4 ms·

While on a zoom call this morning, I ran a continuous TCPDUMp to see what servers were being contacted; the majority of the traffic was sent to 193.122.212.125

While on a zoom call this morning, I ran a continuous TCPDUMp to see what servers were being contacted; the majority of the traffic was sent to 193.122.212.125 Edit: This IP is hosted by Oracle https://bgp.he.net/ip/193.122.212.125 https://bgp.he.net/ip/193.122.212.125 Reverse DNS for the IP is handled by oracle cloud. Although zoom ostensibly has its headquarters in san jose, the code is developed 100% in mainland China. We should consider the face that the chinese military likely has access to MITM all zoom conversations on demand. I find the situation disquieting, but I am of two minds because I also feel almost the same level of distrust to facebook and whatsapp conversations.

LogicX 6y ago
The IPs are announced by oracle: https://bgp.he.net/ip/193.122.212.125 https://bgp.he.net/ip/193.122.212.125 Reverse DNS for the IP is handled by oracle cloud.
- bigphishy 6y ago
  I see now, thanks for helping me pinpoint this.
  - justicezyx 6y ago
    Yet, your original comments will be read and cut out of context. For precise communication, consider edit your original post.
- delfinom 6y ago
  Yea oracle trying desperately to stay relevant has severely undercut everyone else on bandwidth costs. It'll be silly for video apps not to use them. Though the effect on oracle long term will be interesting.
  - GordonS 6y ago
    TBF, bandwidth costs on AWS and Azure are so ludicrously high that it wouldn't be difficult to undercut them on bandwidth. That said, I wouldn't touch an Oracle product with a very long bargepole, even if bandwidth was free.
X6S1x6Okd1st 6y ago
Is there evidence that WhatsApp is MITMable? I assumed it's not because it claims to be E2E, when I checked the fingerprint of a contract it looked good and reports are that the taliban uses it for internal comms https://www.nytimes.com/2019/10/26/world/asia/afghanistan-whatsapp-taliban.html https://www.nytimes.com/2019/10/26/world/asia/afghanistan-wh...
- bigphishy 6y ago
  No there is no evidence that the encryption keys have been modified. If the fingerprints match, then messages are not being intercepted and cannot be with today's technology. However, the code is closed, perhaps it is only displaying a similar thumbprint, and hiding the real thumbprint from the user. As far as I know, the code to whatsapp is closed.
  - X6S1x6Okd1st 6y ago
    It's certainly closed source, but their E2E protocol is laid out in their white paper. You can determine if a given version of the app is conforming to the protocol or not at some point in time. After a short search I was able to find this attempt: https://www.delaat.net/rp/2018-2019/p25/report.pdf https://www.delaat.net/rp/2018-2019/p25/report.pdf Which was inconclusive.
hadcomplained 6y ago
> the code is developed 100% in mainland China I am under the same impression and have some circumstantial evidence supporting it as someone who's been inspecting the code of the Zoom client (just for fun): their Windows client uses a 3rd party library that is used virtually only in China whose documentation is available only in Mandarin. On a tangential note, I got surprised to see no traces of attempts to make inspection harder on their client software. Even function names remain intact in some cases, which I assume would not happen if they had a malicious intent like embedding a backdoor. > We need to promote our own opensource and free tools to our friends and family, we will get the last laugh. Although I agree that there should be viable alternatives to available tools for online communication without the possibility of being eavesdropped, I can see why such things do not exist. It'd be too inconvenient for the law enforcement. And if you take things from the perspective of whether that thing makes the job of the law enforcement harder, you'd notice such things tend not to exist. As a principle, popular software should not have a means to prevent data going through the software from getting inspected by the law enforcement. Does Dropbox offer end-to-end encryption? Of course not. Is there a popular easy-to-use disk encryption software? There was TrueCrypt, which is gone for an obvious reason. Does Gmail implement end-to-end encryption for emails? Of course not...
- samatman 6y ago
  > Even function names remain intact in some cases, which I assume would not happen if they had a malicious intent like embedding a backdoor. For what it's worth, this is a bad assumption. Someone hiding bad behavior from a reverse engineer wants it to be in friendlyMisnamedFunction, not in lkjwer23_aic. If you remove all the English semantics from the binary, a reverser is free to focus on the behavior; if you don't, you can lure them into a false sense of security.
  - srtjstjsj 6y ago
    Are any reverse engineers that stupid?
- jrockway 6y ago
  I'm under this impression because the UI is full of grammatical errors that aren't the types that native English speakers make. I would be surprised if there's anyone in the US working on the Windows app.
throw498754 6y ago
> the code is developed 100% in mainland China. Did the Keybase team move to China?
- 3AC51854 6y ago
  Has the Keybase team written any code for the Zoom client?

LogicX 6y ago

The IPs are announced by oracle: https://bgp.he.net/ip/193.122.212.125 https://bgp.he.net/ip/193.122.212.125 Reverse DNS for the IP is handled by oracle cloud.

bigphishy 6y ago
I see now, thanks for helping me pinpoint this.
- justicezyx 6y ago
  Yet, your original comments will be read and cut out of context. For precise communication, consider edit your original post.
delfinom 6y ago
Yea oracle trying desperately to stay relevant has severely undercut everyone else on bandwidth costs. It'll be silly for video apps not to use them. Though the effect on oracle long term will be interesting.
- GordonS 6y ago
  TBF, bandwidth costs on AWS and Azure are so ludicrously high that it wouldn't be difficult to undercut them on bandwidth. That said, I wouldn't touch an Oracle product with a very long bargepole, even if bandwidth was free.

X6S1x6Okd1st 6y ago

Is there evidence that WhatsApp is MITMable? I assumed it's not because it claims to be E2E, when I checked the fingerprint of a contract it looked good and reports are that the taliban uses it for internal comms https://www.nytimes.com/2019/10/26/world/asia/afghanistan-whatsapp-taliban.html https://www.nytimes.com/2019/10/26/world/asia/afghanistan-wh...

bigphishy 6y ago
No there is no evidence that the encryption keys have been modified. If the fingerprints match, then messages are not being intercepted and cannot be with today's technology. However, the code is closed, perhaps it is only displaying a similar thumbprint, and hiding the real thumbprint from the user. As far as I know, the code to whatsapp is closed.
- X6S1x6Okd1st 6y ago
  It's certainly closed source, but their E2E protocol is laid out in their white paper. You can determine if a given version of the app is conforming to the protocol or not at some point in time. After a short search I was able to find this attempt: https://www.delaat.net/rp/2018-2019/p25/report.pdf https://www.delaat.net/rp/2018-2019/p25/report.pdf Which was inconclusive.

hadcomplained 6y ago

> the code is developed 100% in mainland China I am under the same impression and have some circumstantial evidence supporting it as someone who's been inspecting the code of the Zoom client (just for fun): their Windows client uses a 3rd party library that is used virtually only in China whose documentation is available only in Mandarin. On a tangential note, I got surprised to see no traces of attempts to make inspection harder on their client software. Even function names remain intact in some cases, which I assume would not happen if they had a malicious intent like embedding a backdoor. > We need to promote our own opensource and free tools to our friends and family, we will get the last laugh. Although I agree that there should be viable alternatives to available tools for online communication without the possibility of being eavesdropped, I can see why such things do not exist. It'd be too inconvenient for the law enforcement. And if you take things from the perspective of whether that thing makes the job of the law enforcement harder, you'd notice such things tend not to exist. As a principle, popular software should not have a means to prevent data going through the software from getting inspected by the law enforcement. Does Dropbox offer end-to-end encryption? Of course not. Is there a popular easy-to-use disk encryption software? There was TrueCrypt, which is gone for an obvious reason. Does Gmail implement end-to-end encryption for emails? Of course not...

samatman 6y ago
> Even function names remain intact in some cases, which I assume would not happen if they had a malicious intent like embedding a backdoor. For what it's worth, this is a bad assumption. Someone hiding bad behavior from a reverse engineer wants it to be in friendlyMisnamedFunction, not in lkjwer23_aic. If you remove all the English semantics from the binary, a reverser is free to focus on the behavior; if you don't, you can lure them into a false sense of security.
- srtjstjsj 6y ago
  Are any reverse engineers that stupid?
jrockway 6y ago
I'm under this impression because the UI is full of grammatical errors that aren't the types that native English speakers make. I would be surprised if there's anyone in the US working on the Windows app.

throw498754 6y ago

> the code is developed 100% in mainland China. Did the Keybase team move to China?

3AC51854 6y ago
Has the Keybase team written any code for the Zoom client?