Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerability in the Mac Zoom client allows malicious websites to enable camera

medium.com

Post reply on HN
Print view View original

311–320 of 473 posts

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#311

Post by mikeash »

rahoulb wrote: post #176

I asked Zoom support about this and they sent me to this page: https://blog.zoom.us/wordpress/2019/07/08/response-to-video-... The key thing here is they think this is a fair trade-off because Safari asks if you want to open Zoom. > This is a workaround to a change introduced in Safari 12 that requires a user to confirm that they want to start the Zoom client prior to joining every meeting. The local web server enabl…

What a glorious response. “Your product is broken.” “We know, we did it on purpose, and we’re proud of it!”

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#312

Post by ubermonkey »

muraiki wrote: post #285
ubermonkey wrote: post #272

Earlier quoted context omitted.

(prior reply deleted once I read about the fucking local webserver & phantom reinstallation bullshit. Fuck zoom.)

It's ridiculous to install a constantly running web service that uses tricks to circumvent CORS protection and to get around Safari's protections, which were both rightly created to improve user's security. It's not a "so-called vulnerability". As the article describes, this could be used in concert with another vulnerability to achieve RCE. Combining vulnerabilities is often how RCE is attained. These actions undo t…

Yeah, I was focussing on the webcam thing. That piece, taking individually, isn't a big deal.

But the web server / CORS bypass is completely fucked up, nefarious, and unforgivable.

Accordingly, I edited my post.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#313

Post by rileymat2 »

kuzimoto wrote: post #299
yoz-y wrote: post #264

Earlier quoted context omitted.

I’ve had viruses and anti viruses years before I had internet. Getting a virus was trivial in the 90’s when windows had no security and any program could do anything.

Your comment is a bit ambiguous. Are you saying that even retail software could be considered a virus just because of what it can do on the system? Or was virus software making it onto the machine in other ways?

In our computer lab we got viruses spread by disks.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#314

Post by Jedi72 »

robbiemitchell wrote: post #288
Jedi72 wrote: post #266

Well, the company and product are dead to me now, gonna hassle our CTO to switch. I just really hope theres some dev at Zoom who hated this whole installing backdoors idea who's gonna have the greatest "I told you so" day at the office tomorrow.

Interesting to me that this would be your CTO’s decision.

Hes my direct report-to and has ears of everyone that matters, so its really just my decision of who to pester to get it up the chain.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#317

Post by mikeash »

fortran77 wrote: post #316

I'm surprised that Mac doesn't have a built-in firewall that warns if an app installs something that listens on a port. They advertise OSX as being "secure by design."

The built-in firewall does exactly that. It may not do that for things that only listen on localhost, though.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#318

Post by jontas »

Does this work in the Tor browser to launch the zoom client and expose your identity?

edited: after some research it is clear that this would work in the Tor browser. So if you are logged into Zoom using your real ID a malicious Tor site could launch the client and harvest your name. And if you are only using the browser bundle (and not routing all traffic through Tor) Zoom and/or Zoom+government could use this to expose the real IP of tor users.

Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera

#319

Post by fokinsean »

chrisfosterelli wrote: post #157
pjc50 wrote: post #131

Earlier quoted context omitted.

Am I right in thinking that CORS only applies to Javascript-initiated requests? This trick uses an embedded image to make the request.

That's correct, and part of my point. If they used CORS headers correctly it could both be secure and not require a crazy image hack. The image hack seems like a lot of work to go through to make an app LESS secure.

I'm a bit confused, so CORS doesn't apply when trying to load an image?

If they set CORS to allow interaction from anywhere, why use an image and not load data with js?

Post reply on HN