|
droll posted:So if they're WFH on an enterprise Win 10 machine, the attacker that owns/listens on 420.69.13.13 now has your password? This attack would work if someone clicked the link on a website though, not just from a Zoom chat?
|
#
?
Apr 2, 2020 20:29
|
|
|
|
| # ? May 7, 2024 11:59 |
|
|
Combat Pretzel posted:Minix is Intel. What does AMD run? MAXix
|
|
#
?
Apr 2, 2020 20:35
|
|
|
evil_bunnY posted:They have your hash, which they can then reuse. What is unique about Zoom though that makes this exploit work vs. say a website or email containing the same UNC path \\hyperlink and a user being enticed to click on it?
|
|
#
?
Apr 2, 2020 21:17
|
|
|
Nothing. The zoom code apparently tried to limit to http/s URLs even but the Windows call they used always permits UNC regardless of the protocols specified.
|
|
#
?
Apr 2, 2020 21:20
|
|
|
The UNC bug I found a bit odd (but kudos for fixing it), but the privilege trampoline on osx as part of their installation package is a lot worse. Still needs someone to have unprivileged local access of course in order to use it, but come on.
|
|
#
?
Apr 2, 2020 21:27
|
|
|
Combat Pretzel posted:Minix is Intel. What does AMD run? However, despite the stuff identified by CTS Labs (under suspicious circumstances), and independently verified by the well-established TrailofBits team - the latter pointed out that it's still very much in line with the threat model of The Mossad doing Mossad things invariably leading to "YOU’RE STILL GONNA BE MOSSAD’ED UPON" as James Mickens so delightfully puts it.
|
|
#
?
Apr 2, 2020 22:23
|
|
|
Subjunctive posted:Nothing. The zoom code apparently tried to limit to http/s URLs even but the Windows call they used always permits UNC regardless of the protocols specified. They just pushed an update that supposedly fixes the UNC issue. Got that when I fired up Zoom this morning.
|
|
#
?
Apr 3, 2020 17:32
|
|
|
Darchangel posted:They just pushed an update that supposedly fixes the UNC issue. Got that when I fired up Zoom this morning. They released an updated client 2 days ago. I know this because I had to push it out.
|
|
#
?
Apr 3, 2020 17:36
|
|
|
droll posted:They released an updated client 2 days ago. I know this because I had to push it out. Ah, I guess we just pushed it, then. I’m not on that side of things (yet).
|
|
#
?
Apr 3, 2020 17:54
|
|
|
loving amateur hour here https://twitter.com/lauracgodfrey/status/1247513615487426565
|
|
#
?
Apr 7, 2020 14:22
|
|
|
Yeah that jumped out at me instantly when I saw an invite link but what else are you gonna do when the audience list is non-authenticated consumers? You have to distribute the password and it's just going to be in the same email as the meeting URL. My daughter uses it with her vocal teacher. There isn't any other way that a music teacher is going to share a password with dozens of students right now, a small music school isn't going to have a worthwhile user registration system (would probably be a bigger gently caress up than this), and she's under 13 so it's against TOU at most would-be external identity providers for her to have an account. Now if it turns out the embedded value is easily reversed to a user-chosen password by the meeting owner that they probably also use for their bank's website, it'll certainly be a laugh (and I'll have some friendly suggestions to send out), but I'm not about to touch that poop.
|
|
#
?
Apr 7, 2020 16:50
|
|
|
The password is just more numbers. They do some conversion before including it in the URL.
|
|
#
?
Apr 7, 2020 17:00
|
|
|
Absurd Alhazred posted:loving amateur hour here So, there are two models for meeting invites: - you specifically invite a set of people, and only they get invitations - you publish a URL and anyone with the URL can join the password is a defence against wardialing of the 10-digit numbers; "nonce" might be a better name. zoom's meeting code + password is equivalent here to hangout's meeting URL, because hangouts generates better random meeting IDs. I would not be surprised to see zoom switch to a bigger ID space too, but the model would then be basically the same as with passwords enabled if you want only certain people in the meeting, you either send only them the URL (the most common use case), or you filter using some pre-join thing like zoom's waiting room. for both hangouts and zoom, afaik, if someone gets the full URL they can join (this is the classroom raiding "attack"). you can disable putting the password in the URL with a thing in settings, but it's not clear to me why someone would ever share the URL and not the matching password, whether their intentions are malicious or benign. in zoom you can also require that people authenticate to an account matching your domain, so schools could do that to have account info for the cases where students were disruptive, and prevent non-students from joining. I don't think there's an equivalent mechanism in hangouts, but I haven't looked very deeply I don't think there's anything really wrong with what they're doing here with the URLs. Zoom's made some bad security choices for sure, but I don't think this is one of them. I certainly might be missing something amateurish.
|
|
#
?
Apr 7, 2020 17:14
|
|
|
^ Right. The Zoom password prevents war dialing zoom meetings to steal metadata and reduce the amount of 'zoombombing': https://krebsonsecurity.com/2020/04/war-dialing-tool-exposes-zooms-password-problems/
|
|
#
?
Apr 7, 2020 18:50
|
|
|
this, for example, is amateurish and dangerous https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/
|
|
#
?
Apr 7, 2020 20:28
|
|
|
Subjunctive posted:this, for example, is amateurish and dangerous As a European, it's hilarious to see Americans freaking out about some code being developed/some certificates being issued from China. We've been dealing with American NSA poo poo for years so for us it's more of the same. It hurts when somebody else does it, doesn't it?
|
|
#
?
Apr 7, 2020 23:53
|
|
|
Subjunctive posted:this, for example, is amateurish and dangerous I can't remember, but there was some sort of thing this thread says about rolling your own crypto. I can't remember for the life of me, was it, always roll your own?
|
|
#
?
Apr 8, 2020 01:23
|
|
|
Guy Axlerod posted:The password is just more numbers. They do some conversion before including it in the URL. Are they consistently the same numbers, or does it use your password to generate a different series of numbers every time? Because if its the former, seems like you could use that to figure out someones actual password.
|
|
#
?
Apr 8, 2020 02:43
|
|
|
RFC2324 posted:Are they consistently the same numbers, or does it use your password to generate a different series of numbers every time? Because if its the former, seems like you could use that to figure out someones actual password. The latter, it’s random. I mean, I don’t know if it’s Random, but it’s definitely not the same each time. Furism posted:As a European, it's hilarious to see Americans freaking out about some code being developed/some certificates being issued from China. We've been dealing with American NSA poo poo for years so for us it's more of the same. I’m less worried about Chinese transit and more about them... Defenestrategy posted:I can't remember, but there was some sort of thing this thread says about rolling your own crypto. I can't remember for the life of me, was it, always roll your own? Yeah, roll your own crypto or attackers can see how it works!
|
|
#
?
Apr 8, 2020 02:53
|
|
|
RFC2324 posted:Because if its the former, seems like you could use that to figure out someones actual password. Rainbow tables exist (and it would be poor design for other reasons), but a worry about going backwards from hash to password isn't really one of them. Of course it would only mildly surprise me to find out that Zoom is using some reversible method for the passwords, but hashing libraries are trivial enough to use that I doubt even they would screw that up* *famous last words
|
|
#
?
Apr 8, 2020 03:28
|
|
|
How viscerally offensive would it be to SHA1-hash a password 100,000 times to send it to a database server to be bcrypted for storage if your threat model is "bored 13-year-olds," on a scale of "disappointed in you" to "crimes against data"?
|
|
#
?
Apr 8, 2020 05:57
|
|
|
are the 13 year olds mossad agents or no?
|
|
#
?
Apr 8, 2020 07:11
|
|
|
Subjunctive posted:Nothing. The zoom code apparently tried to limit to http/s URLs even but the Windows call they used always permits UNC regardless of the protocols specified.
|
|
#
?
Apr 8, 2020 09:46
|
|
|
Cup Runneth Over posted:How viscerally offensive would it be to SHA1-hash a password 100,000 times to send it to a database server to be bcrypted for storage if your threat model is "bored 13-year-olds," on a scale of "disappointed in you" to "crimes against data"? This is not very far from any passwords stretching method, so yeah not terrible, but also not great. But why don't you just use pbkdf2 or {b,s}crypt and let something do this for you
|
|
#
?
Apr 8, 2020 10:26
|
|
|
geonetix posted:This is not very far from any passwords stretching method, so yeah not terrible, but also not great. But why don't you just use pbkdf2 or {b,s}crypt and let something do this for you It's "only" linear scaling but at least this way if you combine key material with a TPM, it seems unlikely that you can just take the installation to a much faster processor and break it that way. Although by the time pbkdf2 can be decrypted by a regular processor, there'll probably have been found plenty of problems with pbkdf2.
|
|
#
?
Apr 8, 2020 13:49
|
|
|
geonetix posted:This is not very far from any passwords stretching method, so yeah not terrible, but also not great. But why don't you just use pbkdf2 or {b,s}crypt and let something do this for you No libraries available in the language
|
|
#
?
Apr 8, 2020 13:51
|
|
|
Cup Runneth Over posted:No libraries available in the language
|
|
#
?
Apr 8, 2020 14:25
|
|
|
So BlackBerry...Yes, you heard me BlackBerry is now a CyberSecurity company and has discovered an evidence that a China sponsored hacking group has obtained access to certs and are using this to possibly steal data. https://www.blackberry.com/ca/en/co...by-chinese-apts
|
|
#
?
Apr 8, 2020 15:59
|
|
|
D. Ebdrup posted:The way the number of rounds for a FDE key in FreeBSD is chosen is to test how many rounds it takes until decryption takes 2 seconds to do with the pbkdf2 function - which itself can easily be replaced. While on the subject of FDE in FreeBSD, is there anything comparable to Network-Bound Disk Encryption on Linux on FreeBSD? Trying to roll out more FDE without needing remote hands or someone to console in and type a password to unlock.
|
|
#
?
Apr 8, 2020 19:30
|
|
|
Hed posted:While on the subject of FDE in FreeBSD, is there anything comparable to Network-Bound Disk Encryption on Linux on FreeBSD? Trying to roll out more FDE without needing remote hands or someone to console in and type a password to unlock.
|
|
#
?
Apr 8, 2020 22:03
|
|
|
D. Ebdrup posted:There's a bunch of stuff that plugs into PAM, including pam_mount, pam_script, and pam_restrict which should make it doable - but I'm surprised RedHat aren't using PAM for this, since it's exactly what PAM is for, and you know, it's a thing that exists in Linux too. would it be linux if the wheel were not constantly being reinvented?
|
|
#
?
Apr 9, 2020 02:02
|
|
|
RFC2324 posted:would it be linux if the wheel were not constantly being reinvented? 
|
|
#
?
Apr 9, 2020 08:19
|
|
|
 https://medium.com/@s3c/how-i-hacked-worldwide-zoom-users-eafdff94077d
|
|
#
?
Apr 9, 2020 14:48
|
|
|
holy poo poo that is pants on head special
|
|
#
?
Apr 9, 2020 16:02
|
|
|
Amazing
|
|
#
?
Apr 9, 2020 16:03
|
|
|
Prefect example of just rushing a product or update out the door with minimal testing
|
|
#
?
Apr 9, 2020 16:05
|
|
|
I'm sure Alex "yahoo and facebook" Stamos is going to save them from this
|
|
#
?
Apr 9, 2020 16:06
|
|
|
the no-effort shitpost style of the writeup is perfectly matched with the no-effort stupidity of the bug 
|
|
#
?
Apr 9, 2020 17:21
|
|
|
Klyith posted:the no-effort shitpost style of the writeup is perfectly matched with the no-effort stupidity of the bug it looks a lot more like a barely-english-speaker considering the right aligned text than an intentional shitpost
|
|
#
?
Apr 9, 2020 18:08
|
|
|
|
| # ? May 7, 2024 11:59 |
|
|
Seems like he took down or hid the post, can't view it anymore.
|
|
#
?
Apr 11, 2020 02:16
|
|
