5 ms·

> 0patch became aware of the flaw thanks to a “private researcher” who wants to remain anonymous—that person said no disclosure was made to Zoom No disclosure

by ebg13 6y ago

> 0patch became aware of the flaw thanks to a “private researcher” who wants to remain anonymous—that person said no disclosure was made to Zoom No disclosure was made to Zoom. Why? What's the point of doing that?

ziddoap 6y ago
Just spitballing here, but it could be due to previous bad encounters with Zoom, previous cases where Zoom has dismissed or downplayed an exploit, etc. Is Zoom one of those companies that requires excessive NDA's for exploits? That could be a factor. I can think of a few other reasons, although it probably would have been better to disclose to Zoom /alongside/ whoever else they thought should get it.
- mr_mitm 6y ago
  > bad encounters with Zoom, previous cases where Zoom has dismissed or downplayed an exploit, etc. Have they? Their disclosure policy [1] sounds reasonable and their public response [2] to the recent accusations has been text book, if you ask me. They even hired top industry experts (Alex Stamos, Matthew Green, etc.) and acquired keybase to strengthen their security. To me it looks like Zoom got lots of attention at once, and thus had lots of security issues at once, that would not be out of the ordinary if they had been more spread out. However, them lying to their customers about E2EE is hard to forgive. [1] https://hackerone.com/zoom https://hackerone.com/zoom [2] https://blog.zoom.us/a-message-to-our-users/ https://blog.zoom.us/a-message-to-our-users/
  - ziddoap 6y ago
    As I mentioned, I was just stating some generic reasons why a researcher may choose not to disclose specifically (and only) to the company in question.
  - Freeboots 6y ago
    They do seem to be taking it seriously, but their history of poor security well predates the recent influx of users. Before covid, all i knew about Zoom was "That video chat with all the exploits"
deleted 6y ago
[deleted]
Nullabillity 6y ago
They have shown repeatedly that they don't give a shit, so the best thing you can do for their users is to demonstrate for them why they should uninstall it yesterday.
- deleted 6y ago
  [deleted]
anon102010 6y ago
Live in a country that criminally prosecutes security researches? Jails them?
akersten 6y ago
Maybe Zoom wasn't willing to pay the sticker price: > Vice has reported that someone is claiming to have a zero-day exploit affecting the Zoom app for Windows, and they’re asking $500,000 for it. The remote code execution exploit allegedly requires the hacker to be in a call with the targeted user. Zoom says it has launched an investigation, but so far it has “not found any evidence substantiating these claims.”[1] [1]: https://www.securityweek.com/zoom-teams-katie-moussouris-revamp-bug-bounty-program https://www.securityweek.com/zoom-teams-katie-moussouris-rev... I couldn't find their current bug bounty payout schedule anywhere online, so I can only assume it's unimpressive.

by ebg13 6y ago

ziddoap 6y ago

Just spitballing here, but it could be due to previous bad encounters with Zoom, previous cases where Zoom has dismissed or downplayed an exploit, etc. Is Zoom one of those companies that requires excessive NDA's for exploits? That could be a factor. I can think of a few other reasons, although it probably would have been better to disclose to Zoom /alongside/ whoever else they thought should get it.

mr_mitm 6y ago
> bad encounters with Zoom, previous cases where Zoom has dismissed or downplayed an exploit, etc. Have they? Their disclosure policy [1] sounds reasonable and their public response [2] to the recent accusations has been text book, if you ask me. They even hired top industry experts (Alex Stamos, Matthew Green, etc.) and acquired keybase to strengthen their security. To me it looks like Zoom got lots of attention at once, and thus had lots of security issues at once, that would not be out of the ordinary if they had been more spread out. However, them lying to their customers about E2EE is hard to forgive. [1] https://hackerone.com/zoom https://hackerone.com/zoom [2] https://blog.zoom.us/a-message-to-our-users/ https://blog.zoom.us/a-message-to-our-users/
- ziddoap 6y ago
  As I mentioned, I was just stating some generic reasons why a researcher may choose not to disclose specifically (and only) to the company in question.
- Freeboots 6y ago
  They do seem to be taking it seriously, but their history of poor security well predates the recent influx of users. Before covid, all i knew about Zoom was "That video chat with all the exploits"

deleted 6y ago

[deleted]

Nullabillity 6y ago

They have shown repeatedly that they don't give a shit, so the best thing you can do for their users is to demonstrate for them why they should uninstall it yesterday.

deleted 6y ago
[deleted]

anon102010 6y ago

Live in a country that criminally prosecutes security researches? Jails them?

akersten 6y ago

Maybe Zoom wasn't willing to pay the sticker price: > Vice has reported that someone is claiming to have a zero-day exploit affecting the Zoom app for Windows, and they’re asking $500,000 for it. The remote code execution exploit allegedly requires the hacker to be in a call with the targeted user. Zoom says it has launched an investigation, but so far it has “not found any evidence substantiating these claims.”[1] [1]: https://www.securityweek.com/zoom-teams-katie-moussouris-revamp-bug-bounty-program https://www.securityweek.com/zoom-teams-katie-moussouris-rev... I couldn't find their current bug bounty payout schedule anywhere online, so I can only assume it's unimpressive.