Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom RCE from Pwn2Own 2021

sector7.computest.nl

Post reply on HN
Print view View original

61–70 of 126 posts

Re: Zoom RCE from Pwn2Own 2021

#61

Post by feanaro »

dvt wrote: post #55
titzer wrote: post #43

> This meant that by sending a ResponseKey message with an AES-encrypted element of more than 1024 bytes, it was possible to overflow a heap buffer. This is what I was looking for. Fundamental bug was an overflow of statically-allocated buffer leading to heap corruption. We gotta get off memory-unsafe languages.

> We gotta get off memory-unsafe languages. You read this whole post and that's what you got? Just the fact that this includes a heap grooming step should be pretty telling that it's not very reliable and that it can easily be broken (it probably won't work if you try it after the next Win10 update). I mean, yeah, sure, buffer overflows are bad, but this is an extremely sophisticated attack that relies on like a zill…

Why does it matter how reliable it is? What matters is that it's possible. If it breaks with an update, the technique can be pretty easily adapted to work again.

Re: Zoom RCE from Pwn2Own 2021

#62

Post by feanaro »

puszczyk wrote: post #35
travoc wrote: post #28

Earlier quoted context omitted.

I just decline Zoom meetings while politely saying “our cyber security division does not allow us to use Zoom.” Then send an alternative invitation. So far it seems to work just fine.

What do you recommend to use instead?

Jitsi Meet.

Re: Zoom RCE from Pwn2Own 2021

#63

Post by staticassertion »

dvt wrote: post #55
titzer wrote: post #43

> This meant that by sending a ResponseKey message with an AES-encrypted element of more than 1024 bytes, it was possible to overflow a heap buffer. This is what I was looking for. Fundamental bug was an overflow of statically-allocated buffer leading to heap corruption. We gotta get off memory-unsafe languages.

> We gotta get off memory-unsafe languages. You read this whole post and that's what you got? Just the fact that this includes a heap grooming step should be pretty telling that it's not very reliable and that it can easily be broken (it probably won't work if you try it after the next Win10 update). I mean, yeah, sure, buffer overflows are bad, but this is an extremely sophisticated attack that relies on like a zill…

Just because there's heap grooming involved doesn't mean it's unreliable. Exploits that use heap grooming can often be ~100% reliable.

Our POC for Sigred required lots of heap grooming but it was extremely reliable. https://www.graplsecurity.com/post/anatomy-of-an-exploit-rce...

The overflow was hardly a footnote either, it's the primary bug being exploited here.

Re: Zoom RCE from Pwn2Own 2021

#64

Post by staticassertion »

cle wrote: post #12
swiley wrote: post #2

No one should be installing native apps for this now that we have WebRTC.

So browser sandboxing? Is that fundamentally different from native sandboxes like snap, flatpak, et al?

Browser vendors push sandboxing technology and everything else kinda follows behind by years. It's unlikely you'll find a more powerful sandboxing approach than what's in Chrome.

Re: Zoom RCE from Pwn2Own 2021

#65

Post by staticassertion »

junon wrote: post #53
UncleMeat wrote: post #51

Earlier quoted context omitted.

Yup. I wouldn't hate it if it were illegal to write new applications that processed untrusted input in memory-unsafe languages, at least in the not too distant future. The fact that the industry doesn't see this as an urgent need is just embarrassing.

Imagine thinking we should, literally, police language.

We have quality and standards regulations for all sorts of things, thankfully. That software doesn't makes it the odd one out.

Re: Zoom RCE from Pwn2Own 2021

#66

Post by staticassertion »

Silhouette wrote: post #52
PeterisP wrote: post #48

Earlier quoted context omitted.

Basic TLS is sufficient to stop your employer from MITM'ing your personal email session as long as you control what certificates your machine trust. Certificate pinning is what protects the main sites (who use pinning) from an advanced attacker or a rogue government who are able get a proper CA to issue fake certificates.

Basic TLS is sufficient to stop your employer from MITM'ing your personal email session as long as you control what certificates your machine trust. Which, on almost any employer-issued device on a large corporate network today, you won't. Personal stuff goes on personal devices with personal connectivity and uses personal accounts with personal security. Work stuff goes on work devices with work connectivity and use…

By contrast, I'm typing on a work computer right now. We deploy no special certificates to attempt to MITM traffic, nor will we ever.

I'm using a Chromebook, which allows me to run multiple users at the same time, each with their own profiles. Each user has their own encryption keys for their hard drive. We have no corporate network, no VPN, and instead rely on attestation for authorization.

I prefer to use this device for personal use because I know how safe it is.

Re: Zoom RCE from Pwn2Own 2021

#67

Post by bagels »

UncleMeat wrote: post #58
junon wrote: post #53

Earlier quoted context omitted.

Imagine thinking we should, literally, police language.

Imagine thinking we should, literally, police engineering techniques. If you build a bridge then you are expected to use techniques and systems that provide at least some degree of planned safety for the users of that bridge. It is virtually impossible to write a C++ program of any meaningful complexity that processes untrusted data in an unsandboxed environment that does not expose the owner of the device running th…

I don't think comparing software to buildings is always apt.

If a building collapses, it's likely that people will die.

The consequences of failing software can be mere annoyances depending on the context of its use.

Obviously certain industries that use software have much more dire consequences of failure though (eg. large machinery, transport, health care).

I think one could come up with all sorts of analogies that fit or don't fit, such as, applying a similar argument to door locks. Why should it be legal to use ordinary keyed locks on houses when they are so easy to circumvent with basic lockpicks?

Re: Zoom RCE from Pwn2Own 2021

#68

Post by gwerbret »

UncleMeat wrote: post #58
junon wrote: post #53

Earlier quoted context omitted.

Imagine thinking we should, literally, police language.

Imagine thinking we should, literally, police engineering techniques. If you build a bridge then you are expected to use techniques and systems that provide at least some degree of planned safety for the users of that bridge. It is virtually impossible to write a C++ program of any meaningful complexity that processes untrusted data in an unsandboxed environment that does not expose the owner of the device running th…

You make a very sound argument about the engineering perspective.

Unfortunately, many of the folks writing such software aren't (formally-trained) engineers. Would you suggest that they receive training which allows them to think of software as infrastructure? I'm genuinely curious, not being sarcastic.

Re: Zoom RCE from Pwn2Own 2021

#69

Post by xxpor »

1vuio0pswjnm7 wrote: post #49
fn-mote wrote: post #45

Earlier quoted context omitted.

Isn't certificate pinning what keeps my employer from MITM'ing my personal email session on their network?

As an employer I would prefer employees not to use the corporate network for personal email. The network exists for business use. As an employee I prefer not to use the corporate network for truly personal email. If I am the employer that responsibly monitors the traffic to and from our network, including TLS traffic, an employee that uses our network for personal use with a surveillance "tech" company service such a…

>As an employer I would prefer employees not to use the corporate network for personal email. The network exists for business use.

And as an employee that actually exists in 2021, I'd tell you to get a clue.

>As an employee I prefer not to use the corporate network for truly personal email.

And that's your preference. If you think everyone shares that preference or even realizes the implications you're delusional.

>If I am the employer that responsibly monitors the traffic to and from our network, including TLS traffic, an employee that uses our network for personal use with a surveillance "tech" company service such as Google Mail, Facebook, etc. is putting her own privacy at risk.

No, you're putting them at risk by MITMing their traffic. There's absolutely nothing that forces you to do that. If you don't have separation between the network where humans live, and where The Business lives, that's what's irresponsible.

Re: Zoom RCE from Pwn2Own 2021

#70

Post by userbinator »

UncleMeat wrote: post #51
titzer wrote: post #43

> This meant that by sending a ResponseKey message with an AES-encrypted element of more than 1024 bytes, it was possible to overflow a heap buffer. This is what I was looking for. Fundamental bug was an overflow of statically-allocated buffer leading to heap corruption. We gotta get off memory-unsafe languages.

Yup. I wouldn't hate it if it were illegal to write new applications that processed untrusted input in memory-unsafe languages, at least in the not too distant future. The fact that the industry doesn't see this as an urgent need is just embarrassing.

That's the last thing I want to hear from the authoritarian industry who also writes user-hostile software, embraces DRM, and is deathly scared of users having control over their general-purpose computers.

Insecurity is freedom. (Don't believe me? How is jailbreaking and rooting accomplished?)

Post reply on HN