Vulnerability in the Mac Zoom client allows malicious websites to enable camera

Re:Vulnerability in the Mac Zoom client allows malicious web... by filleokus on Tuesday July 09, 2019 @04:56AM (#20390013)

If Universal Links was supported on macOS we could get the best of both worlds.

The web server basically presents meta-data in a JSON-file (in the .well-known directory) which Safari/iOS uses to launch the app if it is installed, and otherwise just renders the webpage [0].

The app contains information about which domains it allows itself to be opened from which would fix this issue.

[0]:https://developer.apple.com/library/archive/documentation/Ge...

[ Parent | on HN ]

Re:Vulnerability in the Mac Zoom client allows malicious web... by om2 on Wednesday July 10, 2019 @04:56AM (#20400293)

Universal Links will be supported on macOS Catalina. Reference: https://developer.apple.com/videos/play/wwdc2019/717/

[ Parent | on HN ]

Re:Vulnerability in the Mac Zoom client allows malicious web... by m0dest on Tuesday July 09, 2019 @05:57AM (#20390279)

Universal Links are better than their localhost webserver insanity, but don't really solve this. A malicious website can still redirect you to a zoom.us URL that will instantly join the meeting without confirmation.

The underlying problem is that they want a URL to join a conference call hosted by any random user and share your audio/video without confirmation. And it's simply not safe to trigger that kind of action from a URL.

[ Parent | on HN ]

Re:Vulnerability in the Mac Zoom client allows malicious web... by filleokus on Tuesday July 09, 2019 @07:18AM (#20390670)

Yes, I agree that's the underlying problem. Regardless of how the URL is opened it shouldn't behave that way.

However, I do think that Universal Links doesn't work with redirects, consider: https://bit.ly/30oxOdO vs https://twitter.com/ycombinator (tap using Safari on iOS with Twitter installed).

EDIT: Turns out I was misinformed...

[ Parent | on HN ]