3 ms·
> unauthenticated web server bound to localhost so that any website could make requests to it and get the video stream I read the linked article. At no point
by jscholes 7y ago
> unauthenticated web server bound to localhost so that any website could make requests to it and get the video stream
I read the linked article. At no point did it (or as far as I can recall any of the coverage at the time) say that the video stream data could be accessed via the local web server. The problem was already bad; no need to make spurious claims to make it worse.
- asveikau 7y agoOk, maybe that was my slight misreading of the situation. It definitely involved use of the webcam without user consent, however. And an attacker could make you join a meeting that they control, effectively being able to watch and hear you.
- jscholes 7y agoOh absolutely. I'm not trying to downplay the serious nature of the vulnerability, particularly because it also lead to the possibility of remote code execution. Just want to keep the record straight that at no point did this vulnerability allow people to actively spy on your legitimate meetings.