Bug Bounty Writeups

Except Zoom web version doesn't work: the incoming/outgoing audio is garbled (tested with Chrome, they do not support Firefox). This is in part because they were obviously too good for WebRTC native audio and instead gutted ffmpeg and compiled it to WebAssembly (I wish I was kidding but I'm not: https://webrtchacks.com/zoom-avoids-using-webrtc/).

Moreover, Zoom has a history of RCEs (leaving an active web server after you uninstall Zoom? so that a website can reinstall Zoom without any user interaction? why not! https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5), and anti-privacy behavior: meeting host gets a copy of all private messages sent between participants (there is no notice of this; https://twitter.com/rcalo/status/1237957509324746752); host can monitor if your Zoom window is active (https://twitter.com/zoom_us/status/1241768006327336963); and Zoom has audio fingerprint tracing (so if you get a leaked recording Zoom can blame a particular participant: https://venturebeat.com/2019/01/22/zoom-is-bringing-ultrasonic-signatures-to-business-calls-to-deter-leaks/). Running it under strace reveals it is fingerprinting your device as well (idk if that gets sent anywhere but iOS app sends stuff to Facebook...).

Zoom is creepy and should not be used. I keep a separate VM for it, as it clearly can not be trusted.

I moved away early this year due to its poor track record on security:
2019 - Report of the Zoom app's malware like behaviour-using a hidden web server to enable Zoom much more capabilities than simply launching a zoom call like re-installing the Zoom software[1]

2020-Tricking its users during installation pretending the OS is requiring password[2]

In general, playing fast and loose with its users' data-sending a conference en(de)cryption key between two users in Canada/US to an ip address in Beijing.[3]

[1]https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5
[2]https://twitter.com/c1truz_/status/1244737672930824193
[3]https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/

> So except if the software keeps on spying after it is switched off (which would be unacceptable)

This is really kind of funny, because this exact thing happened literally less than a year ago. It was technically a vulnerability, but they refused to see it as such and fix it until it was disclosed publicly and they had a wave of negative PR. They literally allowed anyone to connect to the webcam on your computer through an always-on server which remained installed after you removed Zoom from your computer. https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5

I can't believe everyone has forgotten this quickly. Zoom is not a trustworthy company.

> Does anyone know if they've ignored the concern?

Well yes, an example is their reaction on their Zero Day:

https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5

> Ultimately, Zoom failed at quickly confirming that the reported vulnerability actually existed and they failed at having a fix to the issue delivered to customers in a timely manner. An organization of this profile and with such a large user base should have been more proactive in protecting their users from attack.

let me expand (copy pasta from my comment on sibling post[0]):

this isn't the first time zoom got caught red-handed[1]. Last year they were called out for installing a local web server in order to disable security controls to get around the deprecated NPAPI[2] ... this is _literally_ what malware does. Seriously fuck zoom!

[0] https://news.ycombinator.com/item?id=22658173

[1] https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5

[2] https://en.wikipedia.org/wiki/NPAPI

Wouldn't say so.

The who found the Vulnerability where at least talking to the people at chrome and firefox:
Quote from there Blogpost (https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5)
"Apr 10, 2019 — Vulnerability disclosed to Chromium security team.

Apr 19, 2019 — Vulnerability disclosed to Mozilla FireFox security team."

So, not entirely unrealistic that the other Browser manufacturer also got a notice.