A vulnerability in the Mac Zoom Client allows any malicious website to enable your camera without your permission. The flaw potentially exposes up to 750,000 companies around the world that use Zoom to conduct day-to-day business.
[...] This vulnerability allows any website to forcibly join a user to a Zoom call, with their video camera activated, without the user's permission.
On top of this, this vulnerability would have allowed any webpage to DOS (Denial of Service) a Mac by repeatedly joining a user to an invalid call.
Additionally, if you've ever installed the Zoom client and then uninstalled it, you still have a localhost web server on your machine that will happily re-install the Zoom client for you, without requiring any user interaction on your behalf besides visiting a webpage. This re-install 'feature' continues to work to this day.
[...] According to Zoom, they will have a fix shipped by midnight tonight pacific time removing the hidden web server; hopefully this patches the most glaring parts of this vulnerability. The Zoom CEO has also assured us that they will be updating their application to further protect users privacy.
Proof of concept:
https://jlleitschuh.org/zoom_vulnerability_poc/zoompwn_iframe.html
WARNING: Clicking this link starts a Zoom video call, no questions asked!
(Score: 4, Funny) by All Your Lawn Are Belong To Us on Wednesday July 10 2019, @02:12PM (2 children)
I just got this email from a dude who said I've been haxxored and he filmed me watching videos and I'm supposed to know the kind he means... I've got Zoom on my system so now I guess I have to pay him 1 BTC so that my dirty little secret won't be exposed!!!!!
Who knew that a Taylor Swift and Meghan Trainor addiction could become so expensive?????
This sig for rent.
(Score: 0) by Anonymous Coward on Thursday July 11 2019, @12:25AM
I'm sure both girls 'mow their lawns' bald, so no more lawn for you.
(Score: 0) by Anonymous Coward on Thursday July 11 2019, @03:02AM
Did you see the one where they did that to a guy, threatened to send pictures of him naked and wanking to family and friends, for which his reply amounted to "they already know"