Bug Bounty Writeups

> So except if the software keeps on spying after it is switched off (which would be unacceptable) This is really kind of funny, because this exact thing happened literally less than a year ago. It was technically a vulnerability, but they refused to see it as such and fix it until it was disclosed publicly and they had a wave of negative PR. They literally allowed anyone to connect to the webcam on your computer through an always-on server which remained installed after you removed Zoom from your computer. https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-ma… I can't believe everyone has forgotten this quickly. Zoom is not a trustworthy company.

Check how many analogies I managed to squeeze into this thought piece https://medium.com/bugbountywriteup/how-nature-holds-the-key-to-cybers…

> I'm a recent high school graduate and can't afford $8 per month for the official sync service What happened to the $47000 you got from Apple [1]? [1]: https://medium.com/bugbountywriteup/how-i-earned-47000-usd-as-a-high-s…

I moved away early this year due to its poor track record on security: 2019 - Report of the Zoom app's malware like behaviour-using a hidden web server to enable Zoom much more capabilities than simply launching a zoom call like re-installing the Zoom software[1] 2020-Tricking its users during installation pretending the OS is requiring password[2] In general, playing fast and loose with its users' data-sending a conference en(de)cryption key between two users in Canada/US to an ip address in Beijing.[3] [1]https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-ma… [2]https://twitter.com/c1truz_/status/1244737672930824193 [3]https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-l…

Don't forget the hidden web server fiasco https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-ma…

>The government of Taiwan banned official use of Zoom due to security concerns, as have New York State schools, the U.S. Senate, and the German ministry of foreign affairs. This is good enough reason to not use it. Also I stopped using zoom and trying to avoiding it as much as possible after the very first vulnerability scandal[0] came about [0] https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-ma…

https://daringfireball.net/2020/03/regarding_zoom https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-ma… https://www.theverge.com/2019/7/10/20689644/apple-zoom-web-server-auto…

It's related to https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-ma…

There is some truth to that, but at least the clients are not so terrible (see e.g. https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-ma… From a technical perspective I don't think anything groundbreaking is required, it just wasn't a market segment earning money before now, because why not just walk down the hall, or have a conference etc? Noone is saying a Zoom meeting can replace that, it is just a stop gap.

> Does anyone know if they've ignored the concern? Well yes, an example is their reaction on their Zero Day: https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-ma… > Ultimately, Zoom failed at quickly confirming that the reported vulnerability actually existed and they failed at having a fix to the issue delivered to customers in a timely manner. An organization of this profile and with such a large user base should have been more proactive in protecting their users from attack.

let me expand (copy pasta from my comment on sibling post[0]): this isn't the first time zoom got caught red-handed[1]. Last year they were called out for installing a local web server in order to disable security controls to get around the deprecated NPAPI[2] ... this is _literally_ what malware does. Seriously fuck zoom! [0] https://news.ycombinator.com/item?id=22658173 [1] https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-ma… [2] https://en.wikipedia.org/wiki/NPAPI

What say you to this, Bokelley? https://medium.com/bugbountywriteup/at-ts-ad-exchange-is-overrun-with-…

You’re probably thinking of a security vulnerability in their Mac client due to a poor design choice that they were negligent in fixing expediently. Still, I don’t think this classifies the app as malware—the behavior was not added with malicious intent. https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-ma…

For context, see this GitHub issue: https://github.com/codemirror/CodeMirror/issues/4937 Author is unwilling to change a handful lines of code to make the package compatible with a strict style-src. Why does this matter? You can exfiltrate data such as CSRF tokens using inline styles from a HTML injection vulnerability: https://medium.com/bugbountywriteup/exfiltration-via-css-injection-4e9…

That doesn't solve the problem because the webserver continues to run even if you have uninstalled Zoom. Source: https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-ma…

Wouldn't say so. The who found the Vulnerability where at least talking to the people at chrome and firefox: Quote from there Blogpost (https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-ma… "Apr 10, 2019 — Vulnerability disclosed to Chromium security team. Apr 19, 2019 — Vulnerability disclosed to Mozilla FireFox security team." So, not entirely unrealistic that the other Browser manufacturer also got a notice.

Except Zoom web version doesn't work: the incoming/outgoing audio is garbled (tested with Chrome, they do not support Firefox). This is in part because they were obviously too good for WebRTC native audio and instead gutted ffmpeg and compiled it to WebAssembly (I wish I was kidding but I'm not: https://webrtchacks.com/zoom-avoids-using-webrtc/). Moreover, Zoom has a history of RCEs (leaving an active web server after you uninstall Zoom? so that a website can reinstall Zoom without any user interaction? why not! https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-ma… and anti-privacy behavior: meeting host gets a copy of all private messages sent between participants (there is no notice of this; https://twitter.com/rcalo/status/1237957509324746752); host can monitor if your Zoom window is active (https://twitter.com/zoom_us/status/1241768006327336963); and Zoom has audio fingerprint tracing (so if you get a leaked recording Zoom can blame a particular participant: https://venturebeat.com/2019/01/22/zoom-is-bringing-ultrasonic-signatu… Running it under strace reveals it is fingerprinting your device as well (idk if that gets sent anywhere but iOS app sends stuff to Facebook...). Zoom is creepy and should not be used. I keep a separate VM for it, as it clearly can not be trusted.