News for hackers. Stuff that matters.

A comment on Vulnerability in the Mac Zoom client allows malicious websites to enable camera. Parent comment

Re:Vulnerability in the Mac Zoom client allows malicious web... by nradov on Monday July 08, 2019 @10:23PM (#20388502)
Have your checked for similar vulnerabilities in competing products such as GoToMeeting and WebEx? They have the same basic features.
[ Parent | on HN ]
Re:Vulnerability in the Mac Zoom client allows malicious web... by migueltarga on Monday July 08, 2019 @10:42PM (#20388596)
RingCentral Meetings uses zoom.us engine but the local server runs on port 19424 instead. I'm able to replicate the issue on it.

PoC: http://localhost:19424/launch?action=join&confno=3535353535

[ Parent | on HN ]
Re:Vulnerability in the Mac Zoom client allows malicious web... by nuvs on Monday July 08, 2019 @11:52PM (#20388890)
I can confirm that this vulnerability exists in RingCentral for macOS, version 7.0.136380.0312.

I was taken into Miguel's meeting, but since the host wasn't presented, it simply let me know it was waiting for him (It also had a friendly notice "Your video will turn ON automatically when the meeting starts".

I've changed my settings in Video > Meetings, just like in Zoom, to turn off my vid when joining. Also confirmed that the server is running on port 19424 (via terminal command 'lsof -i :19424').

[ Parent | on HN ]
Re:Vulnerability in the Mac Zoom client allows malicious web... by thijsvandien on Tuesday July 09, 2019 @05:24AM (#20390138)
In my case it's 19421 as written in the article.
[ Parent | on HN ]
Re:Vulnerability in the Mac Zoom client allows malicious web... by migueltarga on Tuesday July 09, 2019 @08:50AM (#20391186)
For RingCentral or Zoom? Could be because I have both on my machine.
[ Parent | on HN ]
Re:Vulnerability in the Mac Zoom client allows malicious web... by thijsvandien on Tuesday July 09, 2019 @09:17AM (#20391367)
Zoom
[ Parent | on HN ]
Re:Vulnerability in the Mac Zoom client allows malicious web... by migueltarga on Tuesday July 09, 2019 @10:13AM (#20391920)
Yes, my comment was about RingCentral Meetings
[ Parent | on HN ]
Re:Vulnerability in the Mac Zoom client allows malicious web... by thijsvandien on Tuesday July 09, 2019 @12:42PM (#20393701)
Sorry, never heard of that, and since the rest of the story was so similar, it didn't really register in my brain as something entirely different.
[ Parent | on HN ]
Re:Vulnerability in the Mac Zoom client allows malicious web... by liveoneggs on Monday July 08, 2019 @10:36PM (#20388568)
bluejeans video installs a nasty daemon that runs at boot too. I'll never attend a bluejeans meeting again
[ Parent | on HN ]
Re:Vulnerability in the Mac Zoom client allows malicious web... by megablast on Monday July 08, 2019 @11:48PM (#20388875)
Not if you just use it through the browser, which is more stable than their app.
[ Parent | on HN ]
Re:Vulnerability in the Mac Zoom client allows malicious web... by Randgalt on Monday July 08, 2019 @11:48PM (#20388872)
Anyone know what port the Bluejeans server is running on and/or how to kill it in a manner similar to the Zoom workaround?
[ Parent | on HN ]
Re:Vulnerability in the Mac Zoom client allows malicious web... by packetslave on Tuesday July 09, 2019 @12:13AM (#20388969) 

    BlueJeans 423 [...] TCP localhost:18171 (LISTEN)

    $ nc 127.0.0.1 18171
    GET / HTTP/1.0

    HTTP/1.1 200 OK
    Content-Length: 23
    Server: Swifter 1.3.3

    BlueJeansHelper Service
[ Parent | on HN ]
Re:Vulnerability in the Mac Zoom client allows malicious web... by redbeard0x0a on Tuesday July 09, 2019 @07:38PM (#20397881)
Removing the BlueJeans from your machine is a little more involved because they actually used launchd.

launchctl list

Then you need to find where the plist files are (i.e. com.bluejeans.app.detector.plist).

You can disable an entry from launchctl list:

launchctl disable uid/<your user uid>/com.bluejeans.app.detector

You can also unload if you find the actual file

launchctl unload ~/Library/LaunchAgents/com.bluejeans.app.detector.plist

There were a couple differently named bluejeans agents.

[ Parent | on HN ]
Re:Vulnerability in the Mac Zoom client allows malicious web... by longnguyen on Monday July 08, 2019 @11:18PM (#20388736)
Wow didn't know that. I rarely use bluejeans but I guess i will uninstall it anyway.
[ Parent | on HN ]