5 ms·
“Makes calls safer”. It fixes this particular no user input RCE vulnerability, but how many others remain? If this type of vulnerability is present at all in
by wffurr 6y ago
“Makes calls safer”. It fixes this particular no user input RCE vulnerability, but how many others remain? If this type of vulnerability is present at all in Zoom, then it stands to reason more wait to be discovered by sufficiently motivated attackers.
These things shouldn’t end with a bounty for the researcher and a patch by the vendor. It should end with a root cause analysis and a plan to fix that type of vulnerability across the entire app, or better yet, the whole industry via a research paper.
- wffurr 6y ago“ does not affect the browser version” at least they weren’t able to combine this with a browser security flaw to escape the JS sandbox.
- La1n 6y agoWhat makes you assume no RCA will be done?
- wffurr 6y agoI should clarify: public RCA. Is $200k enough to motivate a company like Zoom to do an RCA after something like this? Maybe? I personally doubt it but don’t have any real reasoning for it one way or another.
- albntomat0 6y ago> These things shouldn’t end with a bounty for the researcher and a patch by the vendor. It should end with a root cause analysis and a plan to fix that type of vulnerability across the entire app, or better yet, the whole industry via a research paper. I'm unsure (and open to discussion) on which classes of bugs make that possible. My initial thought is that finding a stack overflow bug (to randomly choose a bug class) results in "don't goof up memory", which is technically correct, but not actually useful in finding others of that class. In this hypothetical, maybe the result would some combination of accessing programming language choice, programming practice, and testing tooling? Can't say those are a silver bullet though.
- nightcracker 6y agoYes, Zoom calls are now safer in the sense that the nuclear missile program got safer when the nuclear launch codes were changed from 0000000. Except in Zoom's case there isn't a human sitting in between the nuclear device and the world wide web.
- rijoja 6y agoOh the link actually says that it is not patched. So now everyone with an interest in nuclear devices knows that the code is something really easy to guess. The silver lining in this moving the nuclear warning system a few minutes closer to 12 is that the guy who pointed it out got a bonus and a raise!
- swiley 6y agoI'm still upset they try to force you to use their plugin. These would be less scary if it were jst a web app.
- wasyl 6y agoThey do? I don't have any plugin installed and use Zoom in Firefox without major issues
- BlueTemplar 6y agoLol, I forgot that it could even be run in a web browser!
- ISL 6y agoYou can force it to use a web app by declining permission to run locally. The web-app has fewer capabilities (no gallery view, last I used it), but works great. Also, Meet is fully-featured and runs entirely in-browser.
- tweetle_beetle 6y agoI've wondered whether things like the gallery view limitation were actual technical hurdles, or just the modern equivalent of nagware to boost the app download metrics.
- ISL 6y agoAt the start of the pandemic, the web client had gallery view.
- Asraelite 6y agoIs the lack of a gallery view a genuine technical constraint, or an artificial one introduced to get users to use the plugin?
- Steltek 6y ago