Live data from Hacker News

Zoom RCE from Pwn2Own 2021

sector7.computest.nl

81–90 of 126 posts

Re: Zoom RCE from Pwn2Own 2021

#81
post #53

Earlier quoted context omitted.

Imagine thinking we should, literally, police language.

Imagine thinking we should, literally, police engineering techniques. If you build a bridge then you are expected to use techniques and systems that provide at least some degree of planned safety for the users of that bridge. It is virtually impossible to write a C++ program of any meaningful complexity that processes untrusted data in an unsandboxed environment that does not expose the owner of the device running th…

Your point might make sense for web facing software because programs where lives are actually at stake are written in Ada or a subset of C with rigorous static analysis and engineering processes.

Now, it can't be denied that C and C++ are weak from a security perspective and that they should be avoided for network software as much as possible. But the problem with your take is the subtle implication that Rust is "safe" (not just memory-safe) when in fact there is no empirical evidence or track record of Rust being successfully used in anything remotely mission-critical. I mention this because you brought up the bridge example when it is also possible that due to language complexity that the new "bridge" built in Rust would turn out to be even fragile (but just memory-safe).

Just the other day, there was a Rust GUI library posted here. The library uses a convoluted event handling mechanism of passing enum values as messages and additional book-keeping burden instead of straightforward closures just so that the compiler can prove the code is safe (just memory-safe, mind you). It is possible that because of such contortions required to pass the compiler, Rust could fare worse in the "general correctness" area[1]. It is just that we don't know yet. Even the particular safety issue that is mentioned in the GP comment could be solved by having built-in slice types and mandatory bounds checking (like Zig/Go/D). As usual, C/C++ have terrible defaults.

Again, I agree that there is a need for secure alternatives to C and C++. But the contention is whether Rust is that. Even Rust is actually far from optimal in the "safe systems language" space. There might be languages in the future that are as fast as Rust but more ergonomic. Microsoft Research, for example, is creating a research language named Verona[2] that aims to be memory-safe and concurrency-safe. There are also other attempts like Vale[3] that aim at this space. It is premature to think that Rust is the final evolutionary step in the landscape of systems language and suggest for everything to be moved to Rust ASAP. It often appears like reckless fanaticism.

[1]: There is, in fact, few "anecdata" of Rust being less reliable: https://news.ycombinator.com/item?id=24027296 https://dev.to/yujiri8/it-seems-like-rust-software-us-bad-hk...

[2]: https://www.microsoft.com/en-us/research/project/project-ver...

[3]: https://vale.dev/

Re: Zoom RCE from Pwn2Own 2021

#82
post #33

Earlier quoted context omitted.

i run the snap Zoom on Ubuntu

Is that more secure? Snaps seem to be shit for performance, so I avoid them by default, but maybe I should be favouring them when I have security concerns.

Not really.

https://github.com/ogra1/zoom-snap/blob/065831f1e83c1230810a...

It has the "home" permissions which means it can write "sudo pwn" into your ~/.bashrc, which will of course pwn you.

Re: Zoom RCE from Pwn2Own 2021

#83
post #81

Earlier quoted context omitted.

Imagine thinking we should, literally, police engineering techniques. If you build a bridge then you are expected to use techniques and systems that provide at least some degree of planned safety for the users of that bridge. It is virtually impossible to write a C++ program of any meaningful complexity that processes untrusted data in an unsandboxed environment that does not expose the owner of the device running th…

Your point might make sense for web facing software because programs where lives are actually at stake are written in Ada or a subset of C with rigorous static analysis and engineering processes. Now, it can't be denied that C and C++ are weak from a security perspective and that they should be avoided for network software as much as possible. But the problem with your take is the subtle implication that Rust is "saf…

Did they edit their comment? I saw nothing about Rust in it

Re: Zoom RCE from Pwn2Own 2021

#84
post #83
post #81

Earlier quoted context omitted.

Your point might make sense for web facing software because programs where lives are actually at stake are written in Ada or a subset of C with rigorous static analysis and engineering processes. Now, it can't be denied that C and C++ are weak from a security perspective and that they should be avoided for network software as much as possible. But the problem with your take is the subtle implication that Rust is "saf…

Did they edit their comment? I saw nothing about Rust in it

No, that is why I wrote "subtle implication" there. Unfortunately on online forums, the term "memory-safety" (which is a well-defined term in computer science), is nowadays almost always used in contexts of Rust evangelism. I would be very surprised if the GP's actual intent was that Zoom must have been written in a garbage collected language and not Rust. The wider context of this discussion at all is that whether memory-unsafe languages (ie., C/C++) must be made illegal with the implicit suggestion that Rust must be pushed as the alternative. If C/C++ is made illegal (because "memory-unsafety"), then guess what would be the legal alternative if you can't afford GC overhead. Moreover, for people not using C/C++, the question of memory-safety/unsafety doesn't even arise in the first place.

Re: Zoom RCE from Pwn2Own 2021

#85
post #54

It blows my mind that there are people who manage to find exploit chains like these, amazing job!

This is generally through the use of (often custom) analyzers. I would wager, though I have little empirical evidence, that most non-trivial zero days of large software like this are not strictly manually discovered.

Isn't this a bit like saying most software these days isn't manually built, because they use compilers?

Re: Zoom RCE from Pwn2Own 2021

#86
post #69

Earlier quoted context omitted.

>As an employer I would prefer employees not to use the corporate network for personal email. The network exists for business use. And as an employee that actually exists in 2021, I'd tell you to get a clue. >As an employee I prefer not to use the corporate network for truly personal email. And that's your preference. If you think everyone shares that preference or even realizes the implications you're delusional. >I…

Probably you might need to re-read your employee agreement. Some of these policies are clearly stated and you signed up for them when you are employeed

And the standard startup contract says business hours are "9-5"

The poster's point is that what they say doesn't match reality, contract or otherwise

Re: Zoom RCE from Pwn2Own 2021

#87
post #18

Earlier quoted context omitted.

And the new certificate and DNS records are to make the proxy look legit to the Zoom client, which would otherwise not accept TLS connections. Especially if there are DNS records which specify which CA is used for the certificate.

> Especially if there are DNS records which specify which CA is used for the certificate. If you're thinking of CAA, those records are not for anybody except the CAs. They're an indication to the CA "You may/ may not issue for these names" and explicitly never an instruction to clients about what's trustworthy. It's unusual but completely sound to have CAA set to forbid all CAs, switch it to allow just one CA, get a…

Indeed, my mistake. Then I don't understand why they need to modify dns records.

Re: Zoom RCE from Pwn2Own 2021

#88
post #69

Earlier quoted context omitted.

As an employer I would prefer employees not to use the corporate network for personal email. The network exists for business use. As an employee I prefer not to use the corporate network for truly personal email. If I am the employer that responsibly monitors the traffic to and from our network, including TLS traffic, an employee that uses our network for personal use with a surveillance "tech" company service such a…

>As an employer I would prefer employees not to use the corporate network for personal email. The network exists for business use. And as an employee that actually exists in 2021, I'd tell you to get a clue. >As an employee I prefer not to use the corporate network for truly personal email. And that's your preference. If you think everyone shares that preference or even realizes the implications you're delusional. >I…

... As someone who exists in 2021, I have a smartphone. Why would I want to do my stuff on someone else's machine?

Re: Zoom RCE from Pwn2Own 2021

#89
post #84
post #83

Earlier quoted context omitted.

Did they edit their comment? I saw nothing about Rust in it

No, that is why I wrote "subtle implication" there. Unfortunately on online forums, the term "memory-safety" (which is a well-defined term in computer science), is nowadays almost always used in contexts of Rust evangelism. I would be very surprised if the GP's actual intent was that Zoom must have been written in a garbage collected language and not Rust. The wider context of this discussion at all is that whether m…

You sound paranoid.

Re: Zoom RCE from Pwn2Own 2021

#90
post #54

Earlier quoted context omitted.

This is generally through the use of (often custom) analyzers. I would wager, though I have little empirical evidence, that most non-trivial zero days of large software like this are not strictly manually discovered.

Isn't this a bit like saying most software these days isn't manually built, because they use compilers?

Not at all.
Post reply on HN