Zoom has a signed binary that runs any unsigned script

Re:Zoom has a signed binary that runs any unsigned script by virgilp on Wednesday April 01, 2020 @12:37PM (#22750613)

But if you modify it, it's no longer signed?

[ Parent | on HN ]

Re:Zoom has a signed binary that runs any unsigned script by seb314 on Wednesday April 01, 2020 @12:58PM (#22750872)

apparently the issue is that you could modify the script, keeping the script-launching binary unchanged and signed?

did not try/verify though

[ Parent | on HN ]

Re:Zoom has a signed binary that runs any unsigned script by UncleMeat on Wednesday April 01, 2020 @01:19PM (#22751151)

How are you planning on modifying the script?

The network can't do it if it is downloaded over TLS. A malicious host can already ship evil scripts. Malware on the local machine can already do worse that edit a script.

[ Parent | on HN ]

Re:Zoom has a signed binary that runs any unsigned script by lordlimecat on Wednesday April 01, 2020 @02:06PM (#22751727)

The installer is code-signed, and requests root privileges, right?

>Malware on the local machine can already do worse that edit a script.

Malware on the local machine may not have root rights. You're basically arguing that privilege escalation isnt a real threat.

[ Parent | on HN ]