uptown · 7 years ago

“On Mac, if you have ever installed Zoom, there is a web server on your local machine running on port 19421.”

...

“All a website would need to do is embed the above in their website and any Zoom user will be instantly connected with their video running. This is still true today!”

rolltiide · 7 years ago

as demonstrated, "responsible disclosure" is a huge time waster for the discovery, and the price of this is undervalued even if the company had a clear bug bounty program.

its more valuable than 90-days of a developer's time, not even correlated to time at all really

ct520 · 7 years ago

Sooo... this is still vulnerable?!

gowld · 7 years ago

Note: "Zoom" is a videoconfrerencing app, not a built-in Mac OS accessibility feature for "zoom".

The article does not clearly state this, ceding a plain English word to a corporation, enabling a takeover of human language.

P.S.: This part

> Apr 26, 2019 — Video call with Mozilla and Zoom Security Teams

is funny, and would be way funnier if it was an non-consensual video call.

Finally, note that Zoom effectively does not pay for bug bounties, so researchers should think twice about donating their expertise to a selfish for-profit corporation, and users should think twice about using a videochat product that allows its entire security team to take blackout vacations, and also doesn't pay its outsourced sercurity researchers.

CaliforniaKarl · 7 years ago

The article’s actual title is: Zoom Zero Day: 4+ Million Webcams & maybe an RCE? Just get them to visit your website!

But, assuming I’m reading it correctly, the “maybe an RCE?” part seems like fear-mongering, because it would require that Zoom lose control of one of the domains that they trust for transparent client installs/upgrades.

I’m also a little concerned about how some parts of the article don’t match up. For example, the “UPDATE: June 7th, 2019:” does not have (as far as I can see) a matching entry in the Timeline. There is an entry for July 7, noting a regression; but there is an update the next day (July 8) noting that the regression has been fixed.

thijsvandien · 7 years ago

Positively terrible... Kudos to this researcher. I liked Zoom when I used it a couple of times, but the reinstall “feature” is a huge violation of my trust. Software from the company behind it will not touch my system anymore. Too bad really, because properly working video chat is hard to find. The App Store model is not my favorite, but at times like these, a forced sandbox and inspection by a trusted third party start to look like the only way forward.

dogecoinbase · 7 years ago

I would highly recommend visiting the proof-of-concept link, which is a Zoom videoconference hosted by the author full of people testing it out.

joeconway · 7 years ago

From the article:

"To shut down the web server, run lsof -i :19421 to get the PID of the process, then do kill -9 [process number]. Then you can delete the ~/.zoomus directory to remove the web server application files."

ancorevard · 7 years ago

How to protect yourself:

"Disable the ability for Zoom to turn on your webcam when joining a meeting."

It's under Settings->Video in Zoom, check "Turn off my video when joining a meeting".

TACIXAT · 7 years ago

The Zoom client on Linux used to (?) have a nasty command injection. The URL for joining a meeting got passed to some bash reinvocation (so they could set the library path if my memory serves me). A specially crafted URL could execute commands on the system. I haven't been too interested in using Zoom since seeing that.

seandougall · 7 years ago

> This vulnerability leverages the amazingly simple Zoom feature where you can just send anyone a meeting link (for example https://zoom.us/j/492468757) and when they open that link in their browser their Zoom client is magically opened on their local machine. I was curious about how this amazing bit of functionality was implemented and how it had been implemented securely. Come to find out, it really hadn’t been implemented securely. Nor can I figure out a good way to do this that doesn’t require an additional bit of user interaction to be secure.

Does anybody understand (and have a moment to explain) why the author says this is difficult to do securely? macOS has a simple facility for handling custom URL schemes, so my impulse would be to have `https://zoom.us/j/492468757` do a server-side redirect to a URL like, say, `zoomus://492468757`, which would launch Zoom locally using the OS's built-in services. This wouldn't require a third-party daemon of any sort, and would just be a regular application that the user could trivially uninstall.

Is there a security hole there that I'm missing? Or have I misunderstood the author's point?

Jlleitschuh · 7 years ago

Hi I'm the author, AMA

Or come hang out in the party chat!

Use the exploit to join: https://jlleitschuh.org/zoom_vulnerability_poc/zoompwn_ifram...

outworlder · 7 years ago

Even if you have the camera disabled (and I never gave camera permissions to zoom to begin with), it will still join a random stranger's meeting, which will leak your name (or whatever name you have configured). This may be important for some.

dankohn1 · 7 years ago

Huge kudos to the author for finding this security hole, reporting it responsibly, and then posting such a clear writeup.

olliej · 7 years ago

Note that the server persists after the app is removed, so there’s that as well.

Follow on: What are they talking about regarding custom url handlers? That’s a standard OS X feature...

vayne · 7 years ago

How do you recommend uninstalling this?

duxup · 7 years ago

I really wish physical switches that cut power to mics and cameras were standard on everything.

I know that would be change from how hardware works / is designed now but it also seems like the only reliable line of defense.

georgewfraser · 7 years ago

Why isn't zoom running fully in the web browser at this point? Meet does this, and as far as I can tell the quality is indistinguishable from Zoom. Can someone with a better understanding of the underlying protocols shed light on why Zoom continues to ship a separate desktop app?

amluto · 7 years ago

I don’t get Mozilla and Chromium’s responses. I can think of few cases in which a website should be allowed to issue requests (CORS, img, or otherwise) to an address on the local network and none whatsoever in which a website should be able to contact localhost.

The fix seems straightforward. Require user permission to access the local network (subject to appropriate heuristics as to what “local” means). Require a config option and user permission to access localhost. Problem solved.

olliej · 7 years ago

macOS and iOS both support custom schemes, and have done forever. What feature does Zoom actually want?

upofadown · 7 years ago

><img src="http://localhost:xxxxx/launch?action=join&confno=492468757"/...

So a browser allows a random remote website access to stuff running on the localhost interface? Is this a good idea? Stuff like camera access I can at least disable...

mfrye0 · 7 years ago

Yeah. That's why I bought a webcam cover. I highly recommend if you don't have one already.

DonaldDerek · 7 years ago

Ok here's the thing. Open Google Hangouts, or any other website that asks for permission to use your webcam, then close the tab. Go to terminal check if VDCAssistant is running using `lsof | grep -i VDC` it returns that it is running. I've had this issue since 2015 so I'm glad someone is talking about this now.. Is it just me?

pluc · 7 years ago

GoToMeeting and Zoom are two things I always insist not to use. There are perfectly acceptable online-only counterparts that don't need to infect my computer.

Mtinie · 7 years ago

Might I suggest: https://www.obdev.at/products/microsnitch/index.html

lanrh1836 · 7 years ago

Surprised something of this magnitude seems to have 0 impact on stock price after hours.

tonymet · 7 years ago

I tested the repro-steps and found that the ZoomHelper was not listening, although it was installed . In this case i was prompted to download zoom.pkg rather than activate video.

I'm guessing it was because I have MacOS firewall = strict (no listening ports)

Also, here's a nice tip to show all listening apps (good habit while cleaning up)

  lsof -i -s tcp:listen |awk '{print $1 " "$8" " $9}'|sort|uniq
  COMMAND NODE NAME
  Google UDP *:mdns
  SystemUIS UDP *:*
  SystemUIS UDP *:53611
  UserEvent UDP *:*
  WiFiAgent UDP *:*
  identitys UDP *:*
  rapportd TCP *:49152
  rapportd UDP *:*
  sharingd UDP *:*

firebones · 7 years ago

Do you know if this vulnerability might manifest in other ways, and permit remote participants to force you into sharing or viewing your screen silently?

One of the first times I'd ever used Zoom was in a call with a startup trying to pitch my company on something. The remote participant said something later in the call that was uncannily prescient and related to notes I had in a separate application window. I wrote it off as coincidence, but the phrasing used (and the fact that it was an answer to a question I hadn't asked) seemed nearly verbatim to my written notes.

cobbzilla · 7 years ago

I'm trying to think of the real-world implications and how this would play out.

Normally this would be pretty obvious, wouldn't it? Users would see Zoom open into some weird meeting, and close it.

Presuming the exploit cannot avoid bringing the Zoom app to the foreground when it joins the meeting and activates the camera/mic. If it can do that and stay in the background, all bets are off.

In spite of its obviousness, it's still pretty darn scary --

Scenario 1: malicious website/app opens link while you're sitting there.

You're sitting in front of your computer, you see Zoom open, you're like "WTF?!", close that shit, uninstall Zoom; hopefully discover how to permanently remove it (it otherwise leaves a localhost http server running that can reinstall itself).

But crap the hijackers have, even with a few seconds of video: your face, your surroundings, the audio of your surroundings, all of which can increasingly be fingerprinted. That alone is very scary. Just to be in an unintentional meeting for a moment is very disturbing. A violation of sorts.

Scenario 2: malicious website/app delays opening the link until some threshold of mouse/KB inactivity is reached.

Activate the Zoom link and hope the person is AFK. Spy on their home/office/whatever. Also a violation.

Are there other scenarios I am missing?

Personal note 1: I'm happy I switched to a Linux laptop after finding last year's MBPs disappointing (and the TB revolting; I have a physical escape key!).

Personal note 2: I do actually like Zoom a lot, it's an awesome video conferencing app. But this should be fixed for Mac users.

lanrh1836 · 7 years ago

This feels material, which is why I’m surprised there’s 0 movement in their stock price after hours. Why do you think that is?

sandGorgon · 7 years ago

Why is the web client (on Chrome, etc) so bad on Zoom ? I mean, people are building Google Earth on the browser .Its not just the bad video experience - even the product experience is seriously broken.

For example, the default audio setting when you sign in to the web video client is to connect using PHONE AUDIO. In case you figure out how to click the tab to use computer audio...it breaks down a couple of time in asking for browser permissions (camera, mic). It is unusually bad for something that is supposed to be that good.

there are all these articles about the comparisons - https://webrtchacks.com/zoom-avoids-using-webrtc/

https://bloggeek.me/webrtc-vs-zoom-video-quality/

hangouts still rules when it comes to web based video conferencing. And for countries with massive linux based usage (like India), Zoom is not a very viable option.

chrisfosterelli · 7 years ago

Not sure I follow the CORS angle. The linked stackoverflow question mostly seemed to be someone who was confused about how CORS works, and the issue in the Google Chrome tracker was closed as WontFix because they couldn't reproduce it and said it should work.

I'm nearly positive that CORS from localhost works OK. I set this up all the time for local development. For example, I run a client CRA app on localhost:3000 and an API on localhost:3001. The API sets the CORS headers and the CRA app can make requests to it.

If this is correct then I believe all Zoom needed to do is have their localhost application set CORS headers for their production domain. This would have allowed AJAX communication and only allowed it for Javascript running on their domain. Instead they did this totally hacky method that lets the whole world interact with the localhost server...

Maybe I missed something but if they could have done this the right way and didn't that is much worse IMO...

mychael · 7 years ago

It's pretty convenient for Zoom that this occurs after the IPO.

PixyMisa · 7 years ago

Zoom is why my shiny 27" Retina iMac is decorated with a small square of black electrical tape.

LeicaLatte · 7 years ago

Long live the App Store - developers, customers, Apple.

auscompgeek · 7 years ago

Zoom allow iframing the join page as well? Why are they not seeing X-Frame-Options‽

notmyname · 7 years ago

Here's a small script you can run to mitigate the issues described in the article: https://gist.github.com/notmyname/824db39350e3d39496de2ea930...

vinay_ys · 7 years ago

On my Mac, I have uBlockOrigin installed in my browser and I have it configured to always block 3rdparty and 3rdparty frames and it prevents both the POCs completely.

I have one browser that I use for work email and video conference, where system grants access to camera/microphone to the browser and browser allows Google Meet to access camera.

I have another browser where system does not grant access to any of the devices - camera, microphone, USB etc - and I use that for web surfing.

And I strictly don't install any plugins for video calls. I have refused to join meetings where people try to make me install random binary software on my machine. There's always phone call for such situations.

I feel better about dedicated apps on iPhone where again I can install and grant permissions before the call and then uninstall the app completely. On iPhone I don't do any web surfing. I have Firefox Focus for occasional emergencies to open the unknown web.

etaioinshrdlu · 7 years ago

Has anyone torn down recent-era Macbooks to see if the camera LED is still hardwired to the camera power and a reliable indicator that can't be software disabled?

gesman · 7 years ago

Nothing can beat piece of duct tape

whalesalad · 7 years ago

What blows my mind the most about all of this is how such a successful company has managed to engineer such a shitty solution to this very common problem. I’m not even speaking from a security standpoint (which is a catastrophe) but this feels like some holier than though neckbeard wanting to literally reinvent the wheel on everything. Encoding enum’s as images served from a local web server with various pixel widths??? You can’t make this up. I never liked their UX and now I guess I don’t like what’s under the hood either. Good riddance.

chachra · 7 years ago

Zoom's official response to this issue: https://assets.zoom.us/docs/pdf/Zoom+Response+Video-On+Vulne...

DVassallo · 7 years ago

It looks like it can also happen if you simply open an HTML email with Apple Mail: https://twitter.com/funjon/status/1148464952480374784

omk · 7 years ago

Hosting a web server on localhost is the equivalent of adding a backdoor on your customer's machines. How does a product team even reach this decision?

_-___________-_ · 7 years ago

I use uMatrix, and I've seen localhost show up as a domain a site tried to connect to quite a few times. I never gave it too much thought since I block all non-first-party resources by default anyway, but I now realise it could indicate the use of tricks like this to attempt to communicate with some other process running on my computer. I'll now make sure to look closer whenever I see this. I bet Zoom isn't the only one doing things like this.

rdl · 7 years ago

If you do this audio-only there isn’t a telltale LED on the camera to give away that you are doing it. I’m way more worried about audio bugging than a webcam (which really only has the user’s face)

franky47 · 7 years ago

No amount of security features can rival a small piece of black tape over the camera.

It also makes crypto-phishing (you've been recorded doing X, pay Y BTC) much harder to fall for. Where software could (and eventually will) be compromised, the attacker would have to physically access the machine to remove that tape.

shock · 7 years ago

> Apr 10, 2019 — Vulnerability disclosed to Chromium security team.

> Apr 19, 2019 — Vulnerability disclosed to Mozilla FireFox security team.

Does anyone have any idea why there was a 9 day delay between disclosure to Chromium and Firefox teams?

porker · 7 years ago

Why isn't the Windows client vulnerable? What have they/Microsoft done differently?

rahoulb · 7 years ago

I asked Zoom support about this and they sent me to this page: https://blog.zoom.us/wordpress/2019/07/08/response-to-video-...

The key thing here is they think this is a fair trade-off because Safari asks if you want to open Zoom.

> This is a workaround to a change introduced in Safari 12 that requires a user to confirm that they want to start the Zoom client prior to joining every meeting. The local web server enables users to avoid this extra click before joining every meeting. We feel that this is a legitimate solution to a poor user experience problem, enabling our users to have faster, one-click-to-join meetings. We are not alone among video conferencing providers in implementing this solution.

I do not believe that this is a fair trade-off given that any website can act on this locally installed server.

EDIT: I think they need to be made aware that this isn't acceptable. My reply to their support team: I do not believe this is a fair trade-off - allowing any arbitrary web site local control of privileged software installed on my machine - because Safari offers a security prompt (specifically so that any arbitrary web site does not gain control of privileged software on my machine). I will be switching ~/.zoomus/ZoomOpener.app off, and considering other options until it has been fixed.

StreamBright · 7 years ago

It is not possible to hack these:

https://www.amazon.com/HTR-WCB1-Web-Camera-Blocker/dp/B00595...

azernik · 7 years ago

The most damning part of the conclusions:

> This being said, I also recommend that any researcher that finds a vulnerability in Zoom’s software does not directly report the vulnerability to Zoom. Instead, I recommend that researchers report these vulnerabilities via the Zero Day Initiative (ZDI). The ZDI disclosure program gives vendors 120 days to resolve the vulnerability, the ZDI will pay researchers for their work, and researchers have the ability to publicly disclose their findings.

robinhouston · 7 years ago

Zoom’s response to this[1] is a wonderful example of how not to respond to security issues. It includes the classic tropes:

* Our users don’t care about security.

> Our video-first platform is a key benefit to our users around the world, and our customers have told us that they choose Zoom for our frictionless video communications experience.

* We have no way of knowing if this has been exploited in the wild, so it’s probably fine

> Also of note, we have no indication that this has ever happened.

* Other products have the same vulnerability

> We are not alone among video conferencing providers in implementing this solution.

* We decided not to fix it

> Ultimately, Zoom decided not to change the application functionality

And also a lovely one I haven’t seen before:

* We tried to buy the researcher’s silence, but he refused

> Upon his initial communication to Zoom, the researcher asked whether Zoom provides bounties for security vulnerability submissions. Zoom invited the researcher to join our private paid bug bounty program, which he declined because of non-disclosure terms. It is common industry practice to require non-disclosure for private bug bounty programs.

1. https://blog.zoom.us/wordpress/2019/07/08/response-to-video-...

mychael · 7 years ago

I've lost all trust in Zoom at this point

zongitsrinzler · 7 years ago

Does anyone know of any working alternatives? We use Zoom a lot, it has the most hideous UI and the worst UX but so far it's been the only video platform that reliably works with tens and hundreds of attendees.

_pmf_ · 7 years ago

> Our users don’t care about security.

They're not wrong. Empirically, users explicitly preferred Zoom because it lacked the "ask the user" step before starting a session. Less security is a user visible advantage.

craigds · 7 years ago

A few of our team had the Zoom app installed, but no-one had a running webserver on that port. None had used the app in a long time though.

Was this maybe added in a recent version, and perhaps they just haven't updated?

DanielleMolloy · 7 years ago

Most of the affected users won’t be able to uninstall the Zoom client in a clean way:

https://apple.stackexchange.com/questions/358651/unable-to-c...

I could not get rid of the client in my process list for weeks and regretted installing it.

I will try the fix mentioned at the end of the article now (first killing the webserver).

They will have a hard time regaining users trust.

EnderMB · 7 years ago

The sad thing is that Zoom will probably get away with not fixing this, or fixing it much later than they should.

If you look on Twitter, anyone that has complained about this (huge) vulnerability is being redirected back to their blog post.

To make things worse, most non-technical users that have caught onto these posts are replying to say "thanks for sorting it out!"

This wouldn't be the first time a company sweeps a data leak or vulnerability under the rug. I remember when the Panera Bread stuff kicked off, and all they had to do was bury their head in the sand and wait for the storm to pass. There's currently a lawsuit in progress, but will that happen for a vulnerability like this?

cjcampbell · 7 years ago

HIPAA provides an effective strategy for holding Zoom’s feet to the fire in cases like this. Since the company markets compliant video conferencing for healthcare professionals, they are classified as a Business Associate. It is quite likely that a well-written complaint on the HHS Office of Civil Rights site would result in further investigation and regulatory action.

lawrencegs · 7 years ago

"Additionally, if you’ve ever installed the Zoom client and then uninstalled it, you still have a localhost web server on your machine that will happily re-install the Zoom client for you, without requiring any user interaction on your behalf besides visiting a webpage. This re-install ‘feature’ continues to work to this day."

So... what's the best way to really really uninstall Zoom client from our Mac?

factorialboy · 7 years ago

Why don't people just use the web based Zoom client? I do this exclusively, have done so for a few months now.

One of the main features of a browser is to provide a secure runtime.

latexr · 7 years ago

Another small thing (big for me) Zoom does is register their app as the handler for `tel:` links every time you launch it, with seemingly no way to disable that. Companies that make themselves the default for something on your machine by force are not to be trusted.

I’m not surprised they start a web server from under their users, and that their response to the vulnerability was lacklustre.

feketegy · 7 years ago

Click on the app icon, hold, move to Trash.

maloga · 7 years ago

Btw Zoom is also reinstalling itself one minute after uninstalling it. Made a video of it here: https://news.ycombinator.com/item?id=20390755

mstade · 7 years ago

My job requires me to use zoom for communications – is there anyway I can run zoom in a container or something, so that when I kill the app all traces of it are gone?

michaelermer · 7 years ago

This is crazy, heres a video what happens after deleting and opening your URL. https://www.youtube.com/watch?v=DMY7Z9Fe0ic Before testing that I had the app itself removed months ago...

hidiegomariani · 7 years ago

Jesus Christ

Jedi72 · 7 years ago

Well, the company and product are dead to me now, gonna hassle our CTO to switch. I just really hope theres some dev at Zoom who hated this whole installing backdoors idea who's gonna have the greatest "I told you so" day at the office tomorrow.

douglasfshearer · 7 years ago

It appears that two of Zoom's competitors, Blue Jeans and Webex, also use web servers on localhost:

https://twitter.com/anthonypjshaw/status/1148470933901864960

phatfish · 7 years ago

These meeting apps feel like the browser plugins of the 2000's. There are so many that do almost the same thing they now resort to seriously insecure methods to make sure you have theirs installed and never remove it.

Apparently one less click is a competitive advantage, whatever the cost.

markwaldron · 7 years ago

If you're interested in seeing if you're vulnerable to this, visit this website: http://zoomzeroday.com

robbiemitchell · 7 years ago

Can’t Zoom add their own simple prompt to the local server which gets confirmation from the user that they want to join the meeting? Just one more click and not “nasty”.

It could even be 4 different Join buttons:

- Video & Audio

- Video Only

- Audio Only

- No Video or Audio

maxbaines · 7 years ago

Luckily I use Pi Hole I just Blacklisted zoom.us and zipow.com

exabrial · 7 years ago

What about Audio? Can this be used to exploit that as well?

ubermonkey · 7 years ago

The whole reinstallation thing freaked me out, since I did try Zoom a while back, but apparently my own uninstall process kept the reinstallation hack at bay.

By this I mean:

I have no local web server running on 19421; and

Your link doesn't launch or reinstall anything for me.

Now, something I do that most people probably don't is periodically check StartupItems as well as the LaunchAgents and LaunchDaemons folders, so I can remove anything left over.

I do not mean to trivialize this problem, because what Zoom has done here is egregious and unforgivable, BUT is it accurate to say that the reinstall behavior depends on

1, usage of Chrome and 2, the presence of a StartupItem / LaunchAgent / LaunchDaemon?

I ask because it didn't work for me, even though I still had the ~/.zoomus shit in place (obvs, I don't anymore).

I just want to make sure I understand it properly, and that I've taken the necessary steps to prevent Zoom's unwelcome return.

rafaelturk · 7 years ago

I've lost all trust in Zoom

fortran77 · 7 years ago

I'm surprised that Mac doesn't have a built-in firewall that warns if an app installs something that listens on a port. They advertise OSX as being "secure by design."

jontas · 7 years ago

Does this work in the Tor browser to launch the zoom client and expose your identity?

edited: after some research it is clear that this would work in the Tor browser. So if you are logged into Zoom using your real ID a malicious Tor site could launch the client and harvest your name. And if you are only using the browser bundle (and not routing all traffic through Tor) Zoom and/or Zoom+government could use this to expose the real IP of tor users.

dakom · 7 years ago

Would be interesting to see a list of software that installs a local server (http or otherwise) and whether or not it typically runs in the background on startup.

postit · 7 years ago

FYI: I was able to reproduce the issue with the Linux client as well.

cpncrunch · 7 years ago

The title is click-baity. What it allows is a website to automatically join you into a meeting with the camera enabled and without you asking. So it's annoying, but it doesn't let a website secretly grab your video without you knowing.

The reason webrtc has permissions per site is because webrtc can indeed grab your video without you realising, so it's important to give each site permission to use your camera. This isn't the case with zoom...it pops up a massive window when you enter the meeting.

briandear · 7 years ago

> Second, when Zoom is installed on a Mac device by the user, a limited-functionality web server that can only respond to requests from the local machine is also installed on the device. This is a workaround to a change introduced in Safari 12 that requires a user to confirm that they want to start the Zoom client prior to joining every meeting. The local web server enables users to avoid this extra click before joining every meeting. We feel that this is a legitimate solution to a poor user experience problem, enabling our users to have faster, one-click-to-join meetings. We are not alone among video conferencing providers in implementing this solution.

A workaround to legitimate Safari security improvements.

I hope the Wall Street Journal and CNBC skewer this company and shred the stock price.

jwr · 7 years ago

This is ridiculous. I am cancelling my Zoom subscription.

EastSmith · 7 years ago

Have been using Zoom for the last three yeara and I have recommended it to a lot of people.

Seeing how they handled this accident I will never recommend them again.

JangoSteve · 7 years ago

This is even crazier, because a webpage could load the iframe or img tag lazily, long after the page has been opened and is in the background because the user left the tab open, and the user would have no way of knowing which page is responsible for opening Zoom.

Furthermore, in Chrome, the webpage can set a timeout which brings the browser window back into focus. So for example, if Zoom usually takes about 1 second to open, then the browser could set the timeout for 1100ms, so that zoom is only visible to the user for a split second before it's backgrounded with their camera enabled. Either of the following will bring Chrome back to the foreground:

    setTimeout( function() { alert("Hi") }, 1100)

    setTimeout( function() { var win = window.open("https://www.google.com", '_blank'); win.focus(); window.close() }, 1100)

matthewbauer · 7 years ago

If you want to be taken seriously, don't include these dumb images in your post.

dickeytk · 7 years ago

I added this to my uBlock Origin filters and it has fixed it:

  ||localhost:19421^$all
  ||127.0.0.1:19421^$all

jshipc · 7 years ago

It looks like RingCentral phone / meeting service may be tied up in this also.

FTA, one step to clean this up is:

pkill "RingCentralOpener"; rm -rf ~/.ringcentralopener; touch ~/.ringcentralopener && chmod 000 ~/.ringcentralopener;

RingCentral and Zoom have a multiyear partnership.

https://www.ringcentral.com/whyringcentral/company/pressrele...

paultopia · 7 years ago

Do people who understand networking better than I do (i.e., almost everyone) want to explain how to universally prevent this localhost garbage? Like, some kind of firewall, combined with a simple command line trigger to open up a port when I actually want to? There's gotta be an open-source firewall for this kind of thing, right?

The notion that some random app can just spin up a server on localhost without my permission is completely insane. Also, this is why Gatekeeper, and the App Store "walled garden" are good---nothing should get the kind of permissions necessary to run a fucking localhost server that can reinstall a deleted app w/o user interaction!!

smarx007 · 7 years ago

Here is how I fixed the problem for myself temporarily:

1. Quit Zoom.

2. Kill the ZoomOpener process.

3. cd ~; mv .zoomus/ .zoomus.off/

4. mkdir .zoomus && sudo chown root .zoomus; sudo chmod 600 .zoomus

Now, the Safari permission prompt will show up every time you click on a Zoom link.

shawn-butler · 7 years ago

brew zap formula[0] worked for me to uninstall the listener..

brew update && brew cask zap -f zoomus

[0]: https://github.com/Homebrew/homebrew-cask/blob/master/Casks/...

lemax · 7 years ago

Zoom’s UX has always come off as invasive. An application default that allows hosts to enable automatic camera join is an overstep, and the lengths they go to facilitate this while ignoring long standing, industry standard appsec guidelines to prevent XSS is relatively unsurprising yet hopefully not inconsequential to their enterprise customers.

yellowapple · 7 years ago

This is thoroughly disappointing, given that Zoom is among the few popular conferencing programs that aren't complete garbage for Linux users. Thankfully the Linux client doesn't appear to be affected AFAICT, but this is trust-shattering nonetheless.

zsiddique · 7 years ago

Is anyone noticing that port `19421` no longer has anything listening on it? We are noticing some machines suddenly stop listening on this port but they have not downloaded any update. In zoom patching the running web server without user interaction?

bgentry · 7 years ago

In response to all of the well-deserved criticism, Zoom just made two updates to their blog post[1] to announce that they will be completely removing the webserver for all macOS users in a new release tonight, and also adding an option prompt going forward:

JULY 9 PATCH: The patch planned for tonight (July 9) at or before 12:00 AM PT will do the following: 1. Remove the local web server entirely, once the Zoom client has been updated – We are stopping the use of a local web server on Mac devices. Once the patch is deployed, Mac users will be prompted in the Zoom user interface (UI) to update their client. Once the update is complete, the local web server will be completely removed on that device. 2. Allow users to manually uninstall Zoom – We’re adding a new option to the Zoom menu bar that will allow users to manually and completely uninstall the Zoom client, including the local web server. Once the patch is deployed, a new menu option will appear that says, “Uninstall Zoom.” By clicking that button, Zoom will be completely removed from the user’s device along with the user’s saved settings.

PLANNED JULY RELEASE: Additionally, we have a planned release this weekend (July 12) that will address another security concern: video on by default. With this release: 1. First-time users who select the “Always turn off my video” box will automatically have their video preference saved. The selection will automatically be applied to the user’s Zoom client settings and their video will be OFF by default for all future meetings. 2. Returning users can update their video preferences and make video OFF by default at any time through the Zoom client settings.

Edit: the new version is now released at https://zoom.us/download

[1]: https://blog.zoom.us/wordpress/2019/07/08/response-to-video-...

hidiegomariani · 7 years ago

https://twitter.com/FiloSottile/status/1148587616243204096

b212 · 7 years ago

I'd be really happy to see:

a) Apple removing Zoom from the App Store (at least for a fixed amount of time before they patch* this nightmare up), b) releasing an update to MacOS that breaks Zoom's server completely (I know, I'm asking for too much here).

*talking about patching is a bit exaggeration here because this is not a bug this is a fucking trojan disguised as conferencing app, I'd truly truly block them from App Store for that, as a fellow developer I'm writing this with heavy heart but the incompetency of Zooms developers is enormous here, CEO can say anything he want but I'm pretty much sure it's impossible he was not aware of the fact how the core of his product works. It's not even unethical, you really have to have no imagination to do something like this.

Also - there's a different issue - Macs seem to be pretty solid when it comes to security but looks like ANY installer can just spin up web severs on our machines and we won't even know? I'm just a simple developer, not a devops, how can I prevent this in happening in the future? If they did it once they will do it again. And if not them then someone else. Any hints? Should I scan my ports every morning and see what can go through every single one of them?

migueltarga · 7 years ago

I just got an update! Good job Jonathan Leitschuh!

Release notes of 4.4.53932.0709:

Remove local web server

-We are discontinuing the use of a local web server on Mac devices. Following the update, the local web server will be completely removed from the Zoom installation Option to uninstall Zoom

-Zoom users can now uninstall the Zoom desktop application and all of its components through the settings menu

kccqzy · 7 years ago

The first time I installed Zoom, I opened up a pkg (an Installer package) and Installer said this package wanted to run a script to determine whether or not it can be installed. Usually this is for checking system version or some other harmless action. But for Zoom, this script immediately installed Zoom itself. I immediately thought something fishy was going on.

ronbeltran · 7 years ago

I have Zoom installed on my Ubuntu 16.04 and its also vulnerable.

https://jlleitschuh.org/zoom_vulnerability_poc/zoompwn_ifram...

technobrat · 7 years ago

One thing they were right about was this being "Standard Practice". Even spotify is doing it https://twitter.com/braintube/status/1148645026936827905.

So how does one remove these from their machine ? I can kill the process but it will just start again when I restart the machine. Also how do they do this ? I thought all startup items will be shown under Login Items in System Preferences.

llacb47 · 7 years ago

Might also affect Discord

devin · 7 years ago

Blown out of proportion. A real vulnerability I wish was handled more seriously. But at the same time, even after I “fixed” the vulnerability, my preference in Chrome to always open links for zoom, with zoom, made it nonsense. The problem is with lax browser security and CORS as a product “feature”.

It is worth underscoring that the only reason this vulnerability exists is because Safari forced appropriate prompts? Zoom hacked around it, and got away with it. That’s on browsers to fix.

abvdasker · 7 years ago

I always thought it was paranoid to keep tape over your webcam, but this makes a pretty good case for doing that as a last line of defense.

I also want to express my complete disbelief that Zoom basically installed a back door on all its users' machines. It's hard to imagine a competent engineer not understanding the security implications of building something like this. I have no special security expertise, so when I see an exploit that I can actually understand it scares the living daylights out of me. In this case just about anyone with a web page can trigger this Zoom vulnerability.

xtat · 7 years ago

just came to say: lol

mystcb · 7 years ago

> [UPDATE 2:35 pm PT, Tuesday 7/9] The July 9 patch to the Zoom app on Mac devices detailed below is now live. You may see a pop-up in Zoom to update your client, download it at zoom.us/download, or check for updates by opening your Zoom app window, clicking zoom.us in the top left corner of your screen, and then clicking Check for Updates.

--

Looks like Zoom have decided to remove the Web Server from MAC and pushed out an update directly to the clients (before this, you couldn't get the Zoom Client to check for updates automatically) - The popup appeared post meeting.

https://imgur.com/gallery/INvYaH4

nonoesp · 7 years ago

I just received this message prompting me to "Update now."

Release notes of 4.4.53932.0709:

## Remove local web server

- We are discontinuing the use of a local web server on Mac devices. Following the update, the local web server will be completely removed from the Zoom installation Option to uninstall Zoom

- Zoom users can now uninstall the Zoom desktop application and all of its components through the settings menu

FiroSolutions · 7 years ago

They responded not to fix it which is unusual

https://blog.firosolutions.com/exploits/zoomtozero/

rezeroed · 7 years ago

I don't even know why laptops have cameras. Do you really need to see someone for a conversation? Mine's permanently taped.

uglycoyote · 6 years ago

Searching my Macbook using to see if I have this on my machine using lsof, I found that I did not have it. But there is a suspicious "Adobe Desktop Service" listening on localhost:15292. I wonder what sort of fun things that would enable a random website to run on my machine. I don't even use Abode products, willingly, on this machine. Though I probably have installed at least one in the past.

I'm no infosec expert, If I wanted to figure out more about what this process was up to, how would I go about it?

throwaway84392 · 6 years ago

If you must use Zoom and you use GNU/Linux, run it under firejail.

With firejail you can sandbox anything.

cf512 · 6 years ago

Apologies in advance if someone has already commented about this, but it would appear that Zoom removed that local web server feature for the MacOS version a few days ago:

---

Current Release July 9, 2019 Version 4.4.53932.0709

New and Enhanced Features

-General Features

--Option to uninstall Zoom Zoom users can now uninstall the Zoom application and all of its components through the settings menu.

-Resolved Issues

--Removal of the local web server Zoom will be discontinuing the use of a local web server on Mac and will be completely removed from the Zoom installation. --Minor Bug Fixes (https://support.zoom.us/hc/en-us/articles/201361963-New-Upda...)