13 ms·
Ex-NSA hacker drops zero-day for Zoom
- dewey 7y ago> The two bugs, Wardle said, can be launched by a local attacker — that’s where someone has physical control of a vulnerable computer.
- monocasa 7y agoIt's still a root privilege escalation.
- sc3n3ry 7y agoLPE has always been trivial on OS X... for the longest time, the passwordless-sudo timeout was not specific to the tty. So all you had to do was wait for someone to use sudo, and you would be able to get root.
- monocasa 7y agoCool. Companies that go "I should use a LPE as part of my product" should still be chastised.
- oefrha 7y agoUnless I misunderstood, the escalation prompt only appears if you’re a non-admin user performing the install, and you still need to possess and enter admin credentials in the prompt to do anything at all. Outside of paranoid nerds who refuse to use an admin account day-to-day (I’ve only heard about this kind of people online, yet to meet one in meat space), who uses their Mac like that? (Genuine question.)
- kart23 7y agoI've seen schools do this. My old high school had macbook airs available for checkout at the library, as well as the desktops used for printing. Obviously the student user did not have admin access, and a student could trivially gain it using this method, opening up the systems to all sorts of nasty stuff.
- oefrha 7y agoThe key here is the user needs to possess admin credentials; the prompt itself is just a prompt, think sudo/su. I fail to see why random students would have admin credentials.
- kart23 7y agoOh, ok I didn't read the original article thoroughly. The user still needs to give it the admin password, but the installer can be modified to also execute arbitrary code as the root user.
- valuearb 7y agoTechcrunch disables the back button.
- dvfjsdhgfv 7y agoNot if you disable JS.
- sharken 7y agoI fail to see how that is relevant, also the back button works for me (Firefox on Windows).
- luma 7y agoShitting on zoom in your headline appears to be this week's low latency path to more clicks, no matter how contrived the claim is.
- deleted 7y ago[deleted]
- ghostpepper 7y agoCriticize him for irresponsible disclosure maybe, but is it wrong to say that an unpatched local privilege escalation is a zero day?
- DyslexicAtheist 7y agojudging from their past behavior towards security researchers they have done nothing that deserves responsible disclosure. responsible disclosure starts with responsible QA by the vendor.
- BoysenberryPi 7y agoI'm typically very out of the loop on things but is there any particular reason HN seems to be hell bent on shitting on Zoom this week. Don't recall seeing this much vitriol for a particular product in a while.
- TallGuyShort 7y agoWith more and more of the world, and especially Silicon Valley, being locked-down and quarantined, video conferencing is obviously going through the roof and Zoom seems to be winning. It's just getting a lot of attention, and any flaws are suddenly more impactful.
- neltnerb 7y agoOn the one hand, all the attention (if pride is removed from the equation) should be win-win since remote workers might end up less spied on or hacked and zoom still makes a huge profit.
- duxup 7y agoThis seems like a security bug, but not exactly a high risk one considering it requires you to actually have possession of the computer. Presumably if you have possession of the computer and are able to exploit this bug, you could do any number of other things anyway... Zoom might have issues but if I were to list them, this wouldn't be high on / make the list. Obviously they should fix it, but of all the things, not sure this one is front page worthy.
- saagarjha 7y agoThis is exploitable if you have code running as an unprivileged user and would like to obtain root privileges or access the camera surreptitiously.
- user5994461 7y agoThis should be exploitable on the local network. This is a network share vulnerability. I suspect there was a nasty mis-translation. The article should have said "local network", but it was strip down to "local" and gets mis-interpreted as "local computer".
- saagarjha 7y agoI don't see anything to do with network shares?
- user5994461 7y agoFirst paragraph: two security researchers finding a Zoom bug that can be abused to steal Windows passwords... https://twitter.com/hackerfantastic/status/1245133371262619654 https://twitter.com/hackerfantastic/status/12451333712626196...
- Spooky23 7y agoFOR IMMEDIATE RELEASE Zoom Zero Day Spooky23, a former guest of a Holiday Inn also used by elite NSA Hackers, discovered that if you walk into a remote worker's home while they are engaged and distracted by a Zoom meeting, you can physically pick up the laptop and throw it out the window. In most cases, this will result in a denial of service. Zoom has not made a fix available at this time. Users can work around this threat by securing any nearby windows.
- vnchr 7y agoWhat version of windows provides adequate security? Double-pane or XP?
- reaperducer 7y agoIf your computer is compatible, you'll get a pop-up advertisement during your next PowerPoint presentation to buy a Fenestration Penetration add-on pack that helpfully comes with a free un-installable copy of Bejeweled. But before you install, you have to give Microsoft a copy of your DNA that it can sell on to marketing companies. Microsoft needs this "telemetry" to improve its software, otherwise everything will break.
- dotancohen 7y ago> But before you install, you have to give Microsoft a copy of > your DNA To be fair, Mircosoft has been bending its customers over and leaving DNA samples in dark places since at least the mid nineties.
- RickS 7y agoAny version, so long as it's been screened for security.
- lainga 7y agoI've had good results with the IBM mainframe-targeting z/OS, mainly due to hardware synergies
- 7y ago
- saagarjha 7y agoSlightly better link: https://objective-see.com/blog/blog_0x56.html https://objective-see.com/blog/blog_0x56.html
- pastry90 7y agoThere has to be some headline law where whenever someone claims to be an EX-{3 Letter Agency} hacker, their findings are inevitably mostly trash. Wardle has done more to damage the reputation of the NSA than anyone else I'm aware of.
- deleted 7y ago[deleted]
- corndoge 7y agoWow, I can't believe an NSA employee doesn't care about responsible disclosure /s
- saagarjha 7y agoHe’s a bit sensationalist, to be sure, but the bugs mentioned are ones that should be fixed. (If rather trivial to find…)
- ilikehurdles 7y agoResponsible disclosure means giving the developers a chance to fix the bugs before blasting the methods all over techcrunch.
- saagarjha 7y agoI am aware of what responsible disclosure is; Patrick Wardle doesn't really care for it because he prefers writing up his blog posts as it gives him a chance to speak. But even putting aside his personal flaws, Zoom should fix these issues.
- DyslexicAtheist 7y agowhy would he or anyone else. they haven't exactly got a history of being open to researchers. the only way to deal with them is by either dropping 0days or selling vulns to whoever pays for them. that's totally justified given how ignorant and apologetic people are about this tire fire of a company
- angry_octet 7y agoAt this point, many people prefer to remain ignorant of the risk, so they can continue their lives without change. Just like the CV response. Basically people don't like thinking even one step ahead. What's the consequence of millions of people exposing their private information (PDF bank statements, DOB, scans of their ID docs, etc) via something like Zoom? Massive identity theft and scamming. E.g. people are going to be asked to send money to relatives, and they'll do it. Loans will be taken out using your PII. If you think identity theft is bad now, consider the problem when you can't go to the DMV, your bank, etc. Countries with good digital ID programs (like Germany) and vastly more prepared for this problem.
- jeroenhd 7y agoThese are valid attacks for bypassing Gatekeeper on macOS, but they're not root-level privilege escalations attacks (the user still needs to enter a password) and they don't provide remote code execution. It does show that whoever manages security at Zoom should go back to school though. Operating system security features are not an obstacle but a tool. Trying to work around them reminds me of the age of IE6 toolbars and "system optimisers" who won't let you uninstall them.
- user5994461 7y agoThis is linking to a source on twitter https://twitter.com/hackerfantastic/status/1245133371262619654 https://twitter.com/hackerfantastic/status/12451333712626196... with a short demo on youtube https://www.youtube.com/watch?v=Om1w4DVkkEU https://www.youtube.com/watch?v=Om1w4DVkkEU From what I can gather. You can send a message in zoom with a link like "\\host.example.com\calc.exe". Zoom will highlight it as a clickable link. Assuming you can get the user to click it: 1) It will fetch the remote executable and run. 2) It transparently transmits windows authentication of the user to the remote server, expecting a network share that may require authentication.
- luma 7y agoYou can also do the exact same thing in any messaging app.
- user5994461 7y agoI don't think so. Other messaging apps don't parse strings starting with \\ as links and if they do, they hopefully undo it for the .exe extension.
- kevingadd 7y agoNo hyperlink in any reasonably-authored messaging app is both going to download+run an .exe file without confirmation AND send your credentials to the remote server without prompting. It's absurd behavior
- luma 7y agoHave you tried that? Hangouts: \\servername.tld\share doesn't parse as a UNC, instead becomes clickable and brings up a browser to "servername.tld" Skype for business: Does exactly what Zoom does, turns the entire thing into a clickable link MS Teams: Doesn't parse as clickable at all That's all I have in front of me at the moment...
- Dylan16807 7y ago
- cojoke 7y ago> In the meanwhile, Wardle said, “if you care about your security and privacy, perhaps stop using Zoom. I feel like that's really easy to say if you're not an enterprise/big tech employee who has to use the product to maintain their employment during the quarantine. Are there any privacy solutions out there for those of us who are required to use Zoom anyway?
- munchbunny 7y agoI'm not sure if a VM is an option given the need for a camera. If it is, I think that's a pretty good option. By default I would recommend a dedicated laptop for Zoom. Don't use it for anything else. Also shut the laptop down completely when it's not in use. This means there won't be anything to snoop on, and the hardware will be turned off when you aren't using it.
- snazz 7y agoYou can pass a USB device (including a camera) to a VM. Then you can make sure that Zoom always has focus within the VM to protect yourself from the attention tracking functionality.
- vernie 7y agoZoom seems to be enjoying a good, old-fashioned dogpile
- peterwwillis 7y agoWe're in a pandemic. Telecommunications are of paramount importance to people working in emergency and others services throughout the world. So of course, security and privacy are more paramount than ever. But by releasing more and more "problems" with Zoom, it slowly forces organizations to abandon Zoom as a telecommunications option. Eventually people will not be allowed to use Zoom to do their jobs, which will make those jobs even more difficult than they already are. Social distancing by itself saves lives by keeping infection (and thus death) rates down, and this software is a critical part of making that work. > Because Wardle dropped detail of the vulnerabilities on his blog, Zoom > has not yet provided a fix. In the meanwhile, Wardle said, > “if you care about your security and privacy, perhaps stop using Zoom.” This is not the time to release 0-days in telecommunications software, people need this software to save lives. If you work in InfoSec, or just idle in random hacker channels, please push back on this kind of behavior. It would be "irresponsible" at any other time, but in this era, it's literally life-threatening.
- saagarjha 7y agoIf I was a hacker, I would be looking real closely at Zoom since everyone is using it right now.
- LockAndLol 7y agoI guess it's time to respond to every thread shitting on zoom with: Just use Jitsi Meet. https://jitsi.org/jitsi-meet/ https://jitsi.org/jitsi-meet/ It's free, it's open-source, and can be self-hosted.
- deleted 7y ago[deleted]
- mindfulplay 7y agoWhy are startups born this way? Why optimize for growth and CTR etc. Is there a world in which security and privacy focus (maybe sprinkle in, dare I say, social good) could be funded from the start? These companies presumably all pivot on going public and making a crapton of money: couldn't they anticipate the need to respect the users longer term as opposed to selling them like commodity to investors and advertisers? The worst types are the ones that advertise how good and amazing they are, and when the "tide goes out they are found swimming naked" as Buffett might say.
- reaperducer 7y agoWhy are startups born this way? When I was in the Seattle startup scene, I came to the conclusion that the Silicon Valley bubble had become overrun with charlatans, grifters, and amoral people only interested in making a quick buck. Pretty much any rando who grew tired of being a used car salesman could max his Visa card putting together a flashy office and a piece of craptastic demoware as a lure to hook investor money. I think it's just a natural progression. Sleaseballs follow the money. When flipping houses became popular, the worst kind of people starting flipping houses to make a quick buck. When day trading became popular, the worst kind of people starting day trading to make a quick buck. When software started becoming big business, the worst kind of people started pretending to be "startups" to make a quick buck. For a more historical perspective, see also: Railroads, mining, logging, banking, shipping, etc...
- __s 7y agoFor an essay of this idea, see https://meaningness.com/geeks-mops-sociopaths https://meaningness.com/geeks-mops-sociopaths
- lotsofpulp 7y agoThe users themselves choose to patronize the businesses that optimize for growth. People don’t value security, and don’t know how to evaluate it. They do know how to evaluate the least number of clicks to get the other person’s video stream on their screen with the least number of errors.
- 7y ago
- user_50123890 7y agoIf an attacker has physical access to a device, it should already be considered compromised...
- mrpippy 7y agoThe answer is to use the web client. Either put the ID into https://zoom.us/join https://zoom.us/join, or someone else on HN said that replacing '/j' with '/wc/join' in a URL will use the web client.
- antoncohen 7y ago> The two bugs, Wardle said, can be launched by a local attacker — that’s where someone has physical control of a vulnerable computer. TechCrunch got this wrong. "Local" means local privilege escalation, as opposed to "remote" code execution. They do not require physical access. That being said, local privilege escalation on a single user computer where that user is an admin (most Macs), isn't a massive problem in my mind. It would allow malware, once run by the user, to bypass security prompts usually required to elevate access.
- angry_octet 7y agoIf Zoom was done well it would be a confined app, and controlling the Zoom process wouldn't give you access to everything the user has access too, let alone allow easy root privesc. It's just rubbish software. (WebEx is as bad if not worse.)
- djsumdog 7y ago> Zoom uses a "shady" technique — one that’s also used by Mac malware — to install the Mac app without user interaction It reminds me of the Dropbox trick they used to get past the accessibility restrictions. The implementation is different, but it's essentially to get around all the limitations that Apple has been building into macos. I feel like developers shouldn't have to fight the operating system.
- logicallee 7y agomy comment on an earlier story: https://news.ycombinator.com/item?id=22748204 https://news.ycombinator.com/item?id=22748204
- mcintyre1994 7y agoHeh, have Techcrunch hired a Register headline writer? :)
- aequitas 7y agoCan we stop using and finding bugs in the close-source Zoom and direct that effort to finding bugs in the open source Jitsi (or any other open source solution) instead? Even though it's free and open source there will be bugs and usability issues that need to be solved. If we pool our effort right we can make open source solution into "just works" solutions, reducing the need for companies like Zoom.
- starpilot 7y agozoom zoom zoom
- chews 7y agoIf this is NSA hacking... We've got some patriotic script kids.
- saadalem 7y agoWhen I see much hate on a company, I know it's getting successful
- huslage 7y agoIt’s totally fine to go find bugs, but we have CVEs and responsible disclosure for a reason. This is irresponsible.
- deleted 7y ago[deleted]
- DangerousPie 7y agoI think zero days are irresponsible in the best of times but releasing something like this when their devs are probably all busy just keeping their much-needed service running in times of a global crisis just seems insane.
- annoyingnoob 7y agoAnd Zoom proponents at my office still don't care - its all about convenience for most folks.
- kristianc 7y agoFor most folks, it really is about convenience. If you propose a new videoconf solution, and the first time a C-suite or major prospect joins the call the call buffers, or someone doesn't have the right drivers installed, or someone doesn't know how to click the link - you are absolutely getting hauled over the coals afterwards. No one, at any company wants to get the "We're a technology company - why can't we organize a video call?" line. Convenience is often neglected by people proposing a privacy-conscious, self-hosted FOSS alternative that merely requires you to install it from binary and configure your own Digital Ocean droplet, but it really does matter.
- thinkharderdev 7y agoThis is absolutely true in practice, but there are degrees. Approximately 0 people are going to go full tinfoil hat and setup their own self-hosted FOSS solution, but we absolutely should care if a product like Zoom does something like, say, installs a local web server to bypass security controls on a user's browser which can potentially open up any number of devastating remote exploits that would be easy to exploit by any script-kiddy. The fact that most users don't care is more reason why product developers HAVE to care. I could just as easily say "only paranoid security people care if we hash their passwords in our database so why waste the CPU cycles?" And I would be right, the vast majority of users don't know anything about storing passwords securely but they absolutely care whether their passwords get pilfered by an attacker and used to compromise their account.
- TechBro8615 7y ago> Zoom’s troubled year just got worse. This is an odd way of describing a year in which Zoom's stock has doubled in price.
- burgerzzz 7y agoCan someone explain why I keep seeing Zoom on the frontpage? What sets it apart from the rest that it gets discussed on HN so often recently? Is it a YC company?
- ilikehurdles 7y agoIt's a small company with huge industry competitors, and it's winning.
- dang 7y agoIt's a spinoff of the covid crisis. The rush to remote work has made Zoom much more prominent than it was a few weeks ago. This has attracted a flood of attention, so a lot of spotlights are trained on it right now. For the same reason, we've been hearing all about ventilators lately [1]. That's not a ventilator plot, it's article moths flocking to the spotlights. With Zoom there are compounding factors. Software, video conferencing, video conferencing software, and software businesses are all topics in HN's wheelhouse—as is anything security or privacy related. There have been security and privacy surprises (shall we say) with Zoom in the past, so people are naturally hunting for more. Also, readers are primed to pattern-match any new findings as part of the ongoing sequence. That's a strong multiplier. Familiarity reactions—cache effects, if you like—magnify how much attention a story attracts. There was a similar, though slower-motion, sequence of stories about Facebook last year. It's not a YC company. When there's a major ongoing story, such as the current crisis, floods of follow-up and copycat posts appear, since every website and media outlet wants in on the action. After the Snowden deluge of 2013, we learned to moderate these counter-cyclically, so that HN can surf the big waves without getting totally sogged with repetition. The test for a new submission on a MOT (Massive Ongoing Topic) is: does it contain SNI (Significant New Information) [2]? If no, we downweight the MOT. If yes, we try to have one thread about each SNI. I just made up those TLAs. Zoom has become a MOT in its own right. You can tell that when objections like [3..9] start cropping up. The question is: is the OP a SNI? [1] https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=ventilat&sort=byDate&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... [2] https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20%22significant%20new%20information%22&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu... [3] https://news.ycombinator.com/item?id=22749596 https://news.ycombinator.com/item?id=22749596 [4] https://news.ycombinator.com/item?id=22743303 https://news.ycombinator.com/item?id=22743303 [5] https://news.ycombinator.com/item?id=22748549 https://news.ycombinator.com/item?id=22748549 [6] https://news.ycombinator.com/item?id=22750059 https://news.ycombinator.com/item?id=22750059 [7] https://news.ycombinator.com/item?id=22750251 https://news.ycombinator.com/item?id=22750251 [8] https://news.ycombinator.com/item?id=22753810 https://news.ycombinator.com/item?id=22753810 [9] https://news.ycombinator.com/item?id=22754138 https://news.ycombinator.com/item?id=22754138
- dawnerd 7y agoWhy do sites like Techcrunch think I'll stick around longer if they block the back button?
- jedieaston 7y agoSomething that wasn't clear ("non-privileged attacker") is whether or not running the Zoom installer as a non-admin user would be sufficient for it to use its elevation mischief somehow. From what I see, it can't, because AuthorizationExecuteWithPrivileges requires an admin's credentials to do anything. But if that were the case, can you use the mac Zoom client without an admin's permission, or not? If you don't need to give it admin credentials (and can just give it anyone's non-special password instead) and it installs to /Applications without an admin's permission, then there's a huge problem. If you do need to give it admin credentials, this still needs to be fixed (urgently, as I'm sure there's tons of one-off developer/designer macs that aren't monitored by IT and have the Zoom client on them), but that would mean the security model on OS X wasn't entirely broken by a badly written video conferencing installer.