13 ms·

Zoom fixes major Mac webcam security flaw with emergency patch

326 points by azernik 7y ago

tracker1 7y ago
Tech executive changes stance after very public embarrassment that could impact their bottom line. If they didn't get the backlash, they would have kept their course. There's not really much "willing to accept responsibility" here as far as I'm concerned.
- PunksATawnyFill 7y ago
  Exactly. My company is actively shopping for a conferencing tool, and Zoom just ensured that it's eliminated.
  - ajna91 7y ago
    Anger is certainly justified, but it should give way to reconciliation once the offending party truly repents. Do we want a world of people who change their ways, even if for somewhat impure reasons, or a world in which no one ever does because it's pointless?
    - irq 7y ago
      They haven’t repented yet, though. Read their response.
      - o-__-o 7y ago
        No patch? What the actual fuck
      - bscphil 7y ago
        I don't understand, is there something specific you're referring to? From the article it looks like they're even removing the local web server.
        deleted 7y ago
        [deleted]
    - onion2k 7y ago
      We should definitely treat people as human beings and understand we're all fallible, we should try to forgive mistakes, and we should hope people learn when they get something wrong. That said, if someone does something to make us stop trusting them it's on them to show they've changed; it requires effort from both parties. There is no reason to extend this philosophy to corporations though. We can decide to use a competitor instead. No one needs to show loyalty to a supplier who screwed up.
    - kabwj 7y ago
      > Do we want a world of people who change their ways, even if for somewhat impure reasons, or a world in which no one ever does because it's pointless? You forgot another option: not making the mistake in the first place.
    - chrisbro 7y ago
      The thought process is that if they did this bad thing, only walked back the bad thing when it became public, and are maintaining that they didn't think the bad thing was that bad in the first place...what other nefarious things will that product team do?
    - dclowd9901 7y ago
      I've seen no evidence of true repentance here.
  - deleted 7y ago
    [deleted]
- dclowd9901 7y ago
  Let us be quite clear here: "Farley maintains that the relative security risk of the vulnerabilities that security researcher Jonathan Leitschuh disclosed yesterday were not as severe as Leitschuh made them out to be." That's the CIO still unwilling to accept what a poor decision it was to subversively install a web server on users' computers. They need to shut the fuck up unless the words coming out of their mouth are "we're sorry and we'll do better in the future".
dang 7y ago
The earlier discussion is at https://news.ycombinator.com/item?id=20387298 https://news.ycombinator.com/item?id=20387298.
- azernik 7y ago
  Specifically - OP is just the news that Zoom agreed to make the changes the security community demanded. Previous discussion is root discussion of the issue itself and of the Zoom response more generally.
dingo_bat 7y ago
There's not a single reason to use zoom over the n other existing meeting software. They just got big because of marketing. My office has recently switched from Skype business to zoom and I find it just as shitty. First of all there's absolutely no use for video, because who the fuck wants to see each other's faces in a work related call? Then there's the whole UI thing to consider. I haven't yet figured out how to initiate a call. I always copy the link and email it to the person I want to talk to. Then they see the email and click it. Compare that to Skype's simple call button. All in all, zoom is hyped up by their marketing and provides less than zero value over existing solutions.
migueltarga 7y ago
RingCentral Meetings still vulnerable: lsof -i :19424 https://www.ringcentral.com/whyringcentral/company/pressreleases/ringcentral-and-zoom-video-communications-announce-multi-yea.html https://www.ringcentral.com/whyringcentral/company/pressrele...
- russb 7y ago
  For those unaware, RingCentral white-labels the zoom.us product as their meeting solution.
  - hnzix 7y ago
    Ironically, RingCentral's convention schwag includes a stick-on laptop lens shutter.
olliej 7y ago
This is why no researcher should sign an NDA after to doing volunteer work for a for-profit Corp. If the reporter had agreed to the NDA required for the bug bounty, Zoom could have - and based on their earlier responses, would have - continued to ship this malware. But now because of the researcher signed an NDA they wouldn’t be able to inform the at risk public.
- adtac 7y ago
  Will shenanigans like this (declaring a security breach as not a security breach) be caught and fined under GDPR? According to the regulation, companies need to declare breaches in under 72 hours without any unduly delay, but Zoom left this unpatched for months!
  - rubbingalcohol 7y ago
    Someone would have to prove that their personal information was stolen or misused for GDPR enforcement to be relevant.
  - olliej 7y ago
    As a non-lawyer forum commentator I can say with absolute correctness that it will (or will not) maybe apply. More seriously: I would guess no, as the GDPR is concerned with data collection and compromise, but I can’t imagine they store all the video they forward. Of course I wouldn’t be surprised if someone sues them in the US (but given that the US sees companies as people for rights, but not punishment I imagine that they’ll be fine).
    - irq 7y ago
      “Can say”? Did you mean to write “cannot say”?
      - baq 7y ago
        it doesn't matter, that's the joke
pcx 7y ago
Good to see that they’ve turned around and fixed this issue the right way. I was gonna stop using Zoom otherwise.
- aaomidi 7y ago
  You should anyway. They had 90 days to do this, they didn't. Incompetent company. Incompetent management.
  - deleted 7y ago
    [deleted]
  - o-__-o 7y ago
    Dat IPO lyfe. Investors got their money, what’s the problem here?
akersten 7y ago
Stories like this are wonderful evidence of the effectiveness of public disclosure of security vulnerabilities, and are always heartwarming to see. Remember, 90-day disclosure windows are just a courtesy.
- Sahhaese 7y ago
  This is why I consider bug bounty programs problematic, because they've been co-opted from a system to manage responsible disclosure to a system to contain and manage non-disclosure.
  - vorpalhex 7y ago
    Bug bounty programs can be great tools to help reward researchers, secure products and help align new and amateur researchers who may not have ever reported a bug before to standards. But like all things, they can also be used to keep software insecure, hide issues, and instead buy off researchers.
- lamby 7y ago
  Mmm. This post by Matthew Garrett is good on this: https://mjg59.dreamwidth.org/52432.html https://mjg59.dreamwidth.org/52432.html
notafraudster 7y ago
Of the main facets of the problem, the vulnerability bothered me less than their obviously poor attitude towards fixing it in a responsible timeline, and that bothered me less than the discovery that they were running an always-active webserver to assist call launches and reinstallation. Is that a common thing that programs do? Should I be expected to portscan myself frequently to see if software is unexpectedly running web servers? How much battery am I losing to this stuff?
- graeme 7y ago
  The verge article mentions it's reasonably common and mentions some programs that do it. From the article, a tweet -------- They are far from alone, a quick `lsof -i | grep LISTEN` shows that I have: Spotify, Keybase, KBFS, iTunes, Numi, https://t.co/MVSAJgN9yY… https://t.co/MVSAJgN9yY… All running locally listening web servers. — Matthew Gregg (@braintube) July 9, 2019
  - anaphor 7y ago
    The spotify one is for spotify connect most likely. I'm guessing (although not sure, someone could verify it) that spotify connect requires some sort of authorization to work. Edit: here you go http://cgbystrom.com/articles/deconstructing-spotifys-builtin-http-server/ http://cgbystrom.com/articles/deconstructing-spotifys-builti...
  - asveikau 7y ago
    Did they just imply that every listening socket is a web server?
    - svenfaw 7y ago
      They are mixing apples and oranges indeed.
- Jonnax 7y ago
  I've noticed that the Intel software update scan tool is a web page now, I presume it is a client side application that communicates with a local web server. But I could be wrong.
anaphor 7y ago
This is why full disclosure is so effective. Nothing else works quite like dropping a full PoC and details of an exploit publicly to light a fire under their ass to fix it.
- olliej 7y ago
  Well it’s an argument for responsible disclosure - you tell them, give them plenty of time to fix it, and publish. But responsible disclosure absolutely does not mean “no disclosure”. It means give them a chance to fix it. If they choose not to you disclose so that people know that they need to take steps to protect themselves. The important thing is that the disclosure must become public. It doesn’t matter that they pushed an update, as none of the victims who had deleted/“uninstalled” zoom will get the update, and without the update they’ll still be running the server. The only way anyone would know about it is with the details being public. I’m waiting for Apple to use xprotect to kill the server on all machines, as that’s the only true solution for the uninstalled victims
  - lawnchair_larry 7y ago
    Responsible disclosure doesn’t mean anything. It’s an obsolete term. You’re referring to coordinated disclosure. https://blogs.technet.microsoft.com/ecostrat/2010/07/22/coordinated-vulnerability-disclosure-bringing-balance-to-the-force/ https://blogs.technet.microsoft.com/ecostrat/2010/07/22/coor...
    - gok 7y ago
      This case is actually a really great demonstration of why this often-repeated claim is false. This was responsible, but not coordinated, disclosure.
      - lifthrasiir 7y ago
        Only in the literal sense. A commonly cited issue on the term "responsible disclosure" is that the discoverer is responsible for one's action, even though the action indeed benefits the public. In this viewpoint the vender can argue that it is not responsible to ignore the vendor, even though the vendor itself is being unreasonable. The term "coordinated disclosure" is invented to fix this abuse. You can't literally interpret "responsible" or "coordinated" without this context.
tompic823 7y ago
What about users who had previously uninstalled the Zoom client? Must they now reinstall Zoom in order to be able to fully remove it? Surely there are users that won’t perform the manual update and will remain vulnerable indefinitely.
- jdlshore 7y ago
  Although I agree having an active webserver with dubious security controls is a problem, the vulnerability as we know it today installs Zoom... and this new version of Zoom uninstalls the webserver. So it is (or at least could be) a self-patching vulnerability.
- andrethegiant 7y ago
  I believe rm -rf ~/.zoomus should do the trick
eeeeeeeeeeeee 7y ago
Glad to see the company is changing course, but I’m not sure it would have happened without the public shaming. I want companies to fix things because something is insecure and it endangers the public, not because they have their feet to the fire. I know companies don’t always respond right the first time, I know I haven’t, but Zoom had over 90 days to consider their responses and possible options / software changes. Instead, they were dismissive of the entire thing and only changed course after loud public pressure.
- irq 7y ago
  And this is why anyone who trusts that organization in any way moving forward is a fool.
  - o-__-o 7y ago
    Nah leadership can change, see Microsoft and apple
    - blub 7y ago
      The Microsoft telemetry spyware was completely opaque and they kept changing it to work around users blocking it until they were shamed into publishing almost everything they collect. One still can't turn it off. Apple usually needs to be shamed into admitting to and repairing any broken hardware design. They had to be sued in multiple countries to stop misleading customers to buy AppleCare and allow them to use the warranty guaranteed by law.
    - read_if_gay_ 7y ago
      That’s more of a reason not to trust anything ever. If leaders change for the worse, your investment in the company gets screwed no matter how well they’d done previously. And that investment can be stocks or it can be data, to give an example which you can’t just pull.
      - 8ytecoder 7y ago
        Leaders influence company culture but it's also a self-feedback loop where leaders that fit the company culture end up being leaders in the first place. To break that feedback loop and change course is usually a conscious choice for a company. Even then leadership change and direction at the top is only one of the many signals. It's entirely possible for Zoom's CEO to be a security minded person and the PM/Infosec person who reviewed the security report decided it's not a flaw worth patching.
smaili 7y ago
> But we also recognize and respect the view of others that say they don’t want to have an extra process installed on their local machine. So that’s why we made the decision to remove that component — despite the fact that it’s going to require an extra click from Safari. Am I reading this correctly, their CIO believes it's the "extra process" that people are concerned about -- not the webcam vulnerability?
- Bluestrike2 7y ago
  Amusingly enough, they never actually describe that part as a vulnerability in their blog post. It's a "concern" about a "seamless join process." The word only gets used with regards to the DOS vulnerability, which is only part of the problem. I get the need to at least try and spin things, but it's kind of obvious in this example. And given how people tend to get antsy when they start thinking about possibly being spied on through their webcams, downplaying it is probably counterproductive.
Jedi72 7y ago
The security flaw isnt even the outrageous part. It was secretly installing webservers that dont even remove themselves when you uninstall the app that makes them scum.
- pavs 7y ago
  Dropbox also does this, so does a lot of other popular programs. do `lsof -i | grep LISTEN` to find out what server is running on your machine.
  - Jedi72 7y ago
    In my case there isnt anything I didnt expect. Also closing the apps that were running e.g. RabbitMQ actually stopped the webservers.
- oil25 7y ago
  > It was secretly installing webservers that dont even remove themselves when you uninstall the app that makes them scum. To be fair, dragging an "app" to Trash does not constitute un-installation. It was a poor design decision to implement features using a local web server, but let's not be so quick to attribute covert, malicious intentions.
  - IshKebab 7y ago
    Erm yes it does. That's how it is supposed to work on Mac and that's how it would work if they didn't sneakily install a web server.
  - Jedi72 7y ago
    Their latest patch they rushed out is basically just implementing uninstall the way it should be.
  - diegoperini 7y ago
    > To be fair, dragging an "app" to Trash does not constitute un-installation. Dragging an app to Trash MUST constitute uninstallation. If it doesn't, it is a bug. Leaving configuration files in home folder for easier on-boarding after a reinstall is not the same thing as leaving a self replicating rootkit running all the time. > It was a poor design decision to implement features using a local web server, but let's not be so quick to attribute covert, malicious intentions. Zoom, with all its advertised features, works like a charm from the user's standpoint. It is not that easy to craft such seamless video conferencing apps which makes me believe the team behind it is formed by really experienced people. If this assumption is true, "the poor decision" is actually the true intention and is probably a feature in case zoom needs to install extra software on my device when their business needs change. It feels more like a back up plan than a dirty hack. In my humble opinion, experts ignoring the ethical consequences of such decision are dangerous to society and their intention can be considered malicious if not criminal. I'm sick of seeing the blame always belonging to the business people. Unless taken hostage and forced to act despite not giving consent, the developer should be equally responsible. We don't treat murderers, burglars and scammers the same when they work under a boss. P.S: I probably strawmanned your answer to express my own opinion. English isn't my native language, sorry if my words sounded offensive.
kerng 7y ago
With their incompetent behavior they put a big target on their back now for security researches. In the end it's good for consumers since more issues will be found and promptly fixed. So kudos to the reporter!
yumraj 7y ago
I wonder if instead of the usual 90-day notice a slightly better approach would be an initial partial public disclosure of the issue, without divulging the actual exploit, and the fact that it had been communicated to the company so that a public countdown of the 90-day window can happen. The exploit can then be divulged to the public, automatically, on the expiration of the 90-day window, regardless of whether it's fixed or not, as that may also be educational. For example, after this Zoom issue other companies will hesitate to use a localhost webserver, but if the issue had quietly been fixed by Zoom other companies may still have been tempted to use similar approach.
- enneff 7y ago
  More often than not announcing the existence of a vulnerability is enough to motivate people to find it. It’s much easier to find something that you know is there than to just experiment blindly.
  - yumraj 7y ago
    Fair enough, but that can be countered by very minimal disclosure in the beginning, just that a vulnerability exists and it has been notified. Even if we don't do that, I think we should at least reveal the issue after it's been fixed in all the cases so that other entities can learn from that.
  - o-__-o 7y ago
    Yes. I learned the security release process for a major open source software and it became trivial to determine when vulnerabilities are patched and knowledge of their build process gives you an exact window to exploit said 0-day
- pdkl95 7y ago
  There isn't a 1-size-fits-all solution to this type of situation. Giving the company a reasonable time[1] to fix it is a good guideline to start with, but determining the best approach to use requires making several judgment calls. Is the exploit already being used in the wild? Should affected users be doing something asap to protect themselves? How quickly could someone transform your disclosure into something malicious? How much risk are we forcing the users to bear while we wait for a self-imposed arbitrary time limit to expire. Is there an actual benefit to be gained by delaying public disclosure? (Is the company using the time responsibly to implement a fix, or are they denying the problem exists? Handling a public disclosure meas adapting to the specific risks of the situation. [1] I would say 30 days is more appropriate, with the option to delay the public announcement if the company has handled the situation well and is working on the fix, but needs more time for a legitimate technical reason.
dangoor 7y ago
Amusingly enough, the standard menu position for Quit on the Mac is at the bottom of the menu… _now_ the Uninstall Zoom option is at the bottom of the menu, making it easy to accidentally invoke if you're used to selecting the last item there to quit. (I happened to have my hand on the mouse rather than keyboard at the time… normally I'd just cmd-Q).
- Corrado 7y ago
  Wow, I just checked and you are absolutely correct. How is it this hard for companies to check the Apple HIG for this type of thing?
diafygi 7y ago
I'm confused. Does the patch now make it to where if you drag the app to the trash, it actually uninstalls?
- auslander 7y ago
  First, does the patch actually fixes it? In original report, they "patched" it with the flaw remaining.
- oil25 7y ago
  A macOS "app" is just a directory with an executable binary and some convenient helper files for Finder. Dragging it to the trash does not remove artifacts, such as logs, supporting binaries, even methods of persistence, which may get placed somewhere else on the filesystem as part of a typical installation. This is not unique to Zoom or even Apple operating systems.
  - yoz-y 7y ago
    One thing I'd like to see (and this is definitely doable on macOS side) is that if you trash a .app, the OS would automatically revoke all permissions to it. If this were done then even with the sneaky reinstalling, the user would be alerted by a system dialog requesting access to their webcam.
    - o-__-o 7y ago
      If you have a ktext kernel driver to implement generic access to video input subsystems (think v4l) then why exactly would the user be alerted if the developer didn’t add the feature? Read: anyone can write a kernel driver for macOS, you are too trusting of your software vendors. Get a hardware switch
      - yoz-y 7y ago
        > anyone can write a kernel driver for macOS No they can't. With SIP you won't be able to install it if it is not signed (for kernel extensions only a very few developers have certificates) and in any case you will be alerted about it. Also there are plans to completely disallow making kernel extensions in release after Catalina (since they can now run in userspace, I imagine that userspace will not get access to pre-installed hardware)
gdfiutyer 7y ago
Does anyone know if this issue (and the BlueJeans one) would only affect the current user account? I currently have a separate limited user account just for meetings, and that’s where I install various meeting apps. So in my case is there any way to know if it affected all my accounts or just the one?
tambourine_man 7y ago
The more a think about it, the more a I come to the conclusion that we need a mixed computing paradigm. For many tasks (probably most and certainly for most people) the iOS model is the best. It is, however way too restrictive for a number of use cases. Prohibitively so. Imagine two very different and isolated environments. Terminal, compilers, file managers in one, most other software in the other. With perhaps shared folders between them.
- oil25 7y ago
  Qubes OS is an operating system which pursues exactly these design goals, and unlike iOS, it is free and open source.
- colechristensen 7y ago
  I want a web browser with fewer functions and permissions that is aligned with my interests to dominate most of my computer interactions. That would handle most things that most people do on their computers.
- ben0x539 7y ago
  And then every clown shop would insist that you install their agent program inside the trusted partition.
vinay_ys 7y ago
Let us be clear. Running a local helper agent that accepts properly formatted requests (includes authn/authz) to provide a valid expected functionality is a perfectly valid architectural choice for a full-fledged desktop computer and we shouldn't throw out this capability. The mistakes I see here are: - UX Dark Patterns – making uninstall hard/duplicitous - Helper process having security vulnerability - unauthenticated requests, providing unnecessary privileged operations like update/reinstall etc. - Providing the control of participant video on/off to meeting host - Not acknowledging the mistakes quickly and fixing them fast. Being defensive and using 'others do it too' excuse. Also, in an internal fight for resources/prioritization and just plain philosophical alignment between security vulnerabilities vs UX funnel optimization (reduce number of clicks), in a company like Zoom, I am not at all surprised that UX side own always and security side lost and it took public pressure the shift the balance. Anyone here who has been in this situation knows what I'm talking about. Unless the cost equation changes, it is hard to get business users to change their priority – from their perspective, they didn't understand what the heck their internal security guy was talking about. It would have been one person/security-team who they normally don't interact with. So why will they listen to that guy over the UX Product guy who they interact with daily, who they see as the one who built the hockey stick growth in their customer NPS scores and that guy wasn't happy about adding the extra click back. So, only workable answer I see is public outrage like this (still not very scalable or consistent) and better yet, legal protections/regulations that make it extremely expensive for companies to ignore this stuff.
- colechristensen 7y ago
  Helper agents are dark patterns. Unless installing an always running service on my device is directly related to the intended functionality of your software, setting one up is unwelcome and deceptive. Especially when it is done to work around existing security controls.
  - larrysalibra 7y ago
    Absolutely. If the user indicates they don't want your software running anymore, it should stop. In Zoom's case, if the user exits the app, the web server keeps running. When the user uninstalled the app, the web server still keeps running. The user twice said "I don't want Zoom's software running on my computer and both times Zoom ignored the user's request. This behavior is both unethical AND malicious. Edit: wrote up more thoughts on this: https://salibra.com/p/viral-growth-doesnt-mean-writing-viruses-ed29689b94d6 https://salibra.com/p/viral-growth-doesnt-mean-writing-virus...
jbverschoor 7y ago
This is why I love the appstore and forced sandboxing. I hope adobe will finally use the appstore for once. Glas that office is using it. No more buggy updater apps
- latexr 7y ago
  Adobe has been using the App Store for years[1], but not for the Creative Suite apps. [1]: https://apps.apple.com/us/developer/adobe-inc/id331646274 https://apps.apple.com/us/developer/adobe-inc/id331646274
  - jbverschoor 7y ago
    For iOS because they have no other choice. I’m talking about macOS and their crapware updater and licensing apps
    - latexr 7y ago
      Scroll down. You’ll see they also have apps on the Mac App Store.
fareesh 7y ago
Is there any scope for legislation mandating that cameras have a hardware button to turn off?
nisten 7y ago
Yawn... Call me when they actually go through their corporate ladder and fire everyone who thought this was a good idea in the first place. If those same managers are in still place, there's no reason for me to ever trust this software again.
code4tee 7y ago
The Zoom security team has a lot to answer for on this one. They subverted built in security to only then fall victim to the very thing that would have been stopped by what they subverted. Good on Zoom to do a rapid course reversal here although naturally trust is now damaged given they only came to their senses under strong public pressure. Also a good case study of how putting “user experience” over security can come back to burn you.
pluc 7y ago
Cheat, repeat until caught, then lie.
hexo 7y ago
They should have kept doing guitar effects and not bug others computers. Or choose not already taken name.
aarbor989 7y ago
I could be wrong, but it looks like they are doing a server-side redirect to their custom zoommtg:// URI protocol now instead of making a call to the localhost server. Couldn't anyone still drop this on their website and force you to join through a redirect just as zoom is? I don't see how that particular concern of the disclosure could be avoided unless browsers force confirmation, as Safari has done.
- AgloeDreams 7y ago
  MacOS as a whole forces confirmation on deeplinks. The old solution skipped the OS confirmation dialog.
  - aarbor989 7y ago
    Hmm..but I'm not getting a confirmation prompt on Firefox or Chrome? Visiting a zoom link in either of those browsers takes me directly into the meeting
    - javagram 7y ago
      Safari 12 forces the confirmation, not all browsers.
tablethnuser 7y ago
I uninstalled this software yesterday and it's not going back on my machine. I have the same criticisms as others do about a company like Zoom that only responds to security issues after they wait-and-see if it will impact the bottom line. And that quick peek behind the curtain where their own employees view this as a "PR crisis" (their exact words in the article) rather than something more tells me everything I need to know about their leadership's DNA. Buyer beware.

326 points by azernik 7y ago

Tech executive changes stance after very public embarrassment that could impact their bottom line. If they didn't get the backlash, they would have kept their course. There's not really much "willing to accept responsibility" here as far as I'm concerned.

PunksATawnyFill 7y ago
Exactly. My company is actively shopping for a conferencing tool, and Zoom just ensured that it's eliminated.
- ajna91 7y ago
  Anger is certainly justified, but it should give way to reconciliation once the offending party truly repents. Do we want a world of people who change their ways, even if for somewhat impure reasons, or a world in which no one ever does because it's pointless?
  - irq 7y ago
    They haven’t repented yet, though. Read their response.
    - o-__-o 7y ago
      No patch? What the actual fuck
    - bscphil 7y ago
      I don't understand, is there something specific you're referring to? From the article it looks like they're even removing the local web server.
      - deleted 7y ago
        [deleted]
  - onion2k 7y ago
    We should definitely treat people as human beings and understand we're all fallible, we should try to forgive mistakes, and we should hope people learn when they get something wrong. That said, if someone does something to make us stop trusting them it's on them to show they've changed; it requires effort from both parties. There is no reason to extend this philosophy to corporations though. We can decide to use a competitor instead. No one needs to show loyalty to a supplier who screwed up.
  - kabwj 7y ago
    > Do we want a world of people who change their ways, even if for somewhat impure reasons, or a world in which no one ever does because it's pointless? You forgot another option: not making the mistake in the first place.
  - chrisbro 7y ago
    The thought process is that if they did this bad thing, only walked back the bad thing when it became public, and are maintaining that they didn't think the bad thing was that bad in the first place...what other nefarious things will that product team do?
  - dclowd9901 7y ago
    I've seen no evidence of true repentance here.
- deleted 7y ago
  [deleted]
dclowd9901 7y ago
Let us be quite clear here: "Farley maintains that the relative security risk of the vulnerabilities that security researcher Jonathan Leitschuh disclosed yesterday were not as severe as Leitschuh made them out to be." That's the CIO still unwilling to accept what a poor decision it was to subversively install a web server on users' computers. They need to shut the fuck up unless the words coming out of their mouth are "we're sorry and we'll do better in the future".

dang 7y ago

The earlier discussion is at https://news.ycombinator.com/item?id=20387298 https://news.ycombinator.com/item?id=20387298.

azernik 7y ago
Specifically - OP is just the news that Zoom agreed to make the changes the security community demanded. Previous discussion is root discussion of the issue itself and of the Zoom response more generally.

dingo_bat 7y ago

There's not a single reason to use zoom over the n other existing meeting software. They just got big because of marketing. My office has recently switched from Skype business to zoom and I find it just as shitty. First of all there's absolutely no use for video, because who the fuck wants to see each other's faces in a work related call? Then there's the whole UI thing to consider. I haven't yet figured out how to initiate a call. I always copy the link and email it to the person I want to talk to. Then they see the email and click it. Compare that to Skype's simple call button. All in all, zoom is hyped up by their marketing and provides less than zero value over existing solutions.

migueltarga 7y ago

RingCentral Meetings still vulnerable: lsof -i :19424 https://www.ringcentral.com/whyringcentral/company/pressreleases/ringcentral-and-zoom-video-communications-announce-multi-yea.html https://www.ringcentral.com/whyringcentral/company/pressrele...

russb 7y ago
For those unaware, RingCentral white-labels the zoom.us product as their meeting solution.
- hnzix 7y ago
  Ironically, RingCentral's convention schwag includes a stick-on laptop lens shutter.

olliej 7y ago

This is why no researcher should sign an NDA after to doing volunteer work for a for-profit Corp. If the reporter had agreed to the NDA required for the bug bounty, Zoom could have - and based on their earlier responses, would have - continued to ship this malware. But now because of the researcher signed an NDA they wouldn’t be able to inform the at risk public.

adtac 7y ago
Will shenanigans like this (declaring a security breach as not a security breach) be caught and fined under GDPR? According to the regulation, companies need to declare breaches in under 72 hours without any unduly delay, but Zoom left this unpatched for months!
- rubbingalcohol 7y ago
  Someone would have to prove that their personal information was stolen or misused for GDPR enforcement to be relevant.
- olliej 7y ago
  As a non-lawyer forum commentator I can say with absolute correctness that it will (or will not) maybe apply. More seriously: I would guess no, as the GDPR is concerned with data collection and compromise, but I can’t imagine they store all the video they forward. Of course I wouldn’t be surprised if someone sues them in the US (but given that the US sees companies as people for rights, but not punishment I imagine that they’ll be fine).
  - irq 7y ago
    “Can say”? Did you mean to write “cannot say”?
    - baq 7y ago
      it doesn't matter, that's the joke

pcx 7y ago

Good to see that they’ve turned around and fixed this issue the right way. I was gonna stop using Zoom otherwise.

aaomidi 7y ago
You should anyway. They had 90 days to do this, they didn't. Incompetent company. Incompetent management.
- deleted 7y ago
  [deleted]
- o-__-o 7y ago
  Dat IPO lyfe. Investors got their money, what’s the problem here?

akersten 7y ago

Stories like this are wonderful evidence of the effectiveness of public disclosure of security vulnerabilities, and are always heartwarming to see. Remember, 90-day disclosure windows are just a courtesy.

Sahhaese 7y ago
This is why I consider bug bounty programs problematic, because they've been co-opted from a system to manage responsible disclosure to a system to contain and manage non-disclosure.
- vorpalhex 7y ago
  Bug bounty programs can be great tools to help reward researchers, secure products and help align new and amateur researchers who may not have ever reported a bug before to standards. But like all things, they can also be used to keep software insecure, hide issues, and instead buy off researchers.
lamby 7y ago
Mmm. This post by Matthew Garrett is good on this: https://mjg59.dreamwidth.org/52432.html https://mjg59.dreamwidth.org/52432.html

notafraudster 7y ago

Of the main facets of the problem, the vulnerability bothered me less than their obviously poor attitude towards fixing it in a responsible timeline, and that bothered me less than the discovery that they were running an always-active webserver to assist call launches and reinstallation. Is that a common thing that programs do? Should I be expected to portscan myself frequently to see if software is unexpectedly running web servers? How much battery am I losing to this stuff?

graeme 7y ago
The verge article mentions it's reasonably common and mentions some programs that do it. From the article, a tweet -------- They are far from alone, a quick `lsof -i | grep LISTEN` shows that I have: Spotify, Keybase, KBFS, iTunes, Numi, https://t.co/MVSAJgN9yY… https://t.co/MVSAJgN9yY… All running locally listening web servers. — Matthew Gregg (@braintube) July 9, 2019
- anaphor 7y ago
  The spotify one is for spotify connect most likely. I'm guessing (although not sure, someone could verify it) that spotify connect requires some sort of authorization to work. Edit: here you go http://cgbystrom.com/articles/deconstructing-spotifys-builtin-http-server/ http://cgbystrom.com/articles/deconstructing-spotifys-builti...
- asveikau 7y ago
  Did they just imply that every listening socket is a web server?
  - svenfaw 7y ago
    They are mixing apples and oranges indeed.
Jonnax 7y ago
I've noticed that the Intel software update scan tool is a web page now, I presume it is a client side application that communicates with a local web server. But I could be wrong.

anaphor 7y ago

This is why full disclosure is so effective. Nothing else works quite like dropping a full PoC and details of an exploit publicly to light a fire under their ass to fix it.

olliej 7y ago
Well it’s an argument for responsible disclosure - you tell them, give them plenty of time to fix it, and publish. But responsible disclosure absolutely does not mean “no disclosure”. It means give them a chance to fix it. If they choose not to you disclose so that people know that they need to take steps to protect themselves. The important thing is that the disclosure must become public. It doesn’t matter that they pushed an update, as none of the victims who had deleted/“uninstalled” zoom will get the update, and without the update they’ll still be running the server. The only way anyone would know about it is with the details being public. I’m waiting for Apple to use xprotect to kill the server on all machines, as that’s the only true solution for the uninstalled victims
- lawnchair_larry 7y ago
  Responsible disclosure doesn’t mean anything. It’s an obsolete term. You’re referring to coordinated disclosure. https://blogs.technet.microsoft.com/ecostrat/2010/07/22/coordinated-vulnerability-disclosure-bringing-balance-to-the-force/ https://blogs.technet.microsoft.com/ecostrat/2010/07/22/coor...
  - gok 7y ago
    This case is actually a really great demonstration of why this often-repeated claim is false. This was responsible, but not coordinated, disclosure.
    - lifthrasiir 7y ago
      Only in the literal sense. A commonly cited issue on the term "responsible disclosure" is that the discoverer is responsible for one's action, even though the action indeed benefits the public. In this viewpoint the vender can argue that it is not responsible to ignore the vendor, even though the vendor itself is being unreasonable. The term "coordinated disclosure" is invented to fix this abuse. You can't literally interpret "responsible" or "coordinated" without this context.

tompic823 7y ago

What about users who had previously uninstalled the Zoom client? Must they now reinstall Zoom in order to be able to fully remove it? Surely there are users that won’t perform the manual update and will remain vulnerable indefinitely.

jdlshore 7y ago
Although I agree having an active webserver with dubious security controls is a problem, the vulnerability as we know it today installs Zoom... and this new version of Zoom uninstalls the webserver. So it is (or at least could be) a self-patching vulnerability.
andrethegiant 7y ago
I believe rm -rf ~/.zoomus should do the trick

eeeeeeeeeeeee 7y ago

Glad to see the company is changing course, but I’m not sure it would have happened without the public shaming. I want companies to fix things because something is insecure and it endangers the public, not because they have their feet to the fire. I know companies don’t always respond right the first time, I know I haven’t, but Zoom had over 90 days to consider their responses and possible options / software changes. Instead, they were dismissive of the entire thing and only changed course after loud public pressure.

irq 7y ago
And this is why anyone who trusts that organization in any way moving forward is a fool.
- o-__-o 7y ago
  Nah leadership can change, see Microsoft and apple
  - blub 7y ago
    The Microsoft telemetry spyware was completely opaque and they kept changing it to work around users blocking it until they were shamed into publishing almost everything they collect. One still can't turn it off. Apple usually needs to be shamed into admitting to and repairing any broken hardware design. They had to be sued in multiple countries to stop misleading customers to buy AppleCare and allow them to use the warranty guaranteed by law.
  - read_if_gay_ 7y ago
    That’s more of a reason not to trust anything ever. If leaders change for the worse, your investment in the company gets screwed no matter how well they’d done previously. And that investment can be stocks or it can be data, to give an example which you can’t just pull.
    - 8ytecoder 7y ago
      Leaders influence company culture but it's also a self-feedback loop where leaders that fit the company culture end up being leaders in the first place. To break that feedback loop and change course is usually a conscious choice for a company. Even then leadership change and direction at the top is only one of the many signals. It's entirely possible for Zoom's CEO to be a security minded person and the PM/Infosec person who reviewed the security report decided it's not a flaw worth patching.

smaili 7y ago

> But we also recognize and respect the view of others that say they don’t want to have an extra process installed on their local machine. So that’s why we made the decision to remove that component — despite the fact that it’s going to require an extra click from Safari. Am I reading this correctly, their CIO believes it's the "extra process" that people are concerned about -- not the webcam vulnerability?

Bluestrike2 7y ago
Amusingly enough, they never actually describe that part as a vulnerability in their blog post. It's a "concern" about a "seamless join process." The word only gets used with regards to the DOS vulnerability, which is only part of the problem. I get the need to at least try and spin things, but it's kind of obvious in this example. And given how people tend to get antsy when they start thinking about possibly being spied on through their webcams, downplaying it is probably counterproductive.

Jedi72 7y ago

The security flaw isnt even the outrageous part. It was secretly installing webservers that dont even remove themselves when you uninstall the app that makes them scum.

pavs 7y ago
Dropbox also does this, so does a lot of other popular programs. do `lsof -i | grep LISTEN` to find out what server is running on your machine.
- Jedi72 7y ago
  In my case there isnt anything I didnt expect. Also closing the apps that were running e.g. RabbitMQ actually stopped the webservers.
oil25 7y ago
> It was secretly installing webservers that dont even remove themselves when you uninstall the app that makes them scum. To be fair, dragging an "app" to Trash does not constitute un-installation. It was a poor design decision to implement features using a local web server, but let's not be so quick to attribute covert, malicious intentions.
- IshKebab 7y ago
  Erm yes it does. That's how it is supposed to work on Mac and that's how it would work if they didn't sneakily install a web server.
- Jedi72 7y ago
  Their latest patch they rushed out is basically just implementing uninstall the way it should be.
- diegoperini 7y ago
  > To be fair, dragging an "app" to Trash does not constitute un-installation. Dragging an app to Trash MUST constitute uninstallation. If it doesn't, it is a bug. Leaving configuration files in home folder for easier on-boarding after a reinstall is not the same thing as leaving a self replicating rootkit running all the time. > It was a poor design decision to implement features using a local web server, but let's not be so quick to attribute covert, malicious intentions. Zoom, with all its advertised features, works like a charm from the user's standpoint. It is not that easy to craft such seamless video conferencing apps which makes me believe the team behind it is formed by really experienced people. If this assumption is true, "the poor decision" is actually the true intention and is probably a feature in case zoom needs to install extra software on my device when their business needs change. It feels more like a back up plan than a dirty hack. In my humble opinion, experts ignoring the ethical consequences of such decision are dangerous to society and their intention can be considered malicious if not criminal. I'm sick of seeing the blame always belonging to the business people. Unless taken hostage and forced to act despite not giving consent, the developer should be equally responsible. We don't treat murderers, burglars and scammers the same when they work under a boss. P.S: I probably strawmanned your answer to express my own opinion. English isn't my native language, sorry if my words sounded offensive.

kerng 7y ago

With their incompetent behavior they put a big target on their back now for security researches. In the end it's good for consumers since more issues will be found and promptly fixed. So kudos to the reporter!

yumraj 7y ago

I wonder if instead of the usual 90-day notice a slightly better approach would be an initial partial public disclosure of the issue, without divulging the actual exploit, and the fact that it had been communicated to the company so that a public countdown of the 90-day window can happen. The exploit can then be divulged to the public, automatically, on the expiration of the 90-day window, regardless of whether it's fixed or not, as that may also be educational. For example, after this Zoom issue other companies will hesitate to use a localhost webserver, but if the issue had quietly been fixed by Zoom other companies may still have been tempted to use similar approach.

enneff 7y ago
More often than not announcing the existence of a vulnerability is enough to motivate people to find it. It’s much easier to find something that you know is there than to just experiment blindly.
- yumraj 7y ago
  Fair enough, but that can be countered by very minimal disclosure in the beginning, just that a vulnerability exists and it has been notified. Even if we don't do that, I think we should at least reveal the issue after it's been fixed in all the cases so that other entities can learn from that.
- o-__-o 7y ago
  Yes. I learned the security release process for a major open source software and it became trivial to determine when vulnerabilities are patched and knowledge of their build process gives you an exact window to exploit said 0-day
pdkl95 7y ago
There isn't a 1-size-fits-all solution to this type of situation. Giving the company a reasonable time[1] to fix it is a good guideline to start with, but determining the best approach to use requires making several judgment calls. Is the exploit already being used in the wild? Should affected users be doing something asap to protect themselves? How quickly could someone transform your disclosure into something malicious? How much risk are we forcing the users to bear while we wait for a self-imposed arbitrary time limit to expire. Is there an actual benefit to be gained by delaying public disclosure? (Is the company using the time responsibly to implement a fix, or are they denying the problem exists? Handling a public disclosure meas adapting to the specific risks of the situation. [1] I would say 30 days is more appropriate, with the option to delay the public announcement if the company has handled the situation well and is working on the fix, but needs more time for a legitimate technical reason.

dangoor 7y ago

Amusingly enough, the standard menu position for Quit on the Mac is at the bottom of the menu… _now_ the Uninstall Zoom option is at the bottom of the menu, making it easy to accidentally invoke if you're used to selecting the last item there to quit. (I happened to have my hand on the mouse rather than keyboard at the time… normally I'd just cmd-Q).

Corrado 7y ago
Wow, I just checked and you are absolutely correct. How is it this hard for companies to check the Apple HIG for this type of thing?

diafygi 7y ago

I'm confused. Does the patch now make it to where if you drag the app to the trash, it actually uninstalls?

auslander 7y ago
First, does the patch actually fixes it? In original report, they "patched" it with the flaw remaining.
oil25 7y ago
A macOS "app" is just a directory with an executable binary and some convenient helper files for Finder. Dragging it to the trash does not remove artifacts, such as logs, supporting binaries, even methods of persistence, which may get placed somewhere else on the filesystem as part of a typical installation. This is not unique to Zoom or even Apple operating systems.
- yoz-y 7y ago
  One thing I'd like to see (and this is definitely doable on macOS side) is that if you trash a .app, the OS would automatically revoke all permissions to it. If this were done then even with the sneaky reinstalling, the user would be alerted by a system dialog requesting access to their webcam.
  - o-__-o 7y ago
    If you have a ktext kernel driver to implement generic access to video input subsystems (think v4l) then why exactly would the user be alerted if the developer didn’t add the feature? Read: anyone can write a kernel driver for macOS, you are too trusting of your software vendors. Get a hardware switch
    - yoz-y 7y ago
      > anyone can write a kernel driver for macOS No they can't. With SIP you won't be able to install it if it is not signed (for kernel extensions only a very few developers have certificates) and in any case you will be alerted about it. Also there are plans to completely disallow making kernel extensions in release after Catalina (since they can now run in userspace, I imagine that userspace will not get access to pre-installed hardware)

gdfiutyer 7y ago

Does anyone know if this issue (and the BlueJeans one) would only affect the current user account? I currently have a separate limited user account just for meetings, and that’s where I install various meeting apps. So in my case is there any way to know if it affected all my accounts or just the one?

tambourine_man 7y ago

The more a think about it, the more a I come to the conclusion that we need a mixed computing paradigm. For many tasks (probably most and certainly for most people) the iOS model is the best. It is, however way too restrictive for a number of use cases. Prohibitively so. Imagine two very different and isolated environments. Terminal, compilers, file managers in one, most other software in the other. With perhaps shared folders between them.

oil25 7y ago
Qubes OS is an operating system which pursues exactly these design goals, and unlike iOS, it is free and open source.
colechristensen 7y ago
I want a web browser with fewer functions and permissions that is aligned with my interests to dominate most of my computer interactions. That would handle most things that most people do on their computers.
ben0x539 7y ago
And then every clown shop would insist that you install their agent program inside the trusted partition.

vinay_ys 7y ago

Let us be clear. Running a local helper agent that accepts properly formatted requests (includes authn/authz) to provide a valid expected functionality is a perfectly valid architectural choice for a full-fledged desktop computer and we shouldn't throw out this capability. The mistakes I see here are: - UX Dark Patterns – making uninstall hard/duplicitous - Helper process having security vulnerability - unauthenticated requests, providing unnecessary privileged operations like update/reinstall etc. - Providing the control of participant video on/off to meeting host - Not acknowledging the mistakes quickly and fixing them fast. Being defensive and using 'others do it too' excuse. Also, in an internal fight for resources/prioritization and just plain philosophical alignment between security vulnerabilities vs UX funnel optimization (reduce number of clicks), in a company like Zoom, I am not at all surprised that UX side own always and security side lost and it took public pressure the shift the balance. Anyone here who has been in this situation knows what I'm talking about. Unless the cost equation changes, it is hard to get business users to change their priority – from their perspective, they didn't understand what the heck their internal security guy was talking about. It would have been one person/security-team who they normally don't interact with. So why will they listen to that guy over the UX Product guy who they interact with daily, who they see as the one who built the hockey stick growth in their customer NPS scores and that guy wasn't happy about adding the extra click back. So, only workable answer I see is public outrage like this (still not very scalable or consistent) and better yet, legal protections/regulations that make it extremely expensive for companies to ignore this stuff.

colechristensen 7y ago
Helper agents are dark patterns. Unless installing an always running service on my device is directly related to the intended functionality of your software, setting one up is unwelcome and deceptive. Especially when it is done to work around existing security controls.
- larrysalibra 7y ago
  Absolutely. If the user indicates they don't want your software running anymore, it should stop. In Zoom's case, if the user exits the app, the web server keeps running. When the user uninstalled the app, the web server still keeps running. The user twice said "I don't want Zoom's software running on my computer and both times Zoom ignored the user's request. This behavior is both unethical AND malicious. Edit: wrote up more thoughts on this: https://salibra.com/p/viral-growth-doesnt-mean-writing-viruses-ed29689b94d6 https://salibra.com/p/viral-growth-doesnt-mean-writing-virus...

jbverschoor 7y ago

This is why I love the appstore and forced sandboxing. I hope adobe will finally use the appstore for once. Glas that office is using it. No more buggy updater apps

latexr 7y ago
Adobe has been using the App Store for years[1], but not for the Creative Suite apps. [1]: https://apps.apple.com/us/developer/adobe-inc/id331646274 https://apps.apple.com/us/developer/adobe-inc/id331646274
- jbverschoor 7y ago
  For iOS because they have no other choice. I’m talking about macOS and their crapware updater and licensing apps
  - latexr 7y ago
    Scroll down. You’ll see they also have apps on the Mac App Store.

fareesh 7y ago

Is there any scope for legislation mandating that cameras have a hardware button to turn off?

nisten 7y ago

Yawn... Call me when they actually go through their corporate ladder and fire everyone who thought this was a good idea in the first place. If those same managers are in still place, there's no reason for me to ever trust this software again.

code4tee 7y ago

The Zoom security team has a lot to answer for on this one. They subverted built in security to only then fall victim to the very thing that would have been stopped by what they subverted. Good on Zoom to do a rapid course reversal here although naturally trust is now damaged given they only came to their senses under strong public pressure. Also a good case study of how putting “user experience” over security can come back to burn you.

pluc 7y ago

Cheat, repeat until caught, then lie.

hexo 7y ago

They should have kept doing guitar effects and not bug others computers. Or choose not already taken name.

aarbor989 7y ago

I could be wrong, but it looks like they are doing a server-side redirect to their custom zoommtg:// URI protocol now instead of making a call to the localhost server. Couldn't anyone still drop this on their website and force you to join through a redirect just as zoom is? I don't see how that particular concern of the disclosure could be avoided unless browsers force confirmation, as Safari has done.

AgloeDreams 7y ago
MacOS as a whole forces confirmation on deeplinks. The old solution skipped the OS confirmation dialog.
- aarbor989 7y ago
  Hmm..but I'm not getting a confirmation prompt on Firefox or Chrome? Visiting a zoom link in either of those browsers takes me directly into the meeting
  - javagram 7y ago
    Safari 12 forces the confirmation, not all browsers.

tablethnuser 7y ago

I uninstalled this software yesterday and it's not going back on my machine. I have the same criticisms as others do about a company like Zoom that only responds to security issues after they wait-and-see if it will impact the bottom line. And that quick peek behind the curtain where their own employees view this as a "PR crisis" (their exact words in the article) rather than something more tells me everything I need to know about their leadership's DNA. Buyer beware.