Re: [Gnso-newgtld-wg] Please specify & Clarify is My Privacy at Risk?
Dear Priscillia, I appreciate your response. But this is too little and too late. If there was a Vulnerability, why were we not informed earlier as a customer / User. Secondly, I will need to understand what is the extent of this vulnerability. By Saying “Low risk Vulnerability” it is clearly showing that you are not willing to elucidate and want to either brush it under the carpet or ignore or underplay the risk. This is a mandatory disclosure you need to do as it is my privacy at stake. This is Super Important. Regards, -VA
On Jul 10, 2019, at 2:44 AM, Priscilla McCarthy <priscilla.barolo@zoom.us> wrote:
Hi there Vaibhav, Thank you for your email. These are low-risk vulnerabilities that apply only to Mac users, and we have drafted a blog post discussing them. We are updating our service tonight and this coming weekend. When you see prompted updates, you should update your Zoom app to ensure your security. Here is more information: https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/ <https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/> Thank you! <https://zoom.us/> Priscilla Barolo Manager, Communications Zoom Video Communications Call 650-438-9456 <tel:650-438-9456> | Click zoom.us <https://zoom.us/> | Zoom 650-438-9456 <http://zoom.us/j/650-438-9456> <http://www.facebook.com/zoomvideocommunications> <http://www.twitter.com/zoom_us> <http://www.linkedin.com/company/zoom-video-communications-inc-/> <https://zoom.us/referrals>
<https://smart.zoom.us/v2/a/zoomtopia19/5d2503c401ca44fa0d942282-OjqXg/httpsz...>
On Tue, Jul 9, 2019 at 12:20 PM Vaibhav Aggarwal <va@thevaibhav.com <mailto:va@thevaibhav.com>> wrote: Dear Eric,
I am in receipt of this following email content :
Hey - remember when ICANN switched everyone from Adobe over to Zoom as a way of enhancing information security and data privacy?
"A vulnerability in the Mac Zoom Client allows any malicious website to enable your camera without your permission... This vulnerability allows any website to forcibly join a user to a Zoom call, with their video camera activated, without the user's permission. On top of this, this vulnerability would have allowed any webpage to DOS (Denial of Service) a Mac by repeatedly joining a user to an invalid call. Additionally, if you’ve ever installed the Zoom client and then uninstalled it, you still have a localhost web server on your machine that will happily re-install the Zoom client for you, without requiring any user interaction on your behalf besides visiting a webpage. This re-install ‘feature’ continues to work to this day."
Read more here: https://medium.com/@jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe... <https://medium.com/@jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe...>
Please Clarify if my privacy at risk. And the steps taken to protect my privacy.
Regards,
Vaibhav Aggarwal New Delhi, India vaibhavaggarwal.com <http://vaibhavaggarwal.com/> twitter.com/thevaibhag <http://twitter.com/thevaibhag> youtube.com/+vaibhavaggarwalindia <http://youtube.com/+vaibhavaggarwalindia>
VA, It's customary in the information security practice to not disclose vulnerabilities before a solution is provided by the software author, in order to better serve public interest. And this process was followed in this case by both the security researcher that identified it and Zoom and Zoom itself, but in the end it was clear that Zoom was not willing to change the architecture to really solve the problem. That made the security researcher disclose the vulnerability at the end of the customary 3-month period, which forced Zoom's hand and starting version 4.4.4 release 53932 it seems to be solved now. See https://support.zoom.us/hc/en-us/articles/201361963-New-Updates-for-Mac-OS <https://support.zoom.us/hc/en-us/articles/201361963-New-Updates-for-Mac-OS> . You can read more about responsible disclosure in https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Vulnerabil... <https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Vulnerabil...> . Zoom trying to downplay the severity of this vulnerability is indeed a problem; it was not low risk, and their attitude of thinking that prevented they fixed it in time, requiring a 0-day attack to be disclosed before they actually plugged the hole. Fixing people is harder than fixing software, and the handling of this does not bring any confidence to how they will handle other vulnerabilities in the future. The full recap published by the security researcher is worth reading: https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an... <https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an...> Rubens
On 10 Jul 2019, at 01:47, Vaibhav Aggarwal, Catalyst & Group CEO <va@bladebrains.com> wrote:
Dear Priscillia,
I appreciate your response. But this is too little and too late. If there was a Vulnerability, why were we not informed earlier as a customer / User. Secondly, I will need to understand what is the extent of this vulnerability. By Saying “Low risk Vulnerability” it is clearly showing that you are not willing to elucidate and want to either brush it under the carpet or ignore or underplay the risk.
This is a mandatory disclosure you need to do as it is my privacy at stake. This is Super Important.
Regards, -VA
On Jul 10, 2019, at 2:44 AM, Priscilla McCarthy <priscilla.barolo@zoom.us <mailto:priscilla.barolo@zoom.us>> wrote:
Hi there Vaibhav, Thank you for your email. These are low-risk vulnerabilities that apply only to Mac users, and we have drafted a blog post discussing them. We are updating our service tonight and this coming weekend. When you see prompted updates, you should update your Zoom app to ensure your security. Here is more information: https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/ <https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/> Thank you! <https://zoom.us/> Priscilla Barolo Manager, Communications Zoom Video Communications Call 650-438-9456 <tel:650-438-9456> | Click zoom.us <https://zoom.us/> | Zoom 650-438-9456 <http://zoom.us/j/650-438-9456> <http://www.facebook.com/zoomvideocommunications> <http://www.twitter.com/zoom_us> <http://www.linkedin.com/company/zoom-video-communications-inc-/> <https://zoom.us/referrals>
<https://smart.zoom.us/v2/a/zoomtopia19/5d2503c401ca44fa0d942282-OjqXg/httpsz...>
On Tue, Jul 9, 2019 at 12:20 PM Vaibhav Aggarwal <va@thevaibhav.com <mailto:va@thevaibhav.com>> wrote: Dear Eric,
I am in receipt of this following email content :
Hey - remember when ICANN switched everyone from Adobe over to Zoom as a way of enhancing information security and data privacy?
"A vulnerability in the Mac Zoom Client allows any malicious website to enable your camera without your permission... This vulnerability allows any website to forcibly join a user to a Zoom call, with their video camera activated, without the user's permission. On top of this, this vulnerability would have allowed any webpage to DOS (Denial of Service) a Mac by repeatedly joining a user to an invalid call. Additionally, if you’ve ever installed the Zoom client and then uninstalled it, you still have a localhost web server on your machine that will happily re-install the Zoom client for you, without requiring any user interaction on your behalf besides visiting a webpage. This re-install ‘feature’ continues to work to this day."
Read more here: https://medium.com/@jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe... <https://medium.com/@jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe...>
Please Clarify if my privacy at risk. And the steps taken to protect my privacy.
Regards,
Vaibhav Aggarwal New Delhi, India vaibhavaggarwal.com <http://vaibhavaggarwal.com/> twitter.com/thevaibhag <http://twitter.com/thevaibhag> youtube.com/+vaibhavaggarwalindia <http://youtube.com/+vaibhavaggarwalindia>
_______________________________________________ Gnso-newgtld-wg mailing list Gnso-newgtld-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-newgtld-wg _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
Hi Rubens, OMG. And do we have to do anything, or is Zoom updating the software (Windows; Android) automatically? Do we need to “patch” smth, delete the application and reinstall? (I for example do not use Mac/Apple – only Android and Windows). Thanks for the warning, Alexander From: Gnso-newgtld-wg [mailto:gnso-newgtld-wg-bounces@icann.org] On Behalf Of Rubens Kuhl Sent: Wednesday, July 10, 2019 1:50 PM To: Vaibhav Aggarwal, Catalyst & Group CEO <va@bladebrains.com> Cc: goran.marby@icann.org; ericsyuan2011@gmail.com; Priscilla McCarthy <priscilla.barolo@zoom.us>; Dorrain, Kristine via Gnso-newgtld-wg <gnso-newgtld-wg@icann.org>; Zoom Press <press@zoom.us> Subject: Re: [Gnso-newgtld-wg] Please specify & Clarify is My Privacy at Risk? VA, It's customary in the information security practice to not disclose vulnerabilities before a solution is provided by the software author, in order to better serve public interest. And this process was followed in this case by both the security researcher that identified it and Zoom and Zoom itself, but in the end it was clear that Zoom was not willing to change the architecture to really solve the problem. That made the security researcher disclose the vulnerability at the end of the customary 3-month period, which forced Zoom's hand and starting version 4.4.4 release 53932 it seems to be solved now. See https://support.zoom.us/hc/en-us/articles/201361963-New-Updates-for-Mac-OS . You can read more about responsible disclosure in https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Vulnerabil... . Zoom trying to downplay the severity of this vulnerability is indeed a problem; it was not low risk, and their attitude of thinking that prevented they fixed it in time, requiring a 0-day attack to be disclosed before they actually plugged the hole. Fixing people is harder than fixing software, and the handling of this does not bring any confidence to how they will handle other vulnerabilities in the future. The full recap published by the security researcher is worth reading: https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an... Rubens On 10 Jul 2019, at 01:47, Vaibhav Aggarwal, Catalyst & Group CEO <va@bladebrains.com <mailto:va@bladebrains.com> > wrote: Dear Priscillia, I appreciate your response. But this is too little and too late. If there was a Vulnerability, why were we not informed earlier as a customer / User. Secondly, I will need to understand what is the extent of this vulnerability. By Saying “Low risk Vulnerability” it is clearly showing that you are not willing to elucidate and want to either brush it under the carpet or ignore or underplay the risk. This is a mandatory disclosure you need to do as it is my privacy at stake. This is Super Important. Regards, -VA On Jul 10, 2019, at 2:44 AM, Priscilla McCarthy <priscilla.barolo@zoom.us <mailto:priscilla.barolo@zoom.us> > wrote: Hi there Vaibhav, Thank you for your email. These are low-risk vulnerabilities that apply only to Mac users, and we have drafted a blog post discussing them. We are updating our service tonight and this coming weekend. When you see prompted updates, you should update your Zoom app to ensure your security. Here is more information: https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/ Thank you! <https://zoom.us/> Priscilla Barolo Manager, Communications Zoom Video Communications Call <tel:650-438-9456> 650-438-9456 | Click <https://zoom.us/> zoom.us | Zoom <http://zoom.us/j/650-438-9456> 650-438-9456 <http://www.facebook.com/zoomvideocommunications> <http://www.twitter.com/zoom_us> <http://www.linkedin.com/company/zoom-video-communications-inc-/> <https://zoom.us/referrals> <https://smart.zoom.us/v2/imagebucket/zoom.us/1x1.png> <https://smart.zoom.us/v2/imagebucket/zoom.us/1x1.png> <https://smart.zoom.us/v2/imagebucket/zoom.us/1x1.png> <https://smart.zoom.us/v2/a/zoomtopia19/5d2503c401ca44fa0d942282-OjqXg/httpsz...> On Tue, Jul 9, 2019 at 12:20 PM Vaibhav Aggarwal <va@thevaibhav.com <mailto:va@thevaibhav.com> > wrote: Dear Eric, I am in receipt of this following email content : Hey - remember when ICANN switched everyone from Adobe over to Zoom as a way of enhancing information security and data privacy? "A vulnerability in the Mac Zoom Client allows any malicious website to enable your camera without your permission... This vulnerability allows any website to forcibly join a user to a Zoom call, with their video camera activated, without the user's permission. On top of this, this vulnerability would have allowed any webpage to DOS (Denial of Service) a Mac by repeatedly joining a user to an invalid call. Additionally, if you’ve ever installed the Zoom client and then uninstalled it, you still have a localhost web server on your machine that will happily re-install the Zoom client for you, without requiring any user interaction on your behalf besides visiting a webpage. This re-install ‘feature’ continues to work to this day." Read more here: https://medium.com/@jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe... Please Clarify if my privacy at risk. And the steps taken to protect my privacy. Regards, Vaibhav Aggarwal New Delhi, India vaibhavaggarwal.com <http://vaibhavaggarwal.com/> twitter.com/thevaibhag <http://twitter.com/thevaibhag> youtube.com/+vaibhavaggarwalindia <http://youtube.com/+vaibhavaggarwalindia> _______________________________________________ Gnso-newgtld-wg mailing list Gnso-newgtld-wg@icann.org <mailto:Gnso-newgtld-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-newgtld-wg _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
On 10 Jul 2019, at 08:47, Alexander Schubert <alexander@schubert.berlin> wrote:
Hi Rubens,
OMG. And do we have to do anything, or is Zoom updating the software (Windows; Android) automatically? Do we need to “patch” smth, delete the application and reinstall? (I for example do not use Mac/Apple – only Android and Windows).
In my case I needed to use the "Check for Updates" menu option. If you don't use Mac this vulnerability doesn't apply to you, only the overall attitude from them towards security management. Rubens
It might be fixed with a simple physical measures (like sticker paper), so there is no need to worry. Sincerely Yours, Maxim Alzoba Special projects manager, International Relations Department, FAITID Current UTC offset: +3.00 (.Moscow)
On 10 Jul 2019, at 14:51, Rubens Kuhl <rubensk@nic.br> wrote:
On 10 Jul 2019, at 08:47, Alexander Schubert <alexander@schubert.berlin <mailto:alexander@schubert.berlin>> wrote:
Hi Rubens,
OMG. And do we have to do anything, or is Zoom updating the software (Windows; Android) automatically? Do we need to “patch” smth, delete the application and reinstall? (I for example do not use Mac/Apple – only Android and Windows).
In my case I needed to use the "Check for Updates" menu option. If you don't use Mac this vulnerability doesn't apply to you, only the overall attitude from them towards security management.
Rubens
_______________________________________________ Gnso-newgtld-wg mailing list Gnso-newgtld-wg@icann.org https://mm.icann.org/mailman/listinfo/gnso-newgtld-wg _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5 <https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an...> Well, that’s rather more than I can take on board today. Is it something to do with zoom migrating to DNS over HTTPS (DoH) - ? Just to add that members of this household who choose not to employ video have developed an effective workaround in the form of a small sticker (e.g. half a postage stamp) which obscures the webcam lens. Problem solved? Just a thought. ;=)) CW
On 10 Jul 2019, at 13:47, Alexander Schubert <alexander@schubert.berlin <mailto:alexander@schubert.berlin>> wrote:
Hi Rubens,
OMG. And do we have to do anything, or is Zoom updating the software (Windows; Android) automatically? Do we need to “patch” smth, delete the application and reinstall? (I for example do not use Mac/Apple – only Android and Windows).
Thanks for the warning,
Alexander
From: Gnso-newgtld-wg [mailto:gnso-newgtld-wg-bounces@icann.org <mailto:gnso-newgtld-wg-bounces@icann.org>] On Behalf Of Rubens Kuhl Sent: Wednesday, July 10, 2019 1:50 PM To: Vaibhav Aggarwal, Catalyst & Group CEO <va@bladebrains.com <mailto:va@bladebrains.com>> Cc: goran.marby@icann.org <mailto:goran.marby@icann.org>; ericsyuan2011@gmail.com <mailto:ericsyuan2011@gmail.com>; Priscilla McCarthy <priscilla.barolo@zoom.us <mailto:priscilla.barolo@zoom.us>>; Dorrain, Kristine via Gnso-newgtld-wg <gnso-newgtld-wg@icann.org <mailto:gnso-newgtld-wg@icann.org>>; Zoom Press <press@zoom.us <mailto:press@zoom.us>> Subject: Re: [Gnso-newgtld-wg] Please specify & Clarify is My Privacy at Risk?
VA,
It's customary in the information security practice to not disclose vulnerabilities before a solution is provided by the software author, in order to better serve public interest. And this process was followed in this case by both the security researcher that identified it and Zoom and Zoom itself, but in the end it was clear that Zoom was not willing to change the architecture to really solve the problem. That made the security researcher disclose the vulnerability at the end of the customary 3-month period, which forced Zoom's hand and starting version 4.4.4 release 53932 it seems to be solved now. See https://support.zoom.us/hc/en-us/articles/201361963-New-Updates-for-Mac-OS <https://support.zoom.us/hc/en-us/articles/201361963-New-Updates-for-Mac-OS> .
You can read more about responsible disclosure in https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Vulnerabil... <https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Vulnerabil...> .
Zoom trying to downplay the severity of this vulnerability is indeed a problem; it was not low risk, and their attitude of thinking that prevented they fixed it in time, requiring a 0-day attack to be disclosed before they actually plugged the hole. Fixing people is harder than fixing software, and the handling of this does not bring any confidence to how they will handle other vulnerabilities in the future. The full recap published by the security researcher is worth reading: https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an... <https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an...>
Rubens
On 10 Jul 2019, at 01:47, Vaibhav Aggarwal, Catalyst & Group CEO <va@bladebrains.com <mailto:va@bladebrains.com>> wrote:
Dear Priscillia,
I appreciate your response. But this is too little and too late. If there was a Vulnerability, why were we not informed earlier as a customer / User. Secondly, I will need to understand what is the extent of this vulnerability. By Saying “Low risk Vulnerability” it is clearly showing that you are not willing to elucidate and want to either brush it under the carpet or ignore or underplay the risk.
This is a mandatory disclosure you need to do as it is my privacy at stake. This is Super Important.
Regards, -VA
On Jul 10, 2019, at 2:44 AM, Priscilla McCarthy <priscilla.barolo@zoom.us <mailto:priscilla.barolo@zoom.us>> wrote:
Hi there Vaibhav, Thank you for your email. These are low-risk vulnerabilities that apply only to Mac users, and we have drafted a blog post discussing them. We are updating our service tonight and this coming weekend. When you see prompted updates, you should update your Zoom app to ensure your security. Here is more information: https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/ <https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/> Thank you! <https://zoom.us/> Priscilla Barolo Manager, Communications Zoom Video Communications Call 650-438-9456 <tel:650-438-9456> | Click zoom.us <https://zoom.us/> | Zoom 650-438-9456 <http://zoom.us/j/650-438-9456> <http://www.facebook.com/zoomvideocommunications> <http://www.twitter.com/zoom_us> <http://www.linkedin.com/company/zoom-video-communications-inc-/> <https://zoom.us/referrals>
<https://smart.zoom.us/v2/a/zoomtopia19/5d2503c401ca44fa0d942282-OjqXg/httpsz...>
On Tue, Jul 9, 2019 at 12:20 PM Vaibhav Aggarwal <va@thevaibhav.com <mailto:va@thevaibhav.com>> wrote:
Dear Eric,
I am in receipt of this following email content :
Hey - remember when ICANN switched everyone from Adobe over to Zoom as a way of enhancing information security and data privacy?
"A vulnerability in the Mac Zoom Client allows any malicious website to enable your camera without your permission... This vulnerability allows any website to forcibly join a user to a Zoom call, with their video camera activated, without the user's permission. On top of this, this vulnerability would have allowed any webpage to DOS (Denial of Service) a Mac by repeatedly joining a user to an invalid call. Additionally, if you’ve ever installed the Zoom client and then uninstalled it, you still have a localhost web server on your machine that will happily re-install the Zoom client for you, without requiring any user interaction on your behalf besides visiting a webpage. This re-install ‘feature’ continues to work to this day."
Read more here: https://medium.com/@jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe... <https://medium.com/@jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe...>
Please Clarify if my privacy at risk. And the steps taken to protect my privacy.
Regards,
Vaibhav Aggarwal New Delhi, India vaibhavaggarwal.com <http://vaibhavaggarwal.com/> twitter.com/thevaibhag <http://twitter.com/thevaibhag> youtube.com/+vaibhavaggarwalindia <http://youtube.com/+vaibhavaggarwalindia>
_______________________________________________ Gnso-newgtld-wg mailing list Gnso-newgtld-wg@icann.org <mailto:Gnso-newgtld-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-newgtld-wg <https://mm.icann.org/mailman/listinfo/gnso-newgtld-wg> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy <https://www.icann.org/privacy/policy>) and the website Terms of Service (https://www.icann.org/privacy/tos <https://www.icann.org/privacy/tos>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
_______________________________________________ Gnso-newgtld-wg mailing list Gnso-newgtld-wg@icann.org <mailto:Gnso-newgtld-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-newgtld-wg <https://mm.icann.org/mailman/listinfo/gnso-newgtld-wg> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy <https://www.icann.org/privacy/policy>) and the website Terms of Service (https://www.icann.org/privacy/tos <https://www.icann.org/privacy/tos>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
Begin forwarded message:
From: lists@christopherwilkinson.eu Subject: Re: [Gnso-newgtld-wg] Please specify & Clarify is My Privacy at Risk? Date: 10 July 2019 at 23:45:01 GMT+2 To: alexander@schubert.berlin Cc: gnso-newgtld-wg@icann.org
zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5 <https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an...>
Well, that’s rather more than I can take on board today. Is it something to do with zoom migrating to DNS over HTTPS (DoH) - ?
Just to add that members of this household who choose not to employ video have developed an effective workaround in the form of a small sticker (e.g. half a postage stamp) which obscures the webcam lens. Problem solved?
Just a thought. ;=))
CW
On 10 Jul 2019, at 13:47, Alexander Schubert <alexander@schubert.berlin <mailto:alexander@schubert.berlin>> wrote:
Hi Rubens,
OMG. And do we have to do anything, or is Zoom updating the software (Windows; Android) automatically? Do we need to “patch” smth, delete the application and reinstall? (I for example do not use Mac/Apple – only Android and Windows).
Thanks for the warning,
Alexander
From: Gnso-newgtld-wg [mailto:gnso-newgtld-wg-bounces@icann.org <mailto:gnso-newgtld-wg-bounces@icann.org>] On Behalf Of Rubens Kuhl Sent: Wednesday, July 10, 2019 1:50 PM To: Vaibhav Aggarwal, Catalyst & Group CEO <va@bladebrains.com <mailto:va@bladebrains.com>> Cc: goran.marby@icann.org <mailto:goran.marby@icann.org>; ericsyuan2011@gmail.com <mailto:ericsyuan2011@gmail.com>; Priscilla McCarthy <priscilla.barolo@zoom.us <mailto:priscilla.barolo@zoom.us>>; Dorrain, Kristine via Gnso-newgtld-wg <gnso-newgtld-wg@icann.org <mailto:gnso-newgtld-wg@icann.org>>; Zoom Press <press@zoom.us <mailto:press@zoom.us>> Subject: Re: [Gnso-newgtld-wg] Please specify & Clarify is My Privacy at Risk?
VA,
It's customary in the information security practice to not disclose vulnerabilities before a solution is provided by the software author, in order to better serve public interest. And this process was followed in this case by both the security researcher that identified it and Zoom and Zoom itself, but in the end it was clear that Zoom was not willing to change the architecture to really solve the problem. That made the security researcher disclose the vulnerability at the end of the customary 3-month period, which forced Zoom's hand and starting version 4.4.4 release 53932 it seems to be solved now. See https://support.zoom.us/hc/en-us/articles/201361963-New-Updates-for-Mac-OS <https://support.zoom.us/hc/en-us/articles/201361963-New-Updates-for-Mac-OS> .
You can read more about responsible disclosure in https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Vulnerabil... <https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Vulnerabil...> .
Zoom trying to downplay the severity of this vulnerability is indeed a problem; it was not low risk, and their attitude of thinking that prevented they fixed it in time, requiring a 0-day attack to be disclosed before they actually plugged the hole. Fixing people is harder than fixing software, and the handling of this does not bring any confidence to how they will handle other vulnerabilities in the future. The full recap published by the security researcher is worth reading: https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an... <https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an...>
Rubens
On 10 Jul 2019, at 01:47, Vaibhav Aggarwal, Catalyst & Group CEO <va@bladebrains.com <mailto:va@bladebrains.com>> wrote:
Dear Priscillia,
I appreciate your response. But this is too little and too late. If there was a Vulnerability, why were we not informed earlier as a customer / User. Secondly, I will need to understand what is the extent of this vulnerability. By Saying “Low risk Vulnerability” it is clearly showing that you are not willing to elucidate and want to either brush it under the carpet or ignore or underplay the risk.
This is a mandatory disclosure you need to do as it is my privacy at stake. This is Super Important.
Regards, -VA
On Jul 10, 2019, at 2:44 AM, Priscilla McCarthy <priscilla.barolo@zoom.us <mailto:priscilla.barolo@zoom.us>> wrote:
Hi there Vaibhav, Thank you for your email. These are low-risk vulnerabilities that apply only to Mac users, and we have drafted a blog post discussing them. We are updating our service tonight and this coming weekend. When you see prompted updates, you should update your Zoom app to ensure your security. Here is more information: https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/ <https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/> Thank you! <https://zoom.us/> Priscilla Barolo Manager, Communications Zoom Video Communications Call 650-438-9456 <tel:650-438-9456> | Click zoom.us <https://zoom.us/> | Zoom 650-438-9456 <http://zoom.us/j/650-438-9456> <http://www.facebook.com/zoomvideocommunications> <http://www.twitter.com/zoom_us> <http://www.linkedin.com/company/zoom-video-communications-inc-/> <https://zoom.us/referrals>
<https://smart.zoom.us/v2/a/zoomtopia19/5d2503c401ca44fa0d942282-OjqXg/httpsz...>
On Tue, Jul 9, 2019 at 12:20 PM Vaibhav Aggarwal <va@thevaibhav.com <mailto:va@thevaibhav.com>> wrote:
Dear Eric,
I am in receipt of this following email content :
Hey - remember when ICANN switched everyone from Adobe over to Zoom as a way of enhancing information security and data privacy?
"A vulnerability in the Mac Zoom Client allows any malicious website to enable your camera without your permission... This vulnerability allows any website to forcibly join a user to a Zoom call, with their video camera activated, without the user's permission. On top of this, this vulnerability would have allowed any webpage to DOS (Denial of Service) a Mac by repeatedly joining a user to an invalid call. Additionally, if you’ve ever installed the Zoom client and then uninstalled it, you still have a localhost web server on your machine that will happily re-install the Zoom client for you, without requiring any user interaction on your behalf besides visiting a webpage. This re-install ‘feature’ continues to work to this day."
Read more here: https://medium.com/@jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe... <https://medium.com/@jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe...>
Please Clarify if my privacy at risk. And the steps taken to protect my privacy.
Regards,
Vaibhav Aggarwal New Delhi, India vaibhavaggarwal.com <http://vaibhavaggarwal.com/> twitter.com/thevaibhag <http://twitter.com/thevaibhag> youtube.com/+vaibhavaggarwalindia <http://youtube.com/+vaibhavaggarwalindia>
_______________________________________________ Gnso-newgtld-wg mailing list Gnso-newgtld-wg@icann.org <mailto:Gnso-newgtld-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-newgtld-wg <https://mm.icann.org/mailman/listinfo/gnso-newgtld-wg> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy <https://www.icann.org/privacy/policy>) and the website Terms of Service (https://www.icann.org/privacy/tos <https://www.icann.org/privacy/tos>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
_______________________________________________ Gnso-newgtld-wg mailing list Gnso-newgtld-wg@icann.org <mailto:Gnso-newgtld-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-newgtld-wg <https://mm.icann.org/mailman/listinfo/gnso-newgtld-wg> _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy <https://www.icann.org/privacy/policy>) and the website Terms of Service (https://www.icann.org/privacy/tos <https://www.icann.org/privacy/tos>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
Thanks for wiring in. But a Larger Question here is that I am not able to understand - this is ICANN why we have ben on Zoom on the 1st Hand - While we are trying to legitimize the entire Internet and then we are trying to correct the uncorrected and while we are trying to keep it transparent - isn’t ICANN also responsible for this kind of Non-Disclosure at the time of the license agreement ? Also, as a Public Policy & Statutory Subject Expert, if zoom wasn’t aware of this, then it is opening themselves up to a liable and a “Digitally non responsible” enterprise tag. I am surprised - I suppose, from a a Charter Prespective, ICANN’s procurement procedure mandates full disclosure of conflict, and this is surely one. Now that Icann is a Private Body, why does it not PUBLICALLY send a notice of Clarification to ZOOM for intentionally omitting material facts at the time of signing of the contract - which in turn will be binding on ICANN for disclosure - to the entire Commercial / Non Commercial Community (of Users) (or Potential Users) legally carrying a foot note in the service of Zoom that a issues is - please keep a watch and we are fixing it. In both the cases - One is Hiding Material Evidence and the other Supporting this case, not caring about the community at large. AND BEST PART IS - we are so worried that we have Blocked Domain Name WHO IS INFORMATION - in the name of privacy :-) Its the same community who recommended it. Dosen’t really matter, does it ?? Alas, we are all living in a world of gray areas. We like twisting our tails and sining our songs as the weather changes, we also change our allegiences ! Warm regards, -VA VaibhavAggarwal.com <http://vaibhavaggarwal.com/> Twitter.com/TheVaibhavAg <http://twitter.com/TheVaibhavAg> Youtube.com/+VaibhavAggarwalIndia <http://youtube.com/+VaibhavAggarwalIndia>
On Jul 10, 2019, at 4:20 PM, Rubens Kuhl <rubensk@nic.br> wrote:
VA,
It's customary in the information security practice to not disclose vulnerabilities before a solution is provided by the software author, in order to better serve public interest. And this process was followed in this case by both the security researcher that identified it and Zoom and Zoom itself, but in the end it was clear that Zoom was not willing to change the architecture to really solve the problem. That made the security researcher disclose the vulnerability at the end of the customary 3-month period, which forced Zoom's hand and starting version 4.4.4 release 53932 it seems to be solved now. See https://support.zoom.us/hc/en-us/articles/201361963-New-Updates-for-Mac-OS <https://support.zoom.us/hc/en-us/articles/201361963-New-Updates-for-Mac-OS> .
You can read more about responsible disclosure in https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Vulnerabil... <https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Vulnerabil...> .
Zoom trying to downplay the severity of this vulnerability is indeed a problem; it was not low risk, and their attitude of thinking that prevented they fixed it in time, requiring a 0-day attack to be disclosed before they actually plugged the hole. Fixing people is harder than fixing software, and the handling of this does not bring any confidence to how they will handle other vulnerabilities in the future. The full recap published by the security researcher is worth reading: https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an... <https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an...>
Rubens
On 10 Jul 2019, at 01:47, Vaibhav Aggarwal, Catalyst & Group CEO <va@bladebrains.com <mailto:va@bladebrains.com>> wrote:
Dear Priscillia,
I appreciate your response. But this is too little and too late. If there was a Vulnerability, why were we not informed earlier as a customer / User. Secondly, I will need to understand what is the extent of this vulnerability. By Saying “Low risk Vulnerability” it is clearly showing that you are not willing to elucidate and want to either brush it under the carpet or ignore or underplay the risk.
This is a mandatory disclosure you need to do as it is my privacy at stake. This is Super Important.
Regards, -VA
On Jul 10, 2019, at 2:44 AM, Priscilla McCarthy <priscilla.barolo@zoom.us <mailto:priscilla.barolo@zoom.us>> wrote:
Hi there Vaibhav, Thank you for your email. These are low-risk vulnerabilities that apply only to Mac users, and we have drafted a blog post discussing them. We are updating our service tonight and this coming weekend. When you see prompted updates, you should update your Zoom app to ensure your security. Here is more information: https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/ <https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/> Thank you! <https://zoom.us/> Priscilla Barolo Manager, Communications Zoom Video Communications Call 650-438-9456 <tel:650-438-9456> | Click zoom.us <https://zoom.us/> | Zoom 650-438-9456 <http://zoom.us/j/650-438-9456> <http://www.facebook.com/zoomvideocommunications> <http://www.twitter.com/zoom_us> <http://www.linkedin.com/company/zoom-video-communications-inc-/> <https://zoom.us/referrals>
<https://smart.zoom.us/v2/a/zoomtopia19/5d2503c401ca44fa0d942282-OjqXg/httpsz...>
On Tue, Jul 9, 2019 at 12:20 PM Vaibhav Aggarwal <va@thevaibhav.com <mailto:va@thevaibhav.com>> wrote: Dear Eric,
I am in receipt of this following email content :
Hey - remember when ICANN switched everyone from Adobe over to Zoom as a way of enhancing information security and data privacy?
"A vulnerability in the Mac Zoom Client allows any malicious website to enable your camera without your permission... This vulnerability allows any website to forcibly join a user to a Zoom call, with their video camera activated, without the user's permission. On top of this, this vulnerability would have allowed any webpage to DOS (Denial of Service) a Mac by repeatedly joining a user to an invalid call. Additionally, if you’ve ever installed the Zoom client and then uninstalled it, you still have a localhost web server on your machine that will happily re-install the Zoom client for you, without requiring any user interaction on your behalf besides visiting a webpage. This re-install ‘feature’ continues to work to this day."
Read more here: https://medium.com/@jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe... <https://medium.com/@jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe...>
Please Clarify if my privacy at risk. And the steps taken to protect my privacy.
Regards,
Vaibhav Aggarwal New Delhi, India vaibhavaggarwal.com <http://vaibhavaggarwal.com/> twitter.com/thevaibhag <http://twitter.com/thevaibhag> youtube.com/+vaibhavaggarwalindia <http://youtube.com/+vaibhavaggarwalindia>
_______________________________________________ Gnso-newgtld-wg mailing list Gnso-newgtld-wg@icann.org <mailto:Gnso-newgtld-wg@icann.org> https://mm.icann.org/mailman/listinfo/gnso-newgtld-wg _______________________________________________ By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.
participants (5)
-
Alexander Schubert -
lists＠christopherwilkinson.eu -
Maxim Alzoba -
Rubens Kuhl -
Vaibhav Aggarwal, Catalyst & Group CEO