News for hackers. Stuff that matters.
Re:Two vulnerabilities in Zoom could lead to code execution by redis_mlc on Sunday June 07, 2020 @05:57AM (#23446124)
> something like Cisco WebEx

So you're going to love this.

The CEO of Zoom is a former senior engineer on WebEx, funded by ex-WebEx employees and founders.

Zoom was originally him plus 40 software engineers in China.

If I was Cisco, I'd be wondering how much code was copied into Zoom.

And if I were you, I'd be wondering why people are using an essentially Chinese communications tool.

Zoom is not a normal US company that outsources to China - the entire development team started in China with a San Jose "HQ" (because Cisco is based in San Jose.)

Re:Two vulnerabilities in Zoom could lead to code execution by throw554323 on Sunday June 07, 2020 @06:13AM (#23446201)
Eric Yuan worked for WebEx before it was acquired by a Cisco. While he was at Cisco, he tried to improve WebEx, but none of his managers listened and he felt they were moving to slow [1]. He left and started his own company.

He’s an American. His wife is an American. His kids are American.

1. https://www.cnbc.com/2019/08/21/zoom-founder-left-job-becaus...

Re:Two vulnerabilities in Zoom could lead to code execution by Sevaris on Sunday June 07, 2020 @06:27AM (#23446282)
Nobody said he wasn't American. The team that made and works on Zoom is in China though.
Re:Two vulnerabilities in Zoom could lead to code execution by bamboozled on Sunday June 07, 2020 @06:38AM (#23446327)
What happens if Chinese people work on it?
Re:Two vulnerabilities in Zoom could lead to code execution by Jon_Lowtek on Sunday June 07, 2020 @07:04AM (#23446481)
Chinese Ministry of State Security can inject a coder/sysmin who adds vulnerabilities which are then used for espionage against corporations/governments. The National Security Agency has done things like that in the past, so it is safe to assume the chinese do it to.
Re:Two vulnerabilities in Zoom could lead to code execution by rad_gruchalski on Sunday June 07, 2020 @07:35AM (#23446642)
Playing devil’s advocate: what should the rest of the world do when using proprietary technology from the USA, given that NSA likes to have their nose in everything?
Re:Two vulnerabilities in Zoom could lead to code execution by lifty on Sunday June 07, 2020 @08:08AM (#23446809)
The software industry needs to adapt to the challenges of a fully digitized world and at the moment things are a bit behind. The first and most important part is to have reproducible builds and core signing, so in cases where the source is available, people should be able to easily trace what’s in the software they’re using and who contributed. I think this is a technical challenge and some software ecosystems are trying to solve it (Go, Rust etc.). The next thing that I would like to see happening is more commercial software licenses that allow making a living from selling software but that give access to the source. I prefer a world where I pay for software and developers can make a living, and at the same time be able to check that the promises that the developer makes are held.
Re:Two vulnerabilities in Zoom could lead to code execution by whydoyoucare on Sunday June 07, 2020 @11:53AM (#23448232)
How would code-signing help if NSA arm-twists you into introducing a backdoor in your code? Even for open-source, it is difficult for average-Joe to trace and figure out contributions (its like saying the automobile engine has blueprints available, so everyone should be able to figure out what's wrong). :-)
Re:Two vulnerabilities in Zoom could lead to code execution by joering2 on Sunday June 07, 2020 @01:43PM (#23449097)
Arm-twist?

You know NSA is an American Agency, and America is not China - there is a free enterprise. The only way they can "arm-twist" you is by rules and regulations that every company has to follow. In other words - NSA cannot force you to break the law.

Re:Two vulnerabilities in Zoom could lead to code execution by jtsuken on Sunday June 07, 2020 @03:48PM (#23450161)
"The FBI wanted to work out an arrangement in which the developer would secretly feed its operatives information about Telegram’s inner workings—things like new features and other components of the service’s architecture that they might want to know about. The arrangement would be strictly confidential, and they were willing to pay." source: https://thebaffler.com/salvos/the-crypto-keepers-levine
Re:Two vulnerabilities in Zoom could lead to code execution by joering2 on Sunday June 07, 2020 @04:26PM (#23450493)
Whats your point? Telegram owners are private enterprise. They could say "okay we do it for money", or say "we won't do it because of principles".

Where is this so-called "arm-twisting" ??

Re:Two vulnerabilities in Zoom could lead to code execution by Angeo34 on Sunday June 07, 2020 @04:43PM (#23450633)
>What is a metaphor the post

Even if it wasn't a metaphor the US has been known to physically harass people for Software more than any other regardless of what the people did.

Re:Two vulnerabilities in Zoom could lead to code execution by joering2 on Sunday June 07, 2020 @06:40PM (#23451635)
Us government has been _physically_ harras people for software?

Some examples please?

Re:Two vulnerabilities in Zoom could lead to code execution by jtsuken on Sunday June 07, 2020 @07:50PM (#23452144)
Isn't it ironic how the majority of threads on this forum currently discuss the abuse of power of government officials and the excessive violence of countless law enforcement agencies, while this thread abounds in commenters conspicuously ignorant of the problem?
Re:Two vulnerabilities in Zoom could lead to code execution by joering2 on Sunday June 07, 2020 @11:49PM (#23453405)
I'm not being ignorant. I am simply asking question - what are examples of government physically harassing software people?

Unless what you saying is that some programmer neck was crushed for 8 minutes because they didn't want to implement backdoor??

Re:Two vulnerabilities in Zoom could lead to code execution by jtsuken on Sunday June 07, 2020 @08:02PM (#23452222)
Bribing the software engineers of an independent private business behind the owner's back, and/or showing up without announcement at private residences of major stake-holders is "arm-twisting" for all intents and purposes. Admittedly it's more subtle than the typical approach the Russian or Chinese governments would follow, yet the essence is the same. In rare cases, where bribery and coercion fail, there is the institution of FISA courts in the US and the lack of control over secret services in other countries. The potential of a private business to say "okay we do it for money" is exactly the risk at hand and the reason for more than a handful of "accidental" security breaches in the recent past.
Re:Two vulnerabilities in Zoom could lead to code execution by nitrobeast on Sunday June 07, 2020 @03:34PM (#23450045)
This is an ok thing for some Americans to believe in, but at least Google encrypted all its traffic between data centers specifically to avoid NSA eavesdropping. And many people in the rest of the world don’t think US respects the rule of law as it advertizes.
Re:Two vulnerabilities in Zoom could lead to code execution by whydoyoucare on Monday June 08, 2020 @11:24AM (#23457296)
Google encrypted it after Snowden documents revealed NSA was silently exfiltrating the data. [1]

[1] https://www.washingtonpost.com/world/national-security/nsa-i...

Re:Two vulnerabilities in Zoom could lead to code execution by Jon_Lowtek on Sunday June 07, 2020 @10:34AM (#23447610)
prefer open source and end2end encryption

... oh wait your premise disqualifies that.

Well Arabia and Russia are starting to force data being processed and stored in their territory by blocking foreign comm-tech. But i don't think that is a solution, that is just digital nationalism driven by fear of espionage and demand for the power of mass surveillance.

What "the world" should do is lobby against nation-states and mega-corps having their noses in everything, because it is a central building block of totalitarianism. Even if the state doesn't go all out authoritarian, it opens back doors that leave people vulnerable to abuse by bad actors.

Re:Two vulnerabilities in Zoom could lead to code execution by bamboozled on Sunday June 07, 2020 @07:47PM (#23452123)
This was probably my sentiments also, if you're not using open source technology, you're likely setting up for disappointment.
Re:Two vulnerabilities in Zoom could lead to code execution by otachack on Sunday June 07, 2020 @07:58AM (#23446748)
Use and contribute to open source alternatives?
Re:Two vulnerabilities in Zoom could lead to code execution by ryanlol on Sunday June 07, 2020 @11:38AM (#23448121)
So how do you keep MSS and NSA from planting bugdoors in the open source alternatives?
Re:Two vulnerabilities in Zoom could lead to code execution by MaxBarraclough on Sunday June 07, 2020 @06:52PM (#23451756)
Seems like a reasonable question. A relevant example: SELinux came from the NSA.
Re:Two vulnerabilities in Zoom could lead to code execution by smt88 on Sunday June 07, 2020 @08:12AM (#23446827)
The rest of the world can (and should) avoid US software if they want do. Playing devil's advocate here doesn't make a lot of sense because no US regime has ever been anything close to CCP.
Re:Two vulnerabilities in Zoom could lead to code execution by ixtli on Sunday June 07, 2020 @11:49AM (#23448198)
To be fair we know from the Snowden leaks this is exactly what they do. Microsoft quite proudly cooperated with the NSA to backdoor it’s own apps.
Re:Two vulnerabilities in Zoom could lead to code execution by smt88 on Sunday June 07, 2020 @12:57PM (#23448697)
Yes, there were backdoors in the US. I didn't say there weren't.

You sidestepped my main point, that US/CCP is a laughably false equivalency.

Re:Two vulnerabilities in Zoom could lead to code execution by Jon_Lowtek on Sunday June 07, 2020 @04:30PM (#23450525)
The US government can just walk in and say zoom.us has to feed all the data into MYSTIC for national security reasons. The CCPs ability to pressure some developers into adding bad code which might enable them to hack zoom infrastructure is laughable in comparison. Yes in theory they could attack some high value target that way, but only the hosting nation can exfiltrate mass surveillance without an alarm going off. Which is why zoom.cn is hosted in china.
Re:Two vulnerabilities in Zoom could lead to code execution by c22 on Sunday June 07, 2020 @04:12PM (#23450382)
While it's probably a little easier with a "home field advantage" there's no reason to think they don't do this to stuff built outside of China also. As you say, the NSA does this, and certainly other large nations have institutions that do this as well. It's probably safe to assume all large communications systems are riddled with intentional errors.
Re:Two vulnerabilities in Zoom could lead to code execution by kortilla on Sunday June 07, 2020 @03:48PM (#23450165)
They don’t even need to do that. The government can much more easily coerce the existing employees to do things by threatening them or their family members. This is the risk that Chinese employees in the US with family back in China pose to US companies.
Re:Two vulnerabilities in Zoom could lead to code execution by hammock on Sunday June 07, 2020 @08:01AM (#23446765)
When did the en es aye plant a coder inside a private company to add vulnerabilities, that we know about?
Re:Two vulnerabilities in Zoom could lead to code execution by Jon_Lowtek on Sunday June 07, 2020 @09:01AM (#23447023)
Its a play on the whole "they warn about the dangers of supply chain hacks". If asked how they can be so sure that is happening, they say: well we would do it that way.

A proven case? Look at Crypto AG. Sure one might argue the whole company was planted, so it doesn't count ...

Re:Two vulnerabilities in Zoom could lead to code execution by ixtli on Sunday June 07, 2020 @11:50AM (#23448212)
They don’t have to be so secretive. The Snowden leaks told us that companies like Microsoft collaborate with the IC to backdoor their software.
Re:Two vulnerabilities in Zoom could lead to code execution by hammock on Sunday June 07, 2020 @05:51PM (#23451193)
That's why I was curious
Re:Two vulnerabilities in Zoom could lead to code execution by Angeo34 on Sunday June 07, 2020 @04:42PM (#23450619)
So essentially there would be no difference if it was American or Chinese.
Re:Two vulnerabilities in Zoom could lead to code execution by tenaciousDaniel on Sunday June 07, 2020 @09:37AM (#23447234)
Come on, everyone knows this is not about denigrating Chinese people. To have an entire software team located in China puts the product at risk because of the potential interference of the CCP.
Re:Two vulnerabilities in Zoom could lead to code execution by pbhjpbhj on Sunday June 07, 2020 @12:51PM (#23448644)
Just as with USA/NSA, it seems.

For regular citizens, in USA, isn't having NSA know your stuff worse than having CCP know it?

Re:Two vulnerabilities in Zoom could lead to code execution by swsieber on Sunday June 07, 2020 @10:27AM (#23447566)
Ethnically Chinese? Nothing in particular.

Chinese as in "under the jurisdiction the Chinese government"? Well... quite a bit. The comment was pretty specific about it being the location.

Re:Two vulnerabilities in Zoom could lead to code execution by joering2 on Sunday June 07, 2020 @01:40PM (#23449077)
> His kids are American.

Wait, what??

Re:Two vulnerabilities in Zoom could lead to code execution by dehrmann on Sunday June 07, 2020 @02:11PM (#23449307)
> He’s an American. His wife is an American.

While this is true, both he and his wife were born in China, and it's not clear if they renounced their Chinese citizenship. I buy their explanation that development is done in China to save money, but it's an interesting choice for someone so concerned with looking like an American company.

Re:Two vulnerabilities in Zoom could lead to code execution by XMPPwocky on Sunday June 07, 2020 @06:28AM (#23446286)
"Talented engineer leaves old, bloated company to found new startup that becomes a massive success, disrupting a stagnant industry" is a classic tech success story. Awesome to point out such a cool bit of backstory- SV folks love these scrappy underdog stories, the developers who take a risk, leaving their comfy corporate jobs to create a product customers love.
Re:Two vulnerabilities in Zoom could lead to code execution by pbhjpbhj on Sunday June 07, 2020 @12:47PM (#23448616)
>And if I were you, I'd be wondering why people are using an essentially Chinese communications tool. //

Why not? As I'm in the UK I assume that either I use a USA based product and have my data open to USA government sponsored TLAs, or use proprietary products from other countries and have their secret agencies have some sort of access.

With Five-Eyes, or Maximator, mainstream development in one of the countries involved suggests there's going to be intelligence agency access.

For private citizens access by CCP is probably (unless you have links to China) far lower risk than using software connected to Western nations.

I don't have need of secret communications really; Jitsi (meet.jit.si serves my needs when I get to choose the video chat software; family and friends seem happy with it).

Re:Two vulnerabilities in Zoom could lead to code execution by jonathanstrange on Sunday June 07, 2020 @12:29PM (#23448503)
> I'd be wondering why people are using an essentially Chinese communications tool.

People use it because it's currently the best product.

For us at our university, ease of use and the fact that it allows the speaker of a talk to see the audience while sharing screen made it the preferable tool.

Re:Two vulnerabilities in Zoom could lead to code execution by sabas123 on Sunday June 07, 2020 @07:15AM (#23446552)
Can you source the claim it is developed almost exclusively in China?
Re:Two vulnerabilities in Zoom could lead to code execution by wolco on Sunday June 07, 2020 @09:12AM (#23447081)
This is well known.

Sorry for the amp link I'm in a hurry I have a zoom call in a few minutes

https://www.google.com/amp/s/technode.com/2020/04/13/is-zoom...

Re:Two vulnerabilities in Zoom could lead to code execution by ThePowerOfFuet on Sunday June 07, 2020 @10:58AM (#23447813)
> Sorry for the amp link I'm in a hurry I have a zoom call in a few minutes

It would have taken you less time to fetch the original link than to type that.

Re:Two vulnerabilities in Zoom could lead to code execution by dhosek on Sunday June 07, 2020 @12:06PM (#23448313)
I've found it's rather difficult to get from an amp link to the original, especially on mobile where editing the url isn't as straightforward as I would hope. Plus google seems to ignore non-amp pages in favor of amp. amp is a real poison on the web.
Re:Two vulnerabilities in Zoom could lead to code execution by wolco on Sunday June 07, 2020 @01:01PM (#23448734)
https://technode.com/2020/04/13/is-zoom-crazy-to-count-on-ch...

I'm on mobile, it was part true. I really had no idea I needed to click on that tiny i and didn't have time to do a search by title.

Typing in mobile is really fast type days. I have a full keyword/small phone. I started training myself to type faster on mobile by coding on a mobile editor a few years ago. It is so much more difficult at first but you become more focused with time. Add in a free editor app with ad popups every few minutes for additional challenge.

Re:Two vulnerabilities in Zoom could lead to code execution by manojlds on Sunday June 07, 2020 @11:11AM (#23447909)
Or they could have used dictation, how do you know? And clearly, it's partly a joke.
Re:Two vulnerabilities in Zoom could lead to code execution by voicedYoda on Sunday June 07, 2020 @07:22AM (#23446587)
Quick search gets result [1]. Can't find the discussion now, but zoom personnel came up in other discussions here and someone mentioned, with source, 700 devs on China.

[1] https://www.cnbc.com/2019/03/26/zoom-key-profit-driver-ahead...

Re:Two vulnerabilities in Zoom could lead to code execution by m3kw9 on Sunday June 07, 2020 @11:01AM (#23447834)
If I were you I wouldn’t advise people based on conspiracy theories