17 ms·
Zoom zero-day discovery
- alexrustic 6y agoSee also ZDNet article about this: Critical Zoom vulnerability triggers remote code execution without user input https://www.zdnet.com/article/critical-zoom-vulnerability-triggers-remote-code-execution-without-user-input/ https://www.zdnet.com/article/critical-zoom-vulnerability-tr...
- basicplus2 6y agoThanks for that link! "The attack must also originate from an accepted external contact or be a part of the target's same organizational account," Zoom added. "As a best practice, Zoom recommends that all users only accept contact requests from individuals they know and trust."
- jtdev 6y agoIs it just me, or does $200k seem far too low for this? I understand that the reward was paid by the event, not Zoom... but it seems to me that Zoom should “pony up” some additional funds for this research.
- disgruntled101 6y agoYou are always free to sell the hacks for their """actual""" market value on the black market. Of course you need to launder the money, you might get jailed, you might have to flee the country and so on but at least you get your fair rate.
- wffurr 6y agoOr sell it to the NSA (or insert your national intelligence service here) as a defense contractor, which some might call your “patriotic duty”.
- cosmodisk 6y agoI doubt the rates are that good tbh..
- alwayseasy 6y agoYou need to setup as a defense contractor (and jump through all the hoops) just so you can sell a Zoom zero-day and realize the NSA will give you 50k?
- amoshi 6y agoYou're overcomplicating, Zerodium exists.
- 14 6y agoA lot of the time we see someone getting like 10k. Also 200k is over 3 years my wage so I have to say no it does not seem low to myself but to others perhaps that is a low number but I value things differently. I hold high morals so I would not ever just sell an exploit to "the bad guys" so realistically I was never going to get the most money for said exploit so it is not all about money.
- rvz 6y ago> Is it just me, or does $200k seem far too low for this? For two researchers, that sounds like a lot. $100k each in less than a week for this bug sounds just rightly priced.
- esnard 6y agoVery few bounty programs offer that much for a single vulnerability. I'm not saying it's worth $200k, but $200k is definitively a huge payout in the security industry.
- tyingq 6y agoI can't tell much from the gif, but perhaps. RCE for anyone that runs Zoom, or RCE for anyone in a meeting you're in or something else?
- idiotsecant 6y agoWhat percentage of these kind of exploits does hn think are found by these kind of white hat exercises and what percentage are sitting out there in an intelligence service or private entity's 0-day database? I have always been curious.
- degenerate 6y agoA wild guess is 3:1 (3 working 0-day exploits in existence for every 1 found with exercises like this). My reasoning is because every time there is a very high-priced bounty on an exploit, it seems to get discovered and pay out. So if governments and blackhats have people hunting full time for these exploits, you better bet they are finding them too.
- comboy 6y agoIf I were running an agency... You don't have to find many zero days. Just have enough. Huge backend of tools and network of contributors surely helps, but if 0-day is gone in Zoom, and say you don't have their explicit cooperation (which you totally can have) and you only have one, then it may not be such a worry if it is commonly used with other software that you can own. Besides that, there are tiers of 0-days, some of which you would not touch unless the target is exceptionally valuable and you did some homework with oh-just-a-common-malware to learn about their system and response. There is no system that is secure. There may be systems that are obscure. But if they would be targeted they can be owned with easy because they are not popular and security is really really hard. This is not just crazy talk anymore, it's reality. It's enough to watch CVEs, think what you could do if you exploit them silently and what that allows you to do in the future. Watch them not only for abstractions on top, but for whole tons of firmware running both on your machine and machines that you trust. Oh and certificates... It's just too easy. Way too easy.
- stjohnswarts 6y agoI would guess at least 10:1
- wffurr 6y ago“Makes calls safer”. It fixes this particular no user input RCE vulnerability, but how many others remain? If this type of vulnerability is present at all in Zoom, then it stands to reason more wait to be discovered by sufficiently motivated attackers. These things shouldn’t end with a bounty for the researcher and a patch by the vendor. It should end with a root cause analysis and a plan to fix that type of vulnerability across the entire app, or better yet, the whole industry via a research paper.
- wffurr 6y ago“ does not affect the browser version” at least they weren’t able to combine this with a browser security flaw to escape the JS sandbox.
- La1n 6y agoWhat makes you assume no RCA will be done?
- wffurr 6y agoI should clarify: public RCA. Is $200k enough to motivate a company like Zoom to do an RCA after something like this? Maybe? I personally doubt it but don’t have any real reasoning for it one way or another.
- albntomat0 6y ago> These things shouldn’t end with a bounty for the researcher and a patch by the vendor. It should end with a root cause analysis and a plan to fix that type of vulnerability across the entire app, or better yet, the whole industry via a research paper. I'm unsure (and open to discussion) on which classes of bugs make that possible. My initial thought is that finding a stack overflow bug (to randomly choose a bug class) results in "don't goof up memory", which is technically correct, but not actually useful in finding others of that class. In this hypothetical, maybe the result would some combination of accessing programming language choice, programming practice, and testing tooling? Can't say those are a silver bullet though.
- nightcracker 6y ago
- theobeers 6y agoYet another (relative) win for the browser environment: "We also know that the method works on the Windows and Mac version of the Zoom software, but does not affect the browser version."
- junon 6y agoI don't think this is the right conclusion to jump to. Browsers have a mountain of issues in their own right.
- hvis 6y agoAnd an order of magnitude more security researchers trying to poke holes in them, too.
- theobeers 6y agoOf course they do. I have in mind the choice that we're often given these days, between a native (or pseudo-native) desktop app and an in-browser version with comparable functionality. Perhaps I should have been clearer about that in my earlier comment.
- tyingq 6y agoWe don't know much about the RCE. It may have been able to do something in the browser, with more effort, e̶s̶p̶e̶c̶i̶a̶l̶l̶y̶ ̶g̶i̶v̶e̶n̶ ̶t̶h̶a̶t̶ ̶t̶h̶e̶ ̶"̶n̶a̶t̶i̶v̶e̶ ̶a̶p̶p̶"̶ ̶h̶e̶r̶e̶ ̶i̶s̶ ̶a̶n̶ ̶E̶l̶e̶c̶t̶r̶o̶n̶ ̶a̶p̶p̶. Perhaps they stopped once they saw they had done enough for the $200k bounty. Edit: Not an electron app.
- dathinab 6y agoSeems fair, through "less insecure" would be generally more appropriate (independent of it being Zoom). But then I have lost all trust in Zoom due to the history involved with it. And I also don't thing Zoom will regain the trust, because due to the way they lost trust again and again and also acted in-honest it's pretty hard for them to convey that they changed (instead of just pretending they did).
- jacquesm 6y agoSame here, zoom is on our 'ban' list. And MS teams is getting there, what a load of crap that is, it is so buggy it is embarrassing.
- _nickwhite 6y agoMy biggest gripe about Teams is what a memory hog it is. Mine is currently sitting idle (been on vacation all week) at nearly 1GB. Compare this to Zoom, which is idling at just over 100MB. Teams is literally taking up 10 times more RAM than Zoom just running in the background.
- slaymaker1907 6y agoTry disabling GPU acceleration. It seems to speed things up a lot for some reason.
- DangerousPie 6y agoI have never used Teams but is 1GB of memory usage really an issue in 2021, when most laptops have at least 16-32 gigs of memory? It's been years since the last time I actually worried about how much memory some software on my laptop was using.
- reaperducer 6y agois 1GB of memory usage really an issue in 2021 It isn't if you're on a laptop from 2021. But that vast majority of people aren't. Companies don't provision new computers to their employees every time a new computer comes out. At the companies I've worked for, the minimum refresh time is 3-5 years, depending on tax laws, and financial ability. It's also not a big deal if the computer is only used for Zoom. Most people, whether office drones or developers, run many programs at once.
- hankchinaski 6y ago"safer" until the next zero-day is uncovered
- marshmallow_12 6y agogive zoom some slack, critics. At least they honour their bounties, unlike Apple. https://news.ycombinator.com/item?id=26664714 https://news.ycombinator.com/item?id=26664714
- sneak 6y agoZoom's dark patterns trying to get you to install the app on your system (which demands administrator privileges, natch) are reason enough to resist ever running unsandboxed software from them. Their continued history of major security issues (remember that time that they had a local webserver offering RCE by design as part of the desktop client) is even more. Their browser app does not have feature parity; recently I had to participate in a conference and the browser version fucked up my camera's aspect ratio, a problem that doesn't exist in their full client. A burner laptop was required, and was wiped immediately after. Avoid Zoom whenever possible. Don't ask others to use it.
- oefrha 6y agoRelated, the two other $200k entries from Pwn2Own 2021:[1] - DEVCORE targeting Microsoft Exchange in the Server category (The DEVCORE team combined an authentication bypass and a local privilege escalation to complete take over the Exchange server.) - The researcher who goes by OV targeting Microsoft Teams in the Enterprise Communications category (OV combined a pair of bugs to demonstrate code execution on Microsoft Teams.) It would be kind of funny if Slack had one too... [1] https://www.zerodayinitiative.com/blog/2021/4/2/pwn2own-2021-schedule-and-live-results https://www.zerodayinitiative.com/blog/2021/4/2/pwn2own-2021...
- Rendello 6y agoI wonder if the OS world will move towards lightweight but unforgiving sandboxing like OpenBSD's `pledge` and `unveil` system calls. It's crazy to me that most software is still completely fine to run around and set things as fire the instant it's compromised! This is about the implementation in the SerenityOS but it's my favourite explanation so far: https://awesomekling.github.io/pledge-and-unveil-in-SerenityOS/ https://awesomekling.github.io/pledge-and-unveil-in-Serenity...
- saddlerustle 6y agoiOS, Android and ChromeOS are already there. But for exploits targeting Exchange or Teams it's far from a perfect solution because valuable private information is in the app being compromised.
- brundolf 6y agoMost desktop OSes came about (or at least have their roots in) a pre-internet world, where you install software from discs you purchased at the store, or if you're feeling gutsy, from media your friend hands you in real-life. They assume you have a great amount of trust in every piece of code you run on your computer (and anyway, how will malware exfiltrate your data without an always-on network connection?). Things like Windows Defender and Snap and the recent macOS hardening efforts are patchwork solutions to try and cope with the modern world, but they'll never really be enough because these systems can't be fundamentally re-thought; they have to keep doing everything everybody already expects them to do. Only brand new OSes really get the chance to do things right, and only the mobile ones really had the opportunity to gain wide adoption.
- jtdev 6y agoIt sounds like a great deal for Zoom... Zoom would have paid far more for this research in any other scenario. The InfoSec community seems to be quite happy giving away their hard work, while the large security vendors make mountains of cash on snake oil solutions to enterprises. For context, Zoom certainly paid many multiples of $200k during any given month for firewall licensing.
- kristjansson 6y agoOTOH, security researchers do inflate the value of any given exploit (chain) vs. broad mitigations. Still, 200k seems _low_ for a bug that should imperil the reputation of a many-billion dollar company. And a few years ago it seems like that would have been $1000 and a firm handshake...
- bezoz 6y agoThe positive "tilt" in this article is honestly amusing and unusual for such articles "zero-day discovery makes calls safer" "Understandably, Zoom has not yet had the time to issue a patch for the vulnerability" "This event, and the procedures and protocols that surround it, demonstrate very nicely how white-hat hackers work" Imagine if that was your run of the mill well-hated big corp "Yet another security vulnerability leaves millions at risk" "XYZ Corp shows its incompetence once again exposing users' private data to hackers" etc etc No specific point here. I am just amused!
- vxNsr 6y agoThis is a PR piece. People do hate zoom, this is zoom trying to rehabilitate their image through their security partner.
- FreshFries 6y agoPeople hate zoom? Like "Teams is so much better" or "online meeting are bad"? For me it one of the more enjoyable online meeting options and it leaves Teams, Skype, webex and what have you, far behind.
- Throwaway234285 6y agoLike "Zoom is an unethical company". See: Privacy concerns, lying about encryption, connections to china, bad security.
- cstejerean 6y agoThat might be “people on HN hate zoom”.
- Throwaway234285 6y agoFair point. Possibly "people on HN hate zoom, and then use it anyways because it's forced."
- jchw 6y agoNot related, but: the other day I joined a Zoom call for the first time. I had no interest in using a native client, but when you first try to join the call and Zoom tries to download the client, Microsoft Edge warned me that it was “harmful to my device”. For once SmartScreen and I are in agreement.
- walrus01 6y agoZoom is entirely banned at the two companies that are my day job, and probably 90% of partners. If you do any work adjacent to anything that's ITAR controlled you should also not be surprised to see the same policy from partner companies. This has been in place for quite some time since the initial security problem that was so egregiously bad apple had to resort to using the malware removal tool to remove zoom's binaries from Macos clients. Entirely aside from their many past security holes which have been handled poorly , they have straight up lied about end to end crypto and what exact crypto it's using. That's before we get into the ownership of the company, its management and the location of most of the developers.
- sitzkrieg 6y agothis was the case here too, but just yesterday got on a usaf hosted zoom that said 'gov' and hosted in CONUS so they seem to have some offering at least DoD is ok with now, appears to only be fedramp https://www.zoomgov.com/ https://www.zoomgov.com/
- HappyTypist 6y agoNote that the DoD Authorization only covers Zoom for public, not even FOUO, data. For sensitive data, only Cisco and Microsoft are allowed.
- sitzkrieg 6y agoyes of course, good point to emphasize it's probably never going to even reach CUI approval lol
- Geezus_42 6y agoCounty courts in my area use Zoom as well.
- astrea 6y agoDo these issues hold true for the FedRAMP'd "Zoom For Government"?
- vthallam 6y agoCan we please edit the headline. This sounds disingenuous, a more appropriate headline would be something like "critical vulnerability in Zoom Video Calls that would have put millions of users at risk has been found". This feels like a straight up PR piece.
- rijoja 6y agoSeconded! Only a PR person would dream of saying that a 0 day exploit is a good thing. I expect that most HN readers just finds this hillarious, but still people read HN since it has a good standard. Saying that a 0 day exploit is a good thing goes against this needless to say. Especially since they've faced serious accusations earlier on.
- brundolf 6y agoIt's very clearly sarcasm and not a serious PR move, though I agree it makes the article confusing and hard to follow. Changing it to a different source link seems appropriate.
- rijoja 6y agoI don't really think a communication from Malwarebytes is the place for sarcastic comments. Lets say if you are working with a US government this could have enormous implications. I've talked to a lot of clients who ditched Zoom for Microsoft Teams due to their earlier mistakes. Also I find it funny that the heading "Not patched yet" is solved by the headline "Security done right". Lets say if you are working with a company that deals with say healthcare information a 0-day certainly doesn't make things safer and since it is not patched yet this is definitely not done right.
- gowld 6y agoTeams is exploitable too.
- 6y ago
- AndyMcConachie 6y agoI sometimes wonder if we're destined for a world where software companies decide they should employ QA staff. Or if we're destined for a world where the majority of QA gets oursourced to competitions.
- dreamcompiler 6y agoSoftware companies used to have QA staff. But developers said "we can write our own tests and you can get rid of those expensive QA people who we hate" and here we are, in the land of forever-crappy software. It's our own damn fault for becoming over-reliant on CI to find all the bugs.
- Oddskar 6y agoI squarely put this in the same compartment as "my code is self documenting". I've only seen management and devs who are less than stellar argue against having QAs.
- faraaz98 6y ago>The fact that the researchers came out on the second day of the Pwn2Own event with this vulnerability does not mean they figured it out in those two days. They will have put in months of research to find the different flaws and combine them into an RCE attack. I really appreciate the article author mentioning this. It gives hope to all beginners and shows that "overnight success" is a result of months and years of learning and research
- twobitshifter 6y agoWe were told that the keybase acquisition was going to lead to a more secure Zoom. It appears we’re still waiting to see that come to fruition.
- welder 6y agoThey meant more secure encryption for calls, not a more secure app binary.
- alphabet9000 6y agolikely not the same situation, but its interesting zoom has a client uri scheme zoommtg:// and just a year or so ago a CVE [0] popped up that involved using the irc:// scheme to demonstrate a calculator opening using mIRC. [0] https://proofofcalc.com/cve-2019-6453-mIRC https://proofofcalc.com/cve-2019-6453-mIRC
- fouuler 6y agoNaive question. I'm forced to use Zoom by my University, so I run it from a dedicated user (on Linux). That's fairly safe, right?
- capableweb 6y ago"Safe" in security is always relative. Safe from a military hacking attack? Probably never. Safe from random scriptkiddies? Yeah, probably even if you don't run Zoom with a separate user, as long as you got the rest of your shit together. Safe from people buying/using 0days? Seems so, since this issue was never actually disclosed (yet) so it's not really a 0day, so it'll be harder to for people to exploit. You'd need to understand who/what are your threats to understand if you're "safe" or not.
- fouuler 6y agoWhat I mean is: am I safe from those who have a Zoom 0day, if Zoom is running on a separate user; assuming they do not also have a Linux 0day.
- thinkharderdev 6y agoDepends on a lot of things. If the 0day is an RCE they would need another privilege escalation exploit. How easy that would be depends a lot on how your system is setup. But the short answer is probably not. Unless you are running Qubes or something, if someone can exploit an RCE then they can probably own your system.
- fouuler 6y agoI'd be really interested in a longer answer. I'm running Void Linux. What would exactly would Qubes add in this respect?
- stjohnswarts 6y agoNo, as this discussion points out you should use the browser version if at all possible. The snap version would also offer a little bit more sandboxing probably if you're willing to edit the config for how much access it has to your system.
- brundolf 6y agoIsn't it standard practice not to disclose a vulnerability at all (not just hiding the "technical details") until it's been patched? Why is this being made public?
- floatingatoll 6y agoPwn2own operates under a different banner than the ‘standard practice’ described.
- socrates1998 6y agoShit. I have to use Zoom for meeting with clients on an iMac, what should I do to keep my computer safe?
- treesknees 6y agoIt's not as though this is being actively exploited in the wild. Just keep your Zoom app updated.
- cyberlab 6y agoThis reminds me of the Skype 'vuln' where you could see weird VPS/colocation servers scooping up links when you send them via their chat feature. /Nobody/ except the recipient and you should be visiting that link, yet it's still an issue. At first I thought it just wanted to generate a 'link preview' but it's more sinister than that. Some random surveillant is looking at every link.
- walrus01 6y agoHow long ago was this going on?
- tatersolid 6y agoThis is an anti-malware/anti-phishing scan. Send a link via email, Slack, or any other “enterprise” system and you will see the same.
- PostThisTooFast 6y ago"zero-day?"
- de6u99er 6y agoIt is being sold as if everybody ditched a bullet, while nobody can be 100% certain that this vulnurability has not been alreqdy exploited.
- LocalPCGuy 6y agoEven worse, it isn't even patched now, and now the bad guys are aware this exists, even if they don't know exactly how yet. And no reason to keep it quiet if they do figure it out - exploit away as long as you can cause they know it is going to be fixed relatively quickly.
- spinny 6y agoNot surprising. I just wonder how trivial is to exploit it and if it's not one of many "honest mistakes" that some companies sometimes commit. Some trivially exploitable and very reliable stack overflows on some routers come to mind ...
- AlexCoventry 6y agoI use the zoom web client, when I have to use zoom. It has fewer features, but I'm more comfortable running badly written software in an environment designed for hostile code. Just change the /j/ in the url to /wc/, and insert /join after the meeting id. https://devforum.zoom.us/t/launch-zoom-client-from-browser-without-redirect/9304 https://devforum.zoom.us/t/launch-zoom-client-from-browser-w...
- throwaway888abc 6y agohandy, thanks
- deleted 6y ago[deleted]
- neolog 6y agoTry stracing the desktop client.
- jacobolus 6y agoThe zoom web client has extremely buggy audio support. It regularly breaks in all of the browsers on my computer, and I end up listening to meetings only able to contribute via the text chat.
- AlexCoventry 6y agoAh, I didn't know that. I always phone in, and only use the computer audio as a failover.
- linuxftw 6y agoI've had this as well. I just refresh as soon as the audio and video comes up, and this seems to keep it stable for the remainder of the session. Otherwise, there's like a 60% I lose the ability to do anything.
- spurgu 6y agoAudio was stuttering for me as well up until at some point late last autumn / early winter when it suddenly started working quite fine to the point I could actually bear using it. On MacOS with Chrome.
- busymom0 6y agoIf I remember right, Tesla and a few other companies banned Zoom. But many governments still use it. How is that okay?
- diebeforei485 6y agoHow sandboxed is the macOS version of zoom?
- bitcoinGod88 6y agoITT: more anti china racism