News for hackers. Stuff that matters.

A comment on Zoom has a signed binary that runs any unsigned script. Parent comment

Re:Zoom has a signed binary that runs any unsigned script by jdm2212 on Wednesday April 01, 2020 @01:41PM (#22751423)
The concerns about TikTok are that it's potentially Chinese government spyware because TikTok is owned by a mainland Chinese company which has legal obligations to the Chinese government.

Zoom is a US company that is not answerable to the Chinese government. Like many companies, Zoom has chosen to outsource some of its operations, and those overseas offices create various infosec risks. And given that Zoom infosec seems to be a total clown show, those infosec risks are probably more serious at Zoom. But that would be equally true of any other American company that is really lax about security and too cheap to employ American developers.

[ Parent | on HN ]
Re:Zoom has a signed binary that runs any unsigned script by abiogenesis on Wednesday April 01, 2020 @07:44PM (#22754752)
Not entirely true. While Zoom as a company is not answerable to the Chinese government, the developers are.

Given that we have such horrible laws even in the "more democratic" parts of the world, such as Australia [1], it is not unthinkable that the Chinese government may ask a Chinese developer to install a backdoor to a foreign based product they are working on:

[1] https://www.bbc.com/news/world-australia-46463029

> The Electronic Frontier Foundation has said police could order individual IT developers to create technical functions without their company's knowledge.

[ Parent | on HN ]
Re:Zoom has a signed binary that runs any unsigned script by jdm2212 on Wednesday April 01, 2020 @10:51PM (#22755826)
The same concern applies to any American company with Chinese offices, including Google, Facebook, etc.
[ Parent | on HN ]
Re:Zoom has a signed binary that runs any unsigned script by kryogen1c on Friday April 03, 2020 @10:00AM (#22769192)
except its not an office, its the majority of their dev team operating inside one of the top 3 unsafest, most anti-american (with respect to cybersecurity) countries in the world.
[ Parent | on HN ]
Re:Zoom has a signed binary that runs any unsigned script by president on Wednesday April 01, 2020 @04:18PM (#22753110)
> Zoom is a US company that is not answerable to the Chinese government.

If that was true, then events like the Huawei USA "Tappy" [1] incident wouldn't have occurred. In any case, I'm not trying to take a stance here but merely wanted to correct your statement that they had more engineers in the US than in China.

https://www.npr.org/2019/01/29/689663720/a-robot-named-tappy...

[ Parent | on HN ]
Re:Zoom has a signed binary that runs any unsigned script by jdm2212 on Wednesday April 01, 2020 @05:04PM (#22753489)
Their employees are mostly American, as I originally stated. Their engineers are not.

Huawei USA is almost certainly majority controlled by Huawei China, whereas Zoom's Chinese subsidiary is almost certainly majority controlled by the US parent company. Hence, Huawei is a Chinese company for practical purposes (the people calling the shots will go to jail if they don't do what the CCP wants) and Zoom is an American company (the people calling the shots go to jail if they break American law, and are mostly out of reach of the CCP).

[ Parent | on HN ]