Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom RCE from Pwn2Own 2021

sector7.computest.nl

Post reply on HN
Print view View original

91–100 of 126 posts

Re: Zoom RCE from Pwn2Own 2021

#91

Post by yomly »

nitinreddy88 wrote: post #79
xxpor wrote: post #69

Earlier quoted context omitted.

>As an employer I would prefer employees not to use the corporate network for personal email. The network exists for business use. And as an employee that actually exists in 2021, I'd tell you to get a clue. >As an employee I prefer not to use the corporate network for truly personal email. And that's your preference. If you think everyone shares that preference or even realizes the implications you're delusional. >I…

Probably you might need to re-read your employee agreement. Some of these policies are clearly stated and you signed up for them when you are employeed

Don't know why you are getting downvoted and people are getting emotional.

I have family members who work in compliance. Everything is fair game for surveillance. I know of someone who got fired for accidentally uploading his whatsapp chat history via work email (this is how chat history backup used to work) and they got fired from JPMorgan for having references to drugs.

You can choose not to work for companies like this (indeed I have always fully owned my machine at work) but you're just kidding yourself if you think bigco aren't monitoring everything you do.

Re: Zoom RCE from Pwn2Own 2021

#93

Post by smolder »

skrebbel wrote: post #85
junon wrote: post #54

Earlier quoted context omitted.

This is generally through the use of (often custom) analyzers. I would wager, though I have little empirical evidence, that most non-trivial zero days of large software like this are not strictly manually discovered.

Isn't this a bit like saying most software these days isn't manually built, because they use compilers?

Not sure the point of this comparison. Using compilers to build software has been all but required for a long time, and exploit discovery can be done just by using the software in unexpected ways, or by using complex reverse engineering and analysis tools.

Re: Zoom RCE from Pwn2Own 2021

#94

Post by Thorrez »

fn-mote wrote: post #45
Wowfunhappy wrote: post #30

Earlier quoted context omitted.

Certificate pinning makes it impossible to examine what the software on my own machine is sending over my network! Please don't do that.

Isn't certificate pinning what keeps my employer from MITM'ing my personal email session on their network?

You're checking your personal email on your work computer? Your employer can see that. One way would be through screen recording. But even without screen recording, your employer can install its own certificates. Chrome at least ignores certificate pinning if there are custom installed local certificates.

If you're on a personal device (e.g. your personal phone) on a work wifi, you're secure whether or not certificate pinning is used.

So I don't really see any situation in which certificate pinning will help you. The purpose of certificate pinning is to protect against malicious regular root CAs. It's not to protect against your employer or anyone else who can install custom root CAs on your machine, because they could also install malware that steals data directly from Chrome.

>Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor.

https://chromium.googlesource.com/chromium/src/+/refs/heads/...

Re: Zoom RCE from Pwn2Own 2021

#95

Post by Thorrez »

notatoad wrote: post #80
EvanAnderson wrote: post #47

Earlier quoted context omitted.

No. Your employer can't MITM your personal email session if you don't trust their MITM proxy's CA.

if your employer controls your work computer, they can set it to trust their MITM CA. cert pinning means they can't do that unless they're also modifying yoru email client binaries.

It depends on your email client. If your email client is Chrome, then the pinning won't help you at all.

>Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor.

https://chromium.googlesource.com/chromium/src/+/refs/heads/...

Re: Zoom RCE from Pwn2Own 2021

#96

Post by Thorrez »

Silhouette wrote: post #52
PeterisP wrote: post #48

Earlier quoted context omitted.

Basic TLS is sufficient to stop your employer from MITM'ing your personal email session as long as you control what certificates your machine trust. Certificate pinning is what protects the main sites (who use pinning) from an advanced attacker or a rogue government who are able get a proper CA to issue fake certificates.

Basic TLS is sufficient to stop your employer from MITM'ing your personal email session as long as you control what certificates your machine trust. Which, on almost any employer-issued device on a large corporate network today, you won't. Personal stuff goes on personal devices with personal connectivity and uses personal accounts with personal security. Work stuff goes on work devices with work connectivity and use…

Yep. Pinning doesn't protect you, using a personal device protects you.

You mention needing to use personal connectivity. I don't think that's necessary. HTTPS should protect you from malicious networks.

Re: Zoom RCE from Pwn2Own 2021

#97

Post by Thorrez »

1vuio0pswjnm7 wrote: post #49
fn-mote wrote: post #45

Earlier quoted context omitted.

Isn't certificate pinning what keeps my employer from MITM'ing my personal email session on their network?

As an employer I would prefer employees not to use the corporate network for personal email. The network exists for business use. As an employee I prefer not to use the corporate network for truly personal email. If I am the employer that responsibly monitors the traffic to and from our network, including TLS traffic, an employee that uses our network for personal use with a surveillance "tech" company service such a…

I assume you're talking only about employees using corporate devices on the corporate network. If the employee can connect a personal device to the corporate network the employee will be safe from the MITM.

Re: Zoom RCE from Pwn2Own 2021

#98

Post by tialaramex »

reecko wrote: post #81
UncleMeat wrote: post #58

Earlier quoted context omitted.

Imagine thinking we should, literally, police engineering techniques. If you build a bridge then you are expected to use techniques and systems that provide at least some degree of planned safety for the users of that bridge. It is virtually impossible to write a C++ program of any meaningful complexity that processes untrusted data in an unsandboxed environment that does not expose the owner of the device running th…

Your point might make sense for web facing software because programs where lives are actually at stake are written in Ada or a subset of C with rigorous static analysis and engineering processes. Now, it can't be denied that C and C++ are weak from a security perspective and that they should be avoided for network software as much as possible. But the problem with your take is the subtle implication that Rust is "saf…

> the subtle implication that Rust is "safe" (not just memory-safe)

It's not a "subtle implication" it's a fact that Rust is also data race free and thus concurrency safe in the same sense you're attributing to Verona, although for very different reasons - it can't introduce data races. Verona, unlike Rust, is not in fact a production system, it's an academic toy for pondering new ways to approach concurrency. Perhaps ten years from now its findings will influence future Rust development.

It's certainly interesting that we're still at the place where people are going, "This is only better if you can't afford GC", when even Java is markedly less safe than Rust since it doesn't prevent data races. (Yes there is ConcurrentModificationException for this, no Java doesn't promise to raise this Exception, and if it happens that might already be too late).

Re: Zoom RCE from Pwn2Own 2021

#99

Post by reecko »

staticassertion wrote: post #89
reecko wrote: post #84

Earlier quoted context omitted.

No, that is why I wrote "subtle implication" there. Unfortunately on online forums, the term "memory-safety" (which is a well-defined term in computer science), is nowadays almost always used in contexts of Rust evangelism. I would be very surprised if the GP's actual intent was that Zoom must have been written in a garbage collected language and not Rust. The wider context of this discussion at all is that whether m…

You sound paranoid.

That is a neat attempt at making it appear like I am somehow deluded and am imagining Rust evangelism. The person I replied to made a comment down thread that literally states that Rust must be given a free pass despite `unsafe` blocks on the face of such legislation against unsafe languages. Sounds completely illogical to me.

https://news.ycombinator.com/item?id=28343526

Re: Zoom RCE from Pwn2Own 2021

#100

Post by 1vuio0pswjnm7 »

nitinreddy88 wrote: post #79
xxpor wrote: post #69

Earlier quoted context omitted.

>As an employer I would prefer employees not to use the corporate network for personal email. The network exists for business use. And as an employee that actually exists in 2021, I'd tell you to get a clue. >As an employee I prefer not to use the corporate network for truly personal email. And that's your preference. If you think everyone shares that preference or even realizes the implications you're delusional. >I…

Probably you might need to re-read your employee agreement. Some of these policies are clearly stated and you signed up for them when you are employeed

I doubt he read it the first time. :)
Post reply on HN