Vulnerability in the Mac Zoom client allows malicious websites to enable camera (medium.com)

Article summary

A vulnerability in the Mac Zoom client allows malicious websites to enable the camera. The issue is due to a local web server running on port 19421, which can be accessed by any website. This server can turn on the webcam without user consent. The vulnerability can be exploited even if Zoom is uninstalled, as the web server remains running.

Main themes

• Zoom vulnerability
• responsible disclosure
• bug bounties
• security risks
• uninstallation issues

What commenters say

• The Zoom vulnerability is a critical issue that puts users' privacy at risk, and the company's handling of the situation is inadequate.
• Responsible disclosure is essential in handling vulnerabilities, but the definition of 'responsible' can be subjective.
• Bug bounties should be paid to researchers who discover vulnerabilities, as their work is valuable and important for public safety.
• Selling bugs to the highest bidder is unethical and can have severe consequences, including enabling cybercrime and espionage.
• The traditional view that researchers have a duty to the public to disclose vulnerabilities responsibly is still widely accepted, but some argue that this duty is not always clear-cut.
• The prevalence of bug bounty programs has created a market for vulnerabilities, which can lead to a gray area between responsible disclosure and exploitation.
• The effectiveness of Zoom's uninstallation process is questionable, as the web server remains running even after the app is removed.