Zoom Windows client could allow credentials to be leaked via UNC path injection

Re:Zoom Windows client could allow credentials to be leaked ... by intelligenttank on Wednesday April 01, 2020 @11:25AM (#22749619)

We see a LOT more at home use of zoom by grandparents and others with minimal tech savvy because if Covid19. Telling them to egress block SMB is not helpful. Perhaps we need to put more pressure in ISPs to egress block SMB traffic?

[ Parent | on HN ]

Re:Zoom Windows client could allow credentials to be leaked ... by jeroenhd on Wednesday April 01, 2020 @11:39AM (#22749792)

This is hardly Zoom-related. This attack can easily be executed from Word files and malicious web pages in the right circumstances.

Microsoff should really disable this insecure method of authentication to public addresses for everyone but business users who rely on it (and whose IT department can manually enable the feature through group policy). There are sort-of-valid reasons to use SMB over the internet (easy network printing for one, as well as mounting disks in networks that still hand out publicly routable IPv4 addresses such as universities) and closing the port would break that functionality immediately.

Why should every residential ISP in the world need to cover up for Microsoft's design flaw? This bug is presented as news but it has been a known security issue for at least 6 years now.

[ Parent | on HN ]

Re:Zoom Windows client could allow credentials to be leaked ... by xenonite on Wednesday April 01, 2020 @02:02PM (#22751671)

Can SMB links be clicked on from a standard browser? If browsers prohibit it, I guess it would indeed be responsible on Zoom's part to also prohibit it.

[ Parent | on HN ]