3 ms·
This is funny, but I don't think the issue should be so quickly dismissed. The machine must already be compromised for this vulnerability to be useful, but doe
by CivBase 7y ago
This is funny, but I don't think the issue should be so quickly dismissed.
The machine must already be compromised for this vulnerability to be useful, but doesn't necessarily mean it isn't a problem. A good security model uses layers to reduce the impact of successful attacks. This vulnerability potentially enables an attacker to escalate their privileges, bypassing some of those layers and compromising the machine further.
This article probably overstates the problem (maybe don't use "doom" in the headline next time, even though it rhymes) and there are plenty of examples of worse vulnerabilities, but that doesn't excuse this one.
- wbl 7y agoMulti user security model is real!
- deleted 7y ago[deleted]
- richardwhiuk 7y agoThe vulnerability here is surely in Mac OS X though?
- saagarjha 7y agoNo, it’s Zoom.
- Wowfunhappy 7y agoNo it's not. Mac OS X is allowing a program that was given root permissions to execute code with root permissions.
- __s 7y agoFor another case like this, look up "steam privilege escalation" https://amonitoring.ru/article/steamclient-0day https://amonitoring.ru/article/steamclient-0day Valve tried to downplay this too. Privilege escalation is an attack vector that's easy to downplay
- Spooky23 7y agoI agree. My cynicism is directed more on the confluence of Apple security issues + Zoom + NSA reference attention grabbing. :)