4 ms·
To try to convince my employer at the time to drop Zoom, I decided to see how many security vulns I could find in 2-3 hours. Found 12 confirmed bugs in that wi
by lrvick 2y ago
To try to convince my employer at the time to drop Zoom, I decided to see how many security vulns I could find in 2-3 hours.
Found 12 confirmed bugs in that window using only binwalk and osint.
The worst was that I noticed the zoom.us godaddy account password reset email address was the personal gmail account of Eric S Yuan, the CEO.
So, I tried to do a password reset on his gmail account. No 2FA, and only needed to answer two reset questions. Hometown, and phone number. Got those from public data and got my reset link, and thus, the ability to control the zoom.us domain name.
They were unable to find a single English speaking security team member to explain these bugs to, and it took them 3 months to confirm them and pay me $800 in bug bounties, total, for all 12 bugs.
The one bright side is this did convince my employer to drop them.
- jaxefayo 2y agoHow long ago was this? A few years ago they were hiring aggressively for security team members in the US, including a dedicated fuzzing team. I’m guessing this was from early on when Zoom was just getting popular?
- lrvick 2y agoAbout 7 years ago
- deleted 2y ago[deleted]
- popcalc 2y agoYou're admitting to committing a felony?
- MiguelX413 2y agoWhite hat hacking is fine.
- popcalc 2y agoIf you password reset my personal Gmail account I will sic the FBI on your tail without a second thought. Not cool.
- lrvick 2y agoYou can try, but they will not do anything unless I do actual harm. https://www.justice.gov/archives/opa/pr/department-justice-announces-new-policy-charging-cases-under-computer-fraud-and-abuse-act https://www.justice.gov/archives/opa/pr/department-justice-a... If you do not want your gmail password reset, I recommend hardware 2FA.
- hunter2_ 2y agoThe story says that the password reset link was received, which proves the vulnerability without actually denying service, causing loss, etc. As an analogy, the attacker found a key to a door but did not proceed to open the door. It doesn't say the password reset link was used to change the password, which would deprive the account owner access and grant unauthorized access which of course would be illegal.