17 ms·

Zoom Endpoint-Security Considerations

112 points by Semaphor 7y ago

fock 7y ago
did see the same things with the Linux binary. Especially funny to see these old (and unsupported) OpenSSL-libraries. Isn't nearly every valley-company today built around the assumption of having a development model which makes things as this highly unlikely?
- civ0 7y ago
  Do you have a writeup of your findings? Not that the issues with the Windows version aren't enough, but as a user of the Linux version I would like to know what is wrong with it.
  - fock 7y ago
    It was basically the same things as with the Windows version. I just did some very basic skimming through the binary with 'strings' and basically found the old OpenSSL statically linked (because you can't really expect a distro to have it there...) and some suspicious SQL-statements. Additionally someone decidedly non-native wrote a lot of the debug-messages/even the startup-script. And yes, the latter is interesting if the response to "you are an extended arm of the PLA!?!" is: "we are fully based in SV and employ american talent"...
- mschuster91 7y ago
  > Especially funny to see these old (and unsupported) OpenSSL-libraries. "Never upgrade a running system" is what I guess what was driving this... probably driven by "we don't have budget for maintenance/regression testing, only for new features".
- mgbmtl 7y ago
  Zoom also does weird OS-detection which seems to fail with Debian-testing, so I can't use screensharing on Wayland. Works fine with Jitsi Meet. They also don't support dual-screen mixed-scaling (4k laptop with 1080p external screen). Feels like using Skype: worked for a while under Linux, then never got updated and became very unpredictable/clunky.
  - fock 7y ago
    and the very funny thing is that they apparently don't do any compression at all on screens, so in one meeting I got a 2560x1440-feed (with 4 fps...). Was horribly slow on the VM I used (because the web-interface was not working at that time). Also I wonder what's stopping them (except for them wanting to get their APT on every machine) from giving you more than one stream in the browser...
  - wryun 7y ago
    One way to work around this, stolen from somewhere on the internet: bwrap --dev-bind / / --ro-bind /opt/zoom/os-release /etc/os-release /usr/bin/zoom %U Where you set /opt/zoom/os-release to something appropriate. Should be enough to copy your current one and set VERSION_ID to 10. (it's pretty simplistic)
godzillabrennus 7y ago
And yet the adoption rate is through the roof. Seems that to succeed you don’t focus on security till you get caught. None of this will change unless there is a shift of liability back onto companies for securing data.
- m11a 7y ago
  I think it's becoming a pattern that people (users) don't care about what they can't see. And furthermore, people (users) overall don't seem to care about security until something goes wrong. Besides, a layman doesn't understand even the simplest terms in that article, so naturally how are they supposed to care? Many traditional organisations (schools, enterprise, etc) that care for security, in my experience, did so for GDPR compliance and to the extent that they were compliant. A lot of businesses weren't even being malicious, just negligent. So, on the whole, regular users don't seem to care, and since users don't hold businesses accountable for it, businesses don't really care. NB: Users refers to any random person who isn't in the tech industry. Like, probably, your neighbour or the random person walking their dog.
  - fock 7y ago
    user's didn't care in the past. The yahoo toolbar lived merrily for years. Then came the hot business of "computer security tools". Nowadays with everything (except Zoom) working in a browser people apparently forgot that their computer still contains relevant data and they still have to think about it (not only about the "hot" cloud). I think in the late PC era, Zoom would have been surely classified as malware by some of the more zealous programs out there and whooops, there goes APT-like userfriendlyness...
- poisonborz 7y ago
  For the average user, a privacy/security concern is a possible/theoretical issue, missing features a very real, instantenous issue. Slack, Teams & co flat-out ignored calls and screen sharing until now. They were sidelined so-so features. Hell, on Slack you couldn't even see screen sharing from mobile, and you did not even got a notification that another person is sharing. Never mind missing even the most basic annotation features. No wonder Zoom eats all the pies now. Sure, they made a lot of mistakes, but it was a huge landfall on a small(ish) company. That said, if the others top up their game, I'm happy to get rid of an additional app - but that's how market works.
mappu 7y ago
On Linux, you can get Zoom as a Snap or Flatpak, that provides a useful layer of sandboxing.
- ryukafalz 7y ago
  Some, I guess, but not enough to make much difference. The Flatpak for it mounts the user's home directory: https://github.com/flathub/us.zoom.Zoom/blob/master/us.zoom.Zoom.json#L14 https://github.com/flathub/us.zoom.Zoom/blob/master/us.zoom.... ...and the Snap seems to as well, though I'm less familiar with Snaps and it seems like this may not provide access to hidden files: https://github.com/ogra1/zoom-snap/blob/master/snap/snapcraft.yaml#L32 https://github.com/ogra1/zoom-snap/blob/master/snap/snapcraf... So your SSH keys may be safe there, your photos and documents probably aren't.
  - ZeroCool2u 7y ago
    I think you can forcibly revoke that permission from the snap store interface.
mhils 7y ago
Zoom is the Windows of conferencing apps: It is the most popular one, so researchers actually look at it and say it's shit, but the alternatives aren't much better [1]. [1] Just one example: https://github.com/jitsi/docker-jitsi-meet/blob/master/CHANGELOG.md#stable-4384-1 https://github.com/jitsi/docker-jitsi-meet/blob/master/CHANG...
- Dunedan 7y ago
  Here is another example: Tracking in the mobile apps for Jitsi Meet without the ability to opt-out (which the Jitsi developers apparently consider to be fine): https://github.com/jitsi/jitsi-meet/issues/5799 https://github.com/jitsi/jitsi-meet/issues/5799
  - jimbob45 7y ago
    Looks legitimate - real shame. This prevents me from being able to recommend this to my friends. I hope it was worth it for 8x8.
    - number6 7y ago
      The bin from fdroid comes without tracking
      - jimbob45 7y ago
        I’m on iOS though. I read through the Q&A and it kind like the tracking is done because Crashlytics, something they integrate with, got bought out by Google. I don’t know how much solace that brings me, though.
        joking 7y ago
        use the webapp then, or use the jitsi sdk for ios or android and build your own app. They even don't enable some tracking when you are not using their servers and use your own. Anyone who has published an app to any of the app stores, recognizes the valuable information than services like crashlytics provide and the hundreds of ways an app can crash on the user devices. You may be don't like how it is, but as the parent said, that's not an app issue neither github issues is the place to discuss it.
rshnotsecure 7y ago
We have been measuring and tracing Zoom traffic from the various client apps for the last couple of weeks. One weird thing. It appears Zoom uses SCO Cloud [1] and HunTel Engineering Nebraska [2] to form sort of their own IPX? I have been a cloud architect for the last decade and haven't seen anything like this. The costs must be enormous if we are measuring correctly (no guarantee). SCO Cloud though is quite the character. Apparently they are part of some group that has been trying to sue the Linux kernel for the last 20 years, until the case was put to rest in 2017 I think [3]. [1] - https://scocloud.com https://scocloud.com [2] - https://htleng.com https://htleng.com [3] - https://arstechnica.com/tech-policy/2017/10/appeals-court-keeps-alive-the-never-ending-linux-case-sco-v-ibm/ https://arstechnica.com/tech-policy/2017/10/appeals-court-ke...
- mshade 7y ago
  The SCO that birthed all the lawsuits is pretty long defunct. I doubt SCOcloud is at all related. Their site doesn't seem to match the MO of the old SCO.
Pxtl 7y ago
I feel like this article is conflating things... it is absolutely possible to do SQL string concatenation safely. I've done it many times to work around aggressively-bad SQL APIs. Assuming SQL concatenation is automatically bad is the kind of thinking that makes me roll my eyes at security researchers.
- bitexploder 7y ago
  For every person that gets SQL strong concatenation right 20 get it wrong. And there are simple and safe ways to write arbitrary SQL queries without using concatenation. Parmeterized queries are available everywhere. There is a reason we tell everyone not to do it and that reason is that it’s dangerous and almost everyone screws it up. I have found your case to be the exception in 13 years as an infosec researcher and consultant.
- shakna 7y ago
  Building SQL queries from strings is possible safely, in the same way that C's memory model is safe. It can be done... But not by most people. Are history proves it, time [0] after time [1] and time [2] after time [3]. It is simply not worth it, if you can make use of parameterized queries. [0] https://web.archive.org/web/20161024090111/https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2016/10/talktalk-gets-record-400-000-fine-for-failing-to-prevent-october-2015-attack/ https://web.archive.org/web/20161024090111/https://ico.org.u... [1] https://www.nytimes.com/2014/08/06/technology/russian-gang-said-to-amass-more-than-a-billion-stolen-internet-credentials.html?_r=0 https://www.nytimes.com/2014/08/06/technology/russian-gang-s... [2] https://www.baltimoresun.com/education/bs-xpm-2014-03-07-bs-md-hopkins-servers-hacked-20140306-story.html https://www.baltimoresun.com/education/bs-xpm-2014-03-07-bs-... [3] https://web.archive.org/web/20150219165019/http://www.batblue.com/united-nations-internet-governance-forum-breached/ https://web.archive.org/web/20150219165019/http://www.batblu...
  - jackewiehose 7y ago
    > Building SQL queries from strings is possible safely, in the same way that C's memory model is safe. But still you wouldn't say that every software written in C is automatically insecure. You have to look into the actual case. Just grepping for SQL-string-concatination or uses of sprintf doesn't say much.
wardnath 7y ago
As a quick note, no affiliation whatsoever on my part - I've had great success running online meetups on the LGPL project bigbluebutton. Hope it helps some members here with their pain point. https://bigbluebutton.org https://bigbluebutton.org
foolinaround 7y ago
Can someone comment on this angle, where zoom traffic was routed through China, not exactly a paragon of openness?
- fsflover 7y ago
  Discussion: https://news.ycombinator.com/item?id=22768494 https://news.ycombinator.com/item?id=22768494
user5994461 7y ago
What about the last one? Code execution through turbojpeg.dll Might be possible to share a picture through zoom and when zoom will attempt to render the picture it's gonna execute it? Edit: nevermind looks like this CVE vulnerability only exists on ARM64 CPU, in optimized codepaths using neon instructions. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2201 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2201 https://www.openwall.com/lists/oss-security/2019/11/11/1 https://www.openwall.com/lists/oss-security/2019/11/11/1
Mave83 7y ago
quite unfortunate that there is no alternative with the same great user experience like zoom. Linux, Windows, Mac, every device all just working without a problem. Delay free screen sharing (Not like MS Teams/webex), even remote support is possible. Fantastic product from a user perspective. I hope they will fix the issues or some other currently crappy solution will take over the user experience centric thinking.

112 points by Semaphor 7y ago

fock 7y ago

did see the same things with the Linux binary. Especially funny to see these old (and unsupported) OpenSSL-libraries. Isn't nearly every valley-company today built around the assumption of having a development model which makes things as this highly unlikely?

civ0 7y ago
Do you have a writeup of your findings? Not that the issues with the Windows version aren't enough, but as a user of the Linux version I would like to know what is wrong with it.
- fock 7y ago
  It was basically the same things as with the Windows version. I just did some very basic skimming through the binary with 'strings' and basically found the old OpenSSL statically linked (because you can't really expect a distro to have it there...) and some suspicious SQL-statements. Additionally someone decidedly non-native wrote a lot of the debug-messages/even the startup-script. And yes, the latter is interesting if the response to "you are an extended arm of the PLA!?!" is: "we are fully based in SV and employ american talent"...
mschuster91 7y ago
> Especially funny to see these old (and unsupported) OpenSSL-libraries. "Never upgrade a running system" is what I guess what was driving this... probably driven by "we don't have budget for maintenance/regression testing, only for new features".
mgbmtl 7y ago
Zoom also does weird OS-detection which seems to fail with Debian-testing, so I can't use screensharing on Wayland. Works fine with Jitsi Meet. They also don't support dual-screen mixed-scaling (4k laptop with 1080p external screen). Feels like using Skype: worked for a while under Linux, then never got updated and became very unpredictable/clunky.
- fock 7y ago
  and the very funny thing is that they apparently don't do any compression at all on screens, so in one meeting I got a 2560x1440-feed (with 4 fps...). Was horribly slow on the VM I used (because the web-interface was not working at that time). Also I wonder what's stopping them (except for them wanting to get their APT on every machine) from giving you more than one stream in the browser...
- wryun 7y ago
  One way to work around this, stolen from somewhere on the internet: bwrap --dev-bind / / --ro-bind /opt/zoom/os-release /etc/os-release /usr/bin/zoom %U Where you set /opt/zoom/os-release to something appropriate. Should be enough to copy your current one and set VERSION_ID to 10. (it's pretty simplistic)

godzillabrennus 7y ago

And yet the adoption rate is through the roof. Seems that to succeed you don’t focus on security till you get caught. None of this will change unless there is a shift of liability back onto companies for securing data.

m11a 7y ago
I think it's becoming a pattern that people (users) don't care about what they can't see. And furthermore, people (users) overall don't seem to care about security until something goes wrong. Besides, a layman doesn't understand even the simplest terms in that article, so naturally how are they supposed to care? Many traditional organisations (schools, enterprise, etc) that care for security, in my experience, did so for GDPR compliance and to the extent that they were compliant. A lot of businesses weren't even being malicious, just negligent. So, on the whole, regular users don't seem to care, and since users don't hold businesses accountable for it, businesses don't really care. NB: Users refers to any random person who isn't in the tech industry. Like, probably, your neighbour or the random person walking their dog.
- fock 7y ago
  user's didn't care in the past. The yahoo toolbar lived merrily for years. Then came the hot business of "computer security tools". Nowadays with everything (except Zoom) working in a browser people apparently forgot that their computer still contains relevant data and they still have to think about it (not only about the "hot" cloud). I think in the late PC era, Zoom would have been surely classified as malware by some of the more zealous programs out there and whooops, there goes APT-like userfriendlyness...
poisonborz 7y ago
For the average user, a privacy/security concern is a possible/theoretical issue, missing features a very real, instantenous issue. Slack, Teams & co flat-out ignored calls and screen sharing until now. They were sidelined so-so features. Hell, on Slack you couldn't even see screen sharing from mobile, and you did not even got a notification that another person is sharing. Never mind missing even the most basic annotation features. No wonder Zoom eats all the pies now. Sure, they made a lot of mistakes, but it was a huge landfall on a small(ish) company. That said, if the others top up their game, I'm happy to get rid of an additional app - but that's how market works.

mappu 7y ago

On Linux, you can get Zoom as a Snap or Flatpak, that provides a useful layer of sandboxing.

ryukafalz 7y ago
Some, I guess, but not enough to make much difference. The Flatpak for it mounts the user's home directory: https://github.com/flathub/us.zoom.Zoom/blob/master/us.zoom.Zoom.json#L14 https://github.com/flathub/us.zoom.Zoom/blob/master/us.zoom.... ...and the Snap seems to as well, though I'm less familiar with Snaps and it seems like this may not provide access to hidden files: https://github.com/ogra1/zoom-snap/blob/master/snap/snapcraft.yaml#L32 https://github.com/ogra1/zoom-snap/blob/master/snap/snapcraf... So your SSH keys may be safe there, your photos and documents probably aren't.
- ZeroCool2u 7y ago
  I think you can forcibly revoke that permission from the snap store interface.

mhils 7y ago

Zoom is the Windows of conferencing apps: It is the most popular one, so researchers actually look at it and say it's shit, but the alternatives aren't much better [1]. [1] Just one example: https://github.com/jitsi/docker-jitsi-meet/blob/master/CHANGELOG.md#stable-4384-1 https://github.com/jitsi/docker-jitsi-meet/blob/master/CHANG...

Dunedan 7y ago
Here is another example: Tracking in the mobile apps for Jitsi Meet without the ability to opt-out (which the Jitsi developers apparently consider to be fine): https://github.com/jitsi/jitsi-meet/issues/5799 https://github.com/jitsi/jitsi-meet/issues/5799
- jimbob45 7y ago
  Looks legitimate - real shame. This prevents me from being able to recommend this to my friends. I hope it was worth it for 8x8.
  - number6 7y ago
    The bin from fdroid comes without tracking
    - jimbob45 7y ago
      I’m on iOS though. I read through the Q&A and it kind like the tracking is done because Crashlytics, something they integrate with, got bought out by Google. I don’t know how much solace that brings me, though.
      - joking 7y ago
        use the webapp then, or use the jitsi sdk for ios or android and build your own app. They even don't enable some tracking when you are not using their servers and use your own. Anyone who has published an app to any of the app stores, recognizes the valuable information than services like crashlytics provide and the hundreds of ways an app can crash on the user devices. You may be don't like how it is, but as the parent said, that's not an app issue neither github issues is the place to discuss it.

rshnotsecure 7y ago

We have been measuring and tracing Zoom traffic from the various client apps for the last couple of weeks. One weird thing. It appears Zoom uses SCO Cloud [1] and HunTel Engineering Nebraska [2] to form sort of their own IPX? I have been a cloud architect for the last decade and haven't seen anything like this. The costs must be enormous if we are measuring correctly (no guarantee). SCO Cloud though is quite the character. Apparently they are part of some group that has been trying to sue the Linux kernel for the last 20 years, until the case was put to rest in 2017 I think [3]. [1] - https://scocloud.com https://scocloud.com [2] - https://htleng.com https://htleng.com [3] - https://arstechnica.com/tech-policy/2017/10/appeals-court-keeps-alive-the-never-ending-linux-case-sco-v-ibm/ https://arstechnica.com/tech-policy/2017/10/appeals-court-ke...

mshade 7y ago
The SCO that birthed all the lawsuits is pretty long defunct. I doubt SCOcloud is at all related. Their site doesn't seem to match the MO of the old SCO.

Pxtl 7y ago

I feel like this article is conflating things... it is absolutely possible to do SQL string concatenation safely. I've done it many times to work around aggressively-bad SQL APIs. Assuming SQL concatenation is automatically bad is the kind of thinking that makes me roll my eyes at security researchers.

bitexploder 7y ago
For every person that gets SQL strong concatenation right 20 get it wrong. And there are simple and safe ways to write arbitrary SQL queries without using concatenation. Parmeterized queries are available everywhere. There is a reason we tell everyone not to do it and that reason is that it’s dangerous and almost everyone screws it up. I have found your case to be the exception in 13 years as an infosec researcher and consultant.
shakna 7y ago
Building SQL queries from strings is possible safely, in the same way that C's memory model is safe. It can be done... But not by most people. Are history proves it, time [0] after time [1] and time [2] after time [3]. It is simply not worth it, if you can make use of parameterized queries. [0] https://web.archive.org/web/20161024090111/https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2016/10/talktalk-gets-record-400-000-fine-for-failing-to-prevent-october-2015-attack/ https://web.archive.org/web/20161024090111/https://ico.org.u... [1] https://www.nytimes.com/2014/08/06/technology/russian-gang-said-to-amass-more-than-a-billion-stolen-internet-credentials.html?_r=0 https://www.nytimes.com/2014/08/06/technology/russian-gang-s... [2] https://www.baltimoresun.com/education/bs-xpm-2014-03-07-bs-md-hopkins-servers-hacked-20140306-story.html https://www.baltimoresun.com/education/bs-xpm-2014-03-07-bs-... [3] https://web.archive.org/web/20150219165019/http://www.batblue.com/united-nations-internet-governance-forum-breached/ https://web.archive.org/web/20150219165019/http://www.batblu...
- jackewiehose 7y ago
  > Building SQL queries from strings is possible safely, in the same way that C's memory model is safe. But still you wouldn't say that every software written in C is automatically insecure. You have to look into the actual case. Just grepping for SQL-string-concatination or uses of sprintf doesn't say much.

wardnath 7y ago

As a quick note, no affiliation whatsoever on my part - I've had great success running online meetups on the LGPL project bigbluebutton. Hope it helps some members here with their pain point. https://bigbluebutton.org https://bigbluebutton.org

foolinaround 7y ago

Can someone comment on this angle, where zoom traffic was routed through China, not exactly a paragon of openness?

fsflover 7y ago
Discussion: https://news.ycombinator.com/item?id=22768494 https://news.ycombinator.com/item?id=22768494

user5994461 7y ago

What about the last one? Code execution through turbojpeg.dll Might be possible to share a picture through zoom and when zoom will attempt to render the picture it's gonna execute it? Edit: nevermind looks like this CVE vulnerability only exists on ARM64 CPU, in optimized codepaths using neon instructions. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2201 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2201 https://www.openwall.com/lists/oss-security/2019/11/11/1 https://www.openwall.com/lists/oss-security/2019/11/11/1

Mave83 7y ago

quite unfortunate that there is no alternative with the same great user experience like zoom. Linux, Windows, Mac, every device all just working without a problem. Delay free screen sharing (Not like MS Teams/webex), even remote support is possible. Fantastic product from a user perspective. I hope they will fix the issues or some other currently crappy solution will take over the user experience centric thinking.