Zoom zero-day discovery

Re:Zoom zero-day discovery by capableweb on Friday April 09, 2021 @12:05PM (#26752305)

"Safe" in security is always relative. Safe from a military hacking attack? Probably never. Safe from random scriptkiddies? Yeah, probably even if you don't run Zoom with a separate user, as long as you got the rest of your shit together. Safe from people buying/using 0days? Seems so, since this issue was never actually disclosed (yet) so it's not really a 0day, so it'll be harder to for people to exploit.

You'd need to understand who/what are your threats to understand if you're "safe" or not.

[ Parent | on HN ]

Re:Zoom zero-day discovery by fouuler on Friday April 09, 2021 @12:08PM (#26752337)

What I mean is: am I safe from those who have a Zoom 0day, if Zoom is running on a separate user; assuming they do not also have a Linux 0day.

[ Parent | on HN ]

Re:Zoom zero-day discovery by thinkharderdev on Friday April 09, 2021 @12:48PM (#26752823)

Depends on a lot of things. If the 0day is an RCE they would need another privilege escalation exploit. How easy that would be depends a lot on how your system is setup.

But the short answer is probably not. Unless you are running Qubes or something, if someone can exploit an RCE then they can probably own your system.

[ Parent | on HN ]

Re:Zoom zero-day discovery by fouuler on Friday April 09, 2021 @12:56PM (#26752952)

I'd be really interested in a longer answer. I'm running Void Linux. What would exactly would Qubes add in this respect?

[ Parent | on HN ]