A vulnerability in Zoom's Windows client could let attackers steal Windows login credentials of users who click on malicious links in chat messages
without Zoom asking for their permission or even notifying them that someone else was snooping on them https://www.nytimes.com/... Rogue P. Bigham / @jeffbigham : there's a lesson here... not sure what that lesson is yet, but there's a lesson — “Privacy experts said the company seemed to value ease of use ... over instituting default user protections.” https://www.nytimes.com/... Troy Hunt / @troyhunt : The good news is that flaw only impacts Mac users. The bad news is that this one impacts PC users: https://arstechnica.com/... Mike Elgan / @mikeelgan : Why is everyone using Zoom? Why is anyone using Zoom? https://twitter.com/... Amit Serper / @0xamit : 1. Link has to be clicked 2. Meeting has to be public for someone malicious to even join and post the link (which should probably be your in threat model anyhow) 3. This is how windows explorer works, it's vulnerable as well Conclusion: Stop using windows. #IHaveOpinions https://twitter.com/... Nilay Patel / @reckless : The biggest question facing Zoom is whether these gaffes are move-fast-break-things mistakes, or reflective of a deeper culture of disrespect for user privacy. Or... both. https://www.theverge.com/...
Hi @zoom_us & @NCSC - here is an example of exploiting the Zoom Windows client using UNC path injection to expose credentials for use in SMBRelay attacks. The screen shot below shows an example UNC path link and the credentials being exposed (redacted). https://twitter.com/...
Zoom, the videoconferencing app, said today that it would turn off a data-mining feature that could be used to snoop on meeting participants after inquiries from The Times https://www.nytimes.com/...
Until today, a feature on Zoom allowed some participants to access LinkedIn profile data about other users — without Zoom asking for their permission or even notifying them that someone else was snooping on them https://www.nytimes.com/...
there's a lesson here... not sure what that lesson is yet, but there's a lesson — “Privacy experts said the company seemed to value ease of use ... over instituting default user protections.” https://www.nytimes.com/...
1. Link has to be clicked 2. Meeting has to be public for someone malicious to even join and post the link (which should probably be your in threat model anyhow) 3. This is how windows explorer works, it's vulnerable as well Conclusion: Stop using windows. #IHaveOpinions https://…
The biggest question facing Zoom is whether these gaffes are move-fast-break-things mistakes, or reflective of a deeper culture of disrespect for user privacy. Or... both. https://www.theverge.com/...