Re:Zoom Windows client could allow credentials to be leaked ...
by jeroenhd on Wednesday April 01, 2020 @11:39AM
(#22749792)
This is hardly Zoom-related. This attack can easily be executed from Word files and malicious web pages in the right circumstances.
Microsoff should really disable this insecure method of authentication to public addresses for everyone but business users who rely on it (and whose IT department can manually enable the feature through group policy). There are sort-of-valid reasons to use SMB over the internet (easy network printing for one, as well as mounting disks in networks that still hand out publicly routable IPv4 addresses such as universities) and closing the port would break that functionality immediately.
Why should every residential ISP in the world need to cover up for Microsoft's design flaw? This bug is presented as news but it has been a known security issue for at least 6 years now.
Re:Zoom Windows client could allow credentials to be leaked ...
by xenonite on Wednesday April 01, 2020 @02:02PM
(#22751671)
Can SMB links be clicked on from a standard browser? If browsers prohibit it, I guess it would indeed be responsible on Zoom's part to also prohibit it.
Microsoff should really disable this insecure method of authentication to public addresses for everyone but business users who rely on it (and whose IT department can manually enable the feature through group policy). There are sort-of-valid reasons to use SMB over the internet (easy network printing for one, as well as mounting disks in networks that still hand out publicly routable IPv4 addresses such as universities) and closing the port would break that functionality immediately.
Why should every residential ISP in the world need to cover up for Microsoft's design flaw? This bug is presented as news but it has been a known security issue for at least 6 years now.