Vulnerability in the Mac Zoom client allows malicious websites to enable camera

Re:Vulnerability in the Mac Zoom client allows malicious web... by TeMPOraL on Tuesday July 09, 2019 @11:10AM (#20392524)

> we can simply treat the network itself as hostile and try to defend from it (e.g. applications that can access the network cannot access outside of a designated folder - the OpenBSD pledge approach but forced on all applications that access the network)

Won't work. Malicious actors (both malware developers and companies with user-hostile business models) will start working around it, by for instance giving you two applications, one connected to the Internet and one not. The first application will be the C&C server, the second one will be the executor, and they'll talk with each other over e.g. files in first application's folder.

Trying to block that would pretty much hose all utility in having a general-purpose computer. You'll be back to the crappy UX of a smartphone.

I honestly don't know how to solve this conundrum. You can't solve it technologically, as you quickly hit the Halting Problem. You can't solve it socially, because for any power user benefiting from the modicum of interoperability you leave in, you get 10 regular people who can be trivially social-engineered into selfpwning their device. It seems that in the end, you'll either have to lock down computers to near uselessness, or live with the risk of bad actors exploiting them.

[ Parent | on HN ]

Re:Vulnerability in the Mac Zoom client allows malicious web... by Crinus on Tuesday July 09, 2019 @12:04PM (#20393189)

My comment isn't an ideal solution, it is what i consider a better solution considering how things are treated nowadays.

Ideally users would be wary of what they do with their computers, but considering how the world devolved from "you should never use your real name and address online" to modern social media, this is yet another case where i do not see such an ideal happening.

[ Parent | on HN ]

Re:Vulnerability in the Mac Zoom client allows malicious web... by anaphor on Tuesday July 09, 2019 @11:32AM (#20392775)

Have you looked into the object capability model of permissions? https://en.wikipedia.org/wiki/Capability-based_security

This is exactly the type of problem it solves, usability with security.

[ Parent | on HN ]

Re:Vulnerability in the Mac Zoom client allows malicious web... by TeMPOraL on Tuesday July 09, 2019 @11:47AM (#20392958)

I don't see how it solves the selfpwn problem - that is, for any capability I can explicitly grant if I know what I'm doing, someone else can grant it because a malicious actor nicely asked them to do it. If you take away the ability to grant the capability, you're reducing usability.

[ Parent | on HN ]

Re:Vulnerability in the Mac Zoom client allows malicious web... by anaphor on Tuesday July 09, 2019 @11:52AM (#20393019)

Yeah, that's really an unsolvable problem I guess. But you could at least make it clear to the user what some app is requesting. If it's requesting the root capability / ambient authority (basically access to everything) then that should be a big red flag.

[ Parent | on HN ]