RCE from Pwn2Own 2021

#33

Post by dmurray » Sat, Aug 28, 2021, 8:51 PM UTC

underscore_ku wrote: post #27

makeworld wrote: post #26

This is why I only run Zoom in Firejail.

i run the snap Zoom on Ubuntu

Is that more secure? Snaps seem to be shit for performance, so I avoid them by default, but maybe I should be favouring them when I have security concerns.

Re: Zoom RCE from Pwn2Own 2021

#34

Post by johnchristopher » Sat, Aug 28, 2021, 8:57 PM UTC

Are there any cases or instances of secrets leaking from a zoom meeting through hacking ? Specifically from audio and video, not chat ?

Re: Zoom RCE from Pwn2Own 2021

#35

Post by puszczyk » Sat, Aug 28, 2021, 9:15 PM UTC

travoc wrote: post #28

makeworld wrote: post #26

This is why I only run Zoom in Firejail.

I just decline Zoom meetings while politely saying “our cyber security division does not allow us to use Zoom.” Then send an alternative invitation. So far it seems to work just fine.

What do you recommend to use instead?

Re: Zoom RCE from Pwn2Own 2021

#36

Post by thayne » Sat, Aug 28, 2021, 9:16 PM UTC

travoc wrote: post #28

makeworld wrote: post #26

This is why I only run Zoom in Firejail.

I just decline Zoom meetings while politely saying “our cyber security division does not allow us to use Zoom.” Then send an alternative invitation. So far it seems to work just fine.

Doesn't work so well when your security team are the ones mandating you use zoom.

Re: Zoom RCE from Pwn2Own 2021

#37

Post by rvp-x » Sat, Aug 28, 2021, 9:19 PM UTC

makeworld wrote: post #26

This is why I only run Zoom in Firejail.

FWIW it's possible to run Zoom in a web browser, but they make it annoying. https://techcrunch.com/2020/03/20/psa-yes-you-can-join-a-zoo...

Re: Zoom RCE from Pwn2Own 2021

#38

Post by skybrian » Sat, Aug 28, 2021, 9:23 PM UTC

This presumably doesn't apply to the web app, which is the only way I've used Zoom.

Re: Zoom RCE from Pwn2Own 2021

#39

Post by mvanaltvorst » Sat, Aug 28, 2021, 9:28 PM UTC

It blows my mind that there are people who manage to find exploit chains like these, amazing job!

Re: Zoom RCE from Pwn2Own 2021

#40

Post by koolba » Sat, Aug 28, 2021, 9:28 PM UTC

brundolf wrote: post #23

koolba wrote: post #20

Earlier quoted context omitted.

Last I checked you didn’t have to install anything. I’m not sure about more advanced usage like screen sharing or how many timing options their are, but for generic “see me, see you” it works fine in the browser.

It does have a web app, but they make it incredibly hard to find. I’m not surprised that some don’t even know about it

Indeed, IIRC, you need to click “download”, reject the download, and then an “Open in your browser” dialog appears.