18 ms·

Two vulnerabilities in Zoom could lead to code execution

259 points by joering2 6y ago

olliej 6y ago
At least they're into regular bad code bugs, rather than intentionally created security holes, including deliberately circumventing browser security restrictions. So progress?
- scarface74 6y ago
  You mean like secretly installing a web server on Macs so that if you uninstall Zoom it reinstalls itself? https://www.zdnet.com/article/zoom-defends-use-of-local-web-server-on-macs-after-security-report/ https://www.zdnet.com/article/zoom-defends-use-of-local-web-...
  - crazygringo 6y ago
    No. Your link is from 2019. GP is referring to how Zoom has (so far) moved on from those kinds of egregious behaviors, so now in June 2020 we're looking at just regular (non-malicious) code vulnerabilities.
    - scarface74 6y ago
      How can you trust a company with that type of culture? An accidental vulnerability is excusable. They intentionally wrote malware.
      - crazygringo 6y ago
        Why do you think that has anything to do with culture? They made business decisions that seemed rational at the time, to grow fast at the expense of good security. Now they're making business decisions that are rational for the current situation -- they've grown hugely, and now have been fixing their reputation for privacy and security. Culture has nothing to do with it. It's pure business. I trust their profit motive far more than any "culture". And their profit motive now is: do everything to be a trustworthy product. And their actions over the past couple of months have been demonstrating that. Do you think it's impossible for companies to change? Because a company makes mistakes, they can't ever be trusted again? That doesn't seem very realistic.
        scarface74 6y ago
        They made business decisions that seemed rational at the time, to grow fast at the expense of good security. It seems rational to create malware?
  - olliej 6y ago
    That’s what they’ve moved on from - intentionally malicious code to just bad code. Such progress! Much wow!
    - snvzz 6y ago
      They've learned about plausible deniability. At least, if it looks like a vulnerability, they can probably get away with it.
- donarb 6y ago
  Not much progress at all. They just announced the end-to-end encryption will be a paid for feature. Free users won't get this feature because as CEO Eric Yuan says "Free users for sure we don't want to give that because we also want to work with the FBI, with local law enforcement in case some people use Zoom for a bad purpose". https://news.ycombinator.com/item?id=23437573 https://news.ycombinator.com/item?id=23437573
Jonnax 6y ago
I wonder. Are all the vulnerabilities and issues with Zoom because of its popularity? Everybody is using zoom these days and in my opinion it's because it has an excellent user experience. I'm wondering if something like Cisco WebEx is just as "broken" but everyone doesn't have their eyes on it. One thing for sure. We need a way to run desktop applications in isolated containers in the same way mobile apps are run. I joined a WebEx meeting the other day, downloading it's client. And after the meeting a little window popped up with my next meetings. Without permission it'd hooked into my outlook calendar. At the the very least, we could have some sort of virtual file system that by default applications only see. I'm sure the capability exists in windows, because there's a mod management tool for Skyrim I've used where it creates a virtual folder for all your activated mods and the game itself sees that virtual folder when running. As an aside, remember when Skype was the most popular audio/video chat app in the world? Or even MSN messenger? I also remember Hangouts getting popular but then stagnating in using 100% CPU and setting fire to your laps.
- aetherspawn 6y ago
  I hate that nearly all conferencing apps (except Skype/Teams) feel like malware. And I hate that Covid means that I am pretty much forced to use have half a dozen each day.
  - m0xte 6y ago
    Slack is definitely malware feeling territory. The amount of juice it requires feels like it’s running a crypto mining operation in the background.
    - boudin 6y ago
      The funny thing is that if you disable all the gif and animated gif features it behaves much better. I also disabled spelling checks, automatic replacement of emojis and this kind of not really useful things. On my work computer it went from using kind 60% of a core to almost nothing.
      - 6y ago
CSDude 6y ago
Because of these possibilities, I prefer using my iPad Mini for meetings, and If I have to share a screen I just join from Chrome, its screen share works well enough and is more restricted than Zoom client. I highly recommend it if you dont feel comfortable.
- Fizzadar 6y ago
  I am going to move to the web client from desktop in the wake of this and previous exploits, wasn't aware it could replace the desktop client!
- m3kw9 6y ago
  Maybe you shouldn’t use iOS or any OS as they all have zero day vulnerabilities.
  - CSDude 6y ago
    Okay I will use a unikernel to dialup to the landline number from an partly airgapped raspberry pi. iOS sandbox is much more powerful thn macOS and the risk is significantly reduced
__m 6y ago
I don’t get why people didn’t drop it after that major vulnerability last year
- throw554323 6y ago
  Same reason people didn’t drop Windows, Mac OS, Intel, and other companies that had vulnerabilities.
  - noobermin 6y ago
    The vulnerabilities here are comparable to those reported on the OS vendors and Intel but installing spyware is another level.
- enriquto 6y ago
  A major vulnerability with a sincere response is not that bad. Software is very difficult. What killed my respect for the zoom team was the PR bullshit that they engaged in after it was discovered. Major companies have been known to fuck up and recall their faulty products or offer reasonable solutions (e.g. exploding batteries on the note 7, the intel chip bugs). The reaction shown by zoom was that of a whiny child caught in the act of stealing cookies and denying it all ---"Those are not really cookies you see!" It was so ridiculous it was not even offensive.
- petargyurov 6y ago
  Because 99% of people that use it are non-technical and don't care or don't think they're at risk. The news of such vulnerabilities probably doesn't even reach them.
- epanchin 6y ago
  Why do you lock your front door with a Yale key when you know it can be picked?
- m3kw9 6y ago
  Same reason why people don’t drop windows or any OS for the last couple decades.
philh 6y ago
Not a comment on the article, but the CAPTCHA before it seems weird and kind of sketchy. > Why do I have to complete a CAPTCHA? > Completing the CAPTCHA proves you are a human and gives you temporary access to the web property. Okay, but... why do I have to complete a CAPTCHA? > What can I do to prevent this in the future? > If you are on a personal connection, like at home, you can run an anti-virus scan on your device to make sure it is not infected with malware. > If you are at an office or shared network, you can ask the network administrator to run a scan across the network looking for misconfigured or infected devices. > Another way to prevent getting this page in the future is to use Privacy Pass. You may need to download version 2.0 now from the Firefox Add-ons Store. How would a virus scan help here? I certainly hope my browser doesn't go around advertising when I last did one of them. And how does Privacy Pass prove I'm human, are robots unable to pretend to be Firefox plus Privacy Pass?
- dewey 6y ago
  > How would a virus scan help here? Usually that means that the IP you are connecting from got somehow flagged as an originator of malicious attacks. Like if the virus on your computer does automated requests (click fraud, scraping, DoS,...) to other IPs that are monitored by them. Of course this is probably mostly useless especially if you are on a dynamic IP but that's where it's coming from.
  - judge2020 6y ago
    this line of text was more appropriate when this text only showed up when CF had a low "trust score" for you; now website owners have much more control and can trigger a captcha for almost any reason that doesn't necessarily mean your network is infected (eg. A website owner triggering captchas on a page of their website once they have a heavy increase of traffic)
    - dewey 6y ago
      I was only answering to the part about why they suggest virus scan, not the usage of captchas in general. Of course you are right in regards to captchas in general.
gravitas 6y ago
The Linux client jumped from 3.5.392530.0421 to 5.0.418682.0603 at the end of April 2020, the version outlined in this article appears to have never existed on the Linux platform.
zemnmez 6y ago
another day, another set of misrepresented vulnerabilities from the security consultancy vuln mill: 1) Zoom client application chat Giphy arbitrary file write This is not an 'arbitrary file write'. There is virtually no 'arbitrary file write' that doesn't lead to code execution on Windows. The reason is detailed in the report itself: > The severity of this vulnerability is partially mitigated by the fact that Zoom client will append a string _BigPic.gif to the specified filename. This prevents the attacker from creating a fully controlled file with arbitrary extension. Nobody is getting hacked by downloading a corrupt .gif file. 2) Zoom Client Application Chat Code Snippet Remote Code Execution Vulnerability This is not an 'arbitrary file write', as even in the most user input intensive scenario it is restricted. It's not a 'remote code execution', either as they clearly detail in the last paragraph: > In summary, this vulnerability can be abused in two above outlined scenarios. First, without user interaction, it can be abused to plant arbitrary binaries on target system albeit at a constrained path potentially used in exploiting another vulnerability. Secondly with user interaction, plant binaries at almost arbitrary paths and can potentially overwrite important files and lead to arbitrary code execution. The report itself does not detail the actual way this reaches remote code execution, saying only: > This in itself could potentially be abused in leveraging another vulnerability. However, they could presumably extract the exe to %APPDATA%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, which would cause remote code execution when the user logs in again. I would be surprised if the reality isn't they tried this and they couldn't do it. I don't understand why they cut this so short. It's pretty normal for me to be able to drop an .exe in various places. That's what happens when a website triggers a download. The important thing here is the 'execution' of remote code execution, which they have failed to demonstrate. This is an endless frustration as a vulnerability researcher. Security consultancies, trying to fish for contracts are endlessly willing to misrepresent bugs and security issues they find as much as possible, and there's very little accountability for this.
dreamcompiler 6y ago
I always use Zoom in a browser to avoid stuff like this. Zoom has repeatedly shown itself to be an untrustworthy app by an untrustworthy vendor.
- prophesi 6y ago
  I was able to use Zoom in the browser with my first meeting, but now it no longer shows that option when I access a Zoom meeting URL. What do you do to force it to let you use it in the browser?
  - rlpb 6y ago
    The last time I looked, you have to be logged in, and then after requesting to join you have to wait on the page that tells you to install the app to join for a few seconds before the web joining link appears.
  - danans 6y ago
    AFAICT, you need to first click on the link to install the app, taking the first step in that direction. But then close whatever app install window that opens, return to the invitation page, and the Join From Browser link should have appeared. Basically, the option to join from a browser is only shown once you first signal intent to install the app. This procedure is described in the Zoom docs: https://support.zoom.us/hc/en-us/articles/214629443-Zoom-web-client?mobile_site=true#h_d058aa08-10b5-4c9f-b029-4ce9603bb2d1 https://support.zoom.us/hc/en-us/articles/214629443-Zoom-web... The meeting host can also change a setting that allows the Join From Browser link to be displayed without having to go through the procedure above: https://support.zoom.us/hc/en-us/articles/115005666383-Show-a-Join-from-your-browser-Link?mobile_site=true https://support.zoom.us/hc/en-us/articles/115005666383-Show-...
- mmwelt 6y ago
  Yes, this is a good option for some. However, the ZOOM web client lacks quite a few features, including viewing the video of more than one participant at a time. I believe it's also not possible to share audio. So if you need to do any of these things, you really still have to install the ZOOM client on your computer!
devit 6y ago
The title is misleading: the vulnerabilities are already fixed in the most recent version according to the article.
danans 6y ago
PSA: Zoom has a pretty decent web only experience you can access using a roundabout procedure: https://support.zoom.us/hc/en-us/articles/214629443-Zoom-web-client?mobile_site=true#h_d058aa08-10b5-4c9f-b029-4ce9603bb2d1 https://support.zoom.us/hc/en-us/articles/214629443-Zoom-web... If the Zoom native app's security is a concern for you, the arguably increased security of your browser's environment should help. If you are a Zoom meeting host, you can save your participants the trouble of the procedure described above by always showing the Join From Browser link: https://support.zoom.us/hc/en-us/articles/115005666383-Show-a-Join-from-your-browser-Link?mobile_site=true https://support.zoom.us/hc/en-us/articles/115005666383-Show-...
- bzb4 6y ago
  I recommend doing the same thing with other Electron apps if possible. For example, Discord.
  - Osiris 6y ago
    Except that some features are only available in the desktop app like screen sharing. Another advantage is being able to switch directly to an app instead of remembering which browser instance has which tab. With Discord specifically I have a weird issue on Linux where my mic works fine in the browser but doesn't work at all in the desktop version.
    - bzb4 6y ago
      First, yeah, that’s why I said “if possible”. Most people use Discord just for text and voice and that works okay inside the browser. Second, some browsers allow you to create a window for a website that acts as an app on its own. I don’t remember which ones, I think Chrome was one.
    - scrollaway 6y ago
      Screen sharing is available on discord web. I believe the only major feature that is unavailable on the web is push to talk.
- 6y ago
monadic2 6y ago
I’ve had great experience with running it in a vm at the cost of screen sharing.
akulbe 6y ago
Correct me if I'm wrong… but didn't this get resolved in 5.x, and this is referring to an old version? I was forced to update to 5.x at one point, so it seems like this is old news.

259 points by joering2 6y ago

At least they're into regular bad code bugs, rather than intentionally created security holes, including deliberately circumventing browser security restrictions. So progress?

scarface74 6y ago
You mean like secretly installing a web server on Macs so that if you uninstall Zoom it reinstalls itself? https://www.zdnet.com/article/zoom-defends-use-of-local-web-server-on-macs-after-security-report/ https://www.zdnet.com/article/zoom-defends-use-of-local-web-...
- crazygringo 6y ago
  No. Your link is from 2019. GP is referring to how Zoom has (so far) moved on from those kinds of egregious behaviors, so now in June 2020 we're looking at just regular (non-malicious) code vulnerabilities.
  - scarface74 6y ago
    How can you trust a company with that type of culture? An accidental vulnerability is excusable. They intentionally wrote malware.
    - crazygringo 6y ago
      Why do you think that has anything to do with culture? They made business decisions that seemed rational at the time, to grow fast at the expense of good security. Now they're making business decisions that are rational for the current situation -- they've grown hugely, and now have been fixing their reputation for privacy and security. Culture has nothing to do with it. It's pure business. I trust their profit motive far more than any "culture". And their profit motive now is: do everything to be a trustworthy product. And their actions over the past couple of months have been demonstrating that. Do you think it's impossible for companies to change? Because a company makes mistakes, they can't ever be trusted again? That doesn't seem very realistic.
      - scarface74 6y ago
        They made business decisions that seemed rational at the time, to grow fast at the expense of good security. It seems rational to create malware?
- olliej 6y ago
  That’s what they’ve moved on from - intentionally malicious code to just bad code. Such progress! Much wow!
  - snvzz 6y ago
    They've learned about plausible deniability. At least, if it looks like a vulnerability, they can probably get away with it.
donarb 6y ago
Not much progress at all. They just announced the end-to-end encryption will be a paid for feature. Free users won't get this feature because as CEO Eric Yuan says "Free users for sure we don't want to give that because we also want to work with the FBI, with local law enforcement in case some people use Zoom for a bad purpose". https://news.ycombinator.com/item?id=23437573 https://news.ycombinator.com/item?id=23437573

Jonnax 6y ago

I wonder. Are all the vulnerabilities and issues with Zoom because of its popularity? Everybody is using zoom these days and in my opinion it's because it has an excellent user experience. I'm wondering if something like Cisco WebEx is just as "broken" but everyone doesn't have their eyes on it. One thing for sure. We need a way to run desktop applications in isolated containers in the same way mobile apps are run. I joined a WebEx meeting the other day, downloading it's client. And after the meeting a little window popped up with my next meetings. Without permission it'd hooked into my outlook calendar. At the the very least, we could have some sort of virtual file system that by default applications only see. I'm sure the capability exists in windows, because there's a mod management tool for Skyrim I've used where it creates a virtual folder for all your activated mods and the game itself sees that virtual folder when running. As an aside, remember when Skype was the most popular audio/video chat app in the world? Or even MSN messenger? I also remember Hangouts getting popular but then stagnating in using 100% CPU and setting fire to your laps.

aetherspawn 6y ago
I hate that nearly all conferencing apps (except Skype/Teams) feel like malware. And I hate that Covid means that I am pretty much forced to use have half a dozen each day.
- m0xte 6y ago
  Slack is definitely malware feeling territory. The amount of juice it requires feels like it’s running a crypto mining operation in the background.
  - boudin 6y ago
    The funny thing is that if you disable all the gif and animated gif features it behaves much better. I also disabled spelling checks, automatic replacement of emojis and this kind of not really useful things. On my work computer it went from using kind 60% of a core to almost nothing.
    - 6y ago

CSDude 6y ago

Because of these possibilities, I prefer using my iPad Mini for meetings, and If I have to share a screen I just join from Chrome, its screen share works well enough and is more restricted than Zoom client. I highly recommend it if you dont feel comfortable.

Fizzadar 6y ago
I am going to move to the web client from desktop in the wake of this and previous exploits, wasn't aware it could replace the desktop client!
m3kw9 6y ago
Maybe you shouldn’t use iOS or any OS as they all have zero day vulnerabilities.
- CSDude 6y ago
  Okay I will use a unikernel to dialup to the landline number from an partly airgapped raspberry pi. iOS sandbox is much more powerful thn macOS and the risk is significantly reduced

__m 6y ago

I don’t get why people didn’t drop it after that major vulnerability last year

throw554323 6y ago
Same reason people didn’t drop Windows, Mac OS, Intel, and other companies that had vulnerabilities.
- noobermin 6y ago
  The vulnerabilities here are comparable to those reported on the OS vendors and Intel but installing spyware is another level.
enriquto 6y ago
A major vulnerability with a sincere response is not that bad. Software is very difficult. What killed my respect for the zoom team was the PR bullshit that they engaged in after it was discovered. Major companies have been known to fuck up and recall their faulty products or offer reasonable solutions (e.g. exploding batteries on the note 7, the intel chip bugs). The reaction shown by zoom was that of a whiny child caught in the act of stealing cookies and denying it all ---"Those are not really cookies you see!" It was so ridiculous it was not even offensive.
petargyurov 6y ago
Because 99% of people that use it are non-technical and don't care or don't think they're at risk. The news of such vulnerabilities probably doesn't even reach them.
epanchin 6y ago
Why do you lock your front door with a Yale key when you know it can be picked?
m3kw9 6y ago
Same reason why people don’t drop windows or any OS for the last couple decades.

philh 6y ago

Not a comment on the article, but the CAPTCHA before it seems weird and kind of sketchy. > Why do I have to complete a CAPTCHA? > Completing the CAPTCHA proves you are a human and gives you temporary access to the web property. Okay, but... why do I have to complete a CAPTCHA? > What can I do to prevent this in the future? > If you are on a personal connection, like at home, you can run an anti-virus scan on your device to make sure it is not infected with malware. > If you are at an office or shared network, you can ask the network administrator to run a scan across the network looking for misconfigured or infected devices. > Another way to prevent getting this page in the future is to use Privacy Pass. You may need to download version 2.0 now from the Firefox Add-ons Store. How would a virus scan help here? I certainly hope my browser doesn't go around advertising when I last did one of them. And how does Privacy Pass prove I'm human, are robots unable to pretend to be Firefox plus Privacy Pass?

dewey 6y ago
> How would a virus scan help here? Usually that means that the IP you are connecting from got somehow flagged as an originator of malicious attacks. Like if the virus on your computer does automated requests (click fraud, scraping, DoS,...) to other IPs that are monitored by them. Of course this is probably mostly useless especially if you are on a dynamic IP but that's where it's coming from.
- judge2020 6y ago
  this line of text was more appropriate when this text only showed up when CF had a low "trust score" for you; now website owners have much more control and can trigger a captcha for almost any reason that doesn't necessarily mean your network is infected (eg. A website owner triggering captchas on a page of their website once they have a heavy increase of traffic)
  - dewey 6y ago
    I was only answering to the part about why they suggest virus scan, not the usage of captchas in general. Of course you are right in regards to captchas in general.

gravitas 6y ago

The Linux client jumped from 3.5.392530.0421 to 5.0.418682.0603 at the end of April 2020, the version outlined in this article appears to have never existed on the Linux platform.

zemnmez 6y ago

another day, another set of misrepresented vulnerabilities from the security consultancy vuln mill: 1) Zoom client application chat Giphy arbitrary file write This is not an 'arbitrary file write'. There is virtually no 'arbitrary file write' that doesn't lead to code execution on Windows. The reason is detailed in the report itself: > The severity of this vulnerability is partially mitigated by the fact that Zoom client will append a string _BigPic.gif to the specified filename. This prevents the attacker from creating a fully controlled file with arbitrary extension. Nobody is getting hacked by downloading a corrupt .gif file. 2) Zoom Client Application Chat Code Snippet Remote Code Execution Vulnerability This is not an 'arbitrary file write', as even in the most user input intensive scenario it is restricted. It's not a 'remote code execution', either as they clearly detail in the last paragraph: > In summary, this vulnerability can be abused in two above outlined scenarios. First, without user interaction, it can be abused to plant arbitrary binaries on target system albeit at a constrained path potentially used in exploiting another vulnerability. Secondly with user interaction, plant binaries at almost arbitrary paths and can potentially overwrite important files and lead to arbitrary code execution. The report itself does not detail the actual way this reaches remote code execution, saying only: > This in itself could potentially be abused in leveraging another vulnerability. However, they could presumably extract the exe to %APPDATA%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, which would cause remote code execution when the user logs in again. I would be surprised if the reality isn't they tried this and they couldn't do it. I don't understand why they cut this so short. It's pretty normal for me to be able to drop an .exe in various places. That's what happens when a website triggers a download. The important thing here is the 'execution' of remote code execution, which they have failed to demonstrate. This is an endless frustration as a vulnerability researcher. Security consultancies, trying to fish for contracts are endlessly willing to misrepresent bugs and security issues they find as much as possible, and there's very little accountability for this.

dreamcompiler 6y ago

I always use Zoom in a browser to avoid stuff like this. Zoom has repeatedly shown itself to be an untrustworthy app by an untrustworthy vendor.

prophesi 6y ago
I was able to use Zoom in the browser with my first meeting, but now it no longer shows that option when I access a Zoom meeting URL. What do you do to force it to let you use it in the browser?
- rlpb 6y ago
  The last time I looked, you have to be logged in, and then after requesting to join you have to wait on the page that tells you to install the app to join for a few seconds before the web joining link appears.
- danans 6y ago
  AFAICT, you need to first click on the link to install the app, taking the first step in that direction. But then close whatever app install window that opens, return to the invitation page, and the Join From Browser link should have appeared. Basically, the option to join from a browser is only shown once you first signal intent to install the app. This procedure is described in the Zoom docs: https://support.zoom.us/hc/en-us/articles/214629443-Zoom-web-client?mobile_site=true#h_d058aa08-10b5-4c9f-b029-4ce9603bb2d1 https://support.zoom.us/hc/en-us/articles/214629443-Zoom-web... The meeting host can also change a setting that allows the Join From Browser link to be displayed without having to go through the procedure above: https://support.zoom.us/hc/en-us/articles/115005666383-Show-a-Join-from-your-browser-Link?mobile_site=true https://support.zoom.us/hc/en-us/articles/115005666383-Show-...
mmwelt 6y ago
Yes, this is a good option for some. However, the ZOOM web client lacks quite a few features, including viewing the video of more than one participant at a time. I believe it's also not possible to share audio. So if you need to do any of these things, you really still have to install the ZOOM client on your computer!

devit 6y ago

The title is misleading: the vulnerabilities are already fixed in the most recent version according to the article.

danans 6y ago

PSA: Zoom has a pretty decent web only experience you can access using a roundabout procedure: https://support.zoom.us/hc/en-us/articles/214629443-Zoom-web-client?mobile_site=true#h_d058aa08-10b5-4c9f-b029-4ce9603bb2d1 https://support.zoom.us/hc/en-us/articles/214629443-Zoom-web... If the Zoom native app's security is a concern for you, the arguably increased security of your browser's environment should help. If you are a Zoom meeting host, you can save your participants the trouble of the procedure described above by always showing the Join From Browser link: https://support.zoom.us/hc/en-us/articles/115005666383-Show-a-Join-from-your-browser-Link?mobile_site=true https://support.zoom.us/hc/en-us/articles/115005666383-Show-...

bzb4 6y ago
I recommend doing the same thing with other Electron apps if possible. For example, Discord.
- Osiris 6y ago
  Except that some features are only available in the desktop app like screen sharing. Another advantage is being able to switch directly to an app instead of remembering which browser instance has which tab. With Discord specifically I have a weird issue on Linux where my mic works fine in the browser but doesn't work at all in the desktop version.
  - bzb4 6y ago
    First, yeah, that’s why I said “if possible”. Most people use Discord just for text and voice and that works okay inside the browser. Second, some browsers allow you to create a window for a website that acts as an app on its own. I don’t remember which ones, I think Chrome was one.
  - scrollaway 6y ago
    Screen sharing is available on discord web. I believe the only major feature that is unavailable on the web is push to talk.
6y ago

monadic2 6y ago

I’ve had great experience with running it in a vm at the cost of screen sharing.

akulbe 6y ago

Correct me if I'm wrong… but didn't this get resolved in 5.x, and this is referring to an old version? I was forced to update to 5.x at one point, so it seems like this is old news.