start	end	text
0	2140	Thank you everyone for tuning in.
2140	5240	I'm super honored to be speaking here today at DEF CON.
5240	7520	This is my first DEF CON talk.
7520	10420	I'm super honored to be here today.
10980	14940	And I wish that we can all have a normal DEF CON
15760	18440	and we'd be able to meet everyone in person,
18440	22240	but hopefully next year when life gets back to normal.
23040	25180	Yeah, let's start.
25320	26980	So who am I?
27000	28340	I'm Mazen Ahmed.
28340	29780	I'm a cyber security engineer
30430	33860	and I specialize in offensive security and APSEC.
34180	36500	I also founded Fullhunt.
36500	37940	If you haven't heard about Fullhunt,
37940	40920	it's the next generation assets discovery
40920	43900	slash monitoring, slash scanning,
43900	45280	slash a lot of cool things
45280	47160	that are happening in the background.
47980	50160	If you haven't tried it or checked it out,
50160	51280	you should definitely do.
51280	53080	It will be one of the coolest things
53080	55840	in security one day soon.
57160	60000	Before that, I worked in the security engineering
60000	62700	of ProtonMail.
62820	66740	I was also, I'm also a bounty participant
67320	71760	where I reported security vulnerabilities to Facebook,
71760	77540	to the Department of Defense, to Twitter, and many others.
78080	82740	I'm interested in web, infra, mobile,
82740	87520	and cloud security, life evasions, security automation,
87520	92200	and DevSecOps, and many other cool things in security.
93040	96460	And you can read more at mazenahmed.net
96460	100000	and you can find my contact details there.
101520	103260	And yeah, let's start.
103260	104660	So the agenda for today,
104660	106920	of course, we're talking about hacking Zoom.
107000	110500	Before that, we need to have a quick intro about Zoom,
110500	111500	just in case.
112740	116880	And then we're gonna have a background, findings,
116960	121840	a retrospective on the Zoom's last minute VDP,
121840	124560	recommendations, final thoughts,
125040	128880	and then we would have a room for Q&A.
130300	132860	Zoom, everyone knows it today.
132860	134380	Everyone is using it.
134380	136980	It's literally in everywhere in the world.
136980	140680	Every company, almost every company is using it.
140680	144040	Governments use it too.
144340	147520	We saw last week the hearing of the Twitter hack
147520	151380	where the hearing was done via Zoom
151380	156900	and that hack happened at the hearing live.
156900	159180	It was quite bad, but yeah.
159180	162420	So this proves that everyone is using it.
164070	167540	In May, 2020, the market valuation for Zoom
167540	171620	is 50 billion USD.
173520	176720	I'd like to bring this chart here.
176720	180880	This is a comparison between the market capital of Zoom
180880	185380	against the top seven airlines in the world,
185380	188040	including United and Delta.
189740	196800	So combining the top seven airlines' market capital,
196800	202380	they are either equal or have a higher market capital.
202380	205300	This is crazy just to think about it,
205300	207140	how Zoom became today.
209600	213600	And the rise of Zoom started with the global pandemic.
213600	215180	Everyone knows about that.
218200	221620	So from a stock performance,
221620	224300	almost all of the companies were in the same range
224300	225880	as we can see here.
225880	232360	And then it jumped, it actually skyrocketed by May
232360	234740	with all what was happening.
234740	238460	And meanwhile, all of these top airlines
238460	243120	were quickly falling down, as we can see.
244360	246300	For me, I just find this really interesting
246300	248820	to imagine how Zoom became today.
250900	254820	Yeah, and because how important is Zoom?
254820	257120	This is where my research started.
259000	263620	So in March, March 2020,
263620	266580	Patrick Walder gave a talk at Opcode
266580	272440	about the Zoom security and the state of security at Zoom.
272540	275760	And he disclosed a number of security vulnerabilities
275760	280360	in the Mac OS client of Zoom.
280880	284240	And this brings a lot of attention
284240	287120	to the media and to me personally.
287860	289960	And from that, I got more interested
289960	293540	and started my research from there.
294360	297180	So what was tested before?
298680	302720	The Zoom Mac OS app, it was tested.
302720	305140	We can read about it in the media
305140	308320	and we can read about it in researches
308320	312080	done by Patrick Walder and many others.
312080	314660	It was hacked, it was really bad,
314660	317040	it was reusing really bad practices.
318040	320940	There was a lot of Zoom privacy concerns
321560	326640	and the way that Zoom is sharing data to Facebook
327010	329720	and a lot of things we can also see.
330660	333840	But what was not tested before?
333840	336040	Of course, many things.
336240	339540	This is, I can just share two,
339540	342420	but many things has not been tested before.
342800	347280	For me, I'm trying to take into a couple of things
347280	349500	and that I will be showing now.
350040	354620	One thing that was not tested was the Zoom Linux app.
354800	359080	Nothing, I have tried to search about any research
359080	363400	or disclosure for any vulnerability in the Zoom Linux client.
363400	364800	I haven't seen anything.
365240	367560	This is one thing that I wanted to see
367560	369980	or to focus on.
370760	374620	The Zoom external attack surface, Zoom became huge
374620	378420	and there was no focus on the external attack surface
378420	379460	of Zoom.
380680	384760	The Zoom cloud infrastructure, how it's being set up
384760	388480	and different things related to the infra.
389220	391680	And of course, the Zoom's new end-to-end
391680	394200	encryption implementation.
394200	395880	We have seen it to the media.
395880	397760	Did anyone test it?
398000	401000	We can talk about that later.
401020	402280	And of course, many.
402620	405440	There are a lot of things, I only focused on these.
405440	407840	Definitely, there is a lot of room for research
407840	409200	in this area.
411560	415900	So the findings agenda, I'm not gonna go
415900	417680	to each one of them now.
417680	419580	We will talk about them later.
419580	422040	It's just here for people who are curious
422040	424780	to see what we're gonna talk about.
427730	432690	A quick disclaimer, the entire research is non-funded.
432690	434290	This is a non-funded research.
434290	437270	I have done everything here in my spare time,
437730	441790	just to confirm that or state that.
443150	445990	The research background, the first finding
445990	448890	that I identified was in April, 2020.
449590	453810	And my expectations did not match what I was seeing
453810	455150	in the media.
455450	458310	We will know how later.
458870	461930	The first conclusive response for my finding
461930	468010	that I reported in April, 2020, I got it in July.
469070	474990	This wasn't a very pleasing experience.
475430	479530	And this after a lot of follow-ups, of course, from my side.
479530	482130	And after submitting the CFP to Defcon,
482130	485130	the second round of research started.
485130	488550	At that time, I identified additional
488550	490350	six new different vulnerabilities
491070	494270	and security-related issues.
494570	498410	And of course, everything was reported to Zoom.
499630	504430	And the reward was zero dollars.
504430	507510	Yeah, I just want to say that.
510880	514720	So the first step for doing any type
514720	519520	of offensive research is the reconnaissance.
520140	523060	Understanding the attack surface.
523060	525480	And that's where I started with.
527460	531660	I used full-hunt.io to get the Zoom details.
532220	536100	API returned around 13 domains.
536100	541160	And this is the list of domains that was discovered.
542160	546700	I took a portion of them and analyzed them.
546740	549480	The remaining are there.
549480	554520	If anyone would like to have a test drive, feel free.
556360	559080	And let's go to the findings.
562790	566670	One thing that I noticed that there was two servers
566670	571490	that are having a Kerberos service running.
572450	573990	And when I saw that,
573990	577770	I got interested to see what's happening there.
577970	582650	Apparently, there was two exposed Kerberos servers
582650	585890	that was exposed unintentionally to the internet
586330	588870	and no one knew about them.
590310	596930	So this one had also a web service running on port 80
596930	599170	and it was FreeIPA.
599170	601190	If you don't know what's FreeIPA,
601190	603370	it's an identity management solution
603800	606070	that was developed by Red Hat.
607230	610330	It's open source, you can check it out.
613340	617700	And I started by testing the web interface.
617880	620600	As you can see, this screenshot,
620600	624420	when you are providing an invalid username,
624420	627980	you can see that there is a Kerberos error
627980	629800	that is telling you that.
629800	632320	And one thing that I did not mention here,
632320	635420	that whenever you see a Kerberos server running,
636840	639780	by itself, it's not huge,
639780	641560	but once you compromise it
641560	645400	or you have a single credential that is valid,
646820	651900	then this would open a crazy large amount
651900	655100	of attack surface for you to attack.
655160	657260	And that's what I was doing.
657300	659460	I want to get initial foothold there
659460	662540	and then go from there.
663640	666980	So I started doing user enumeration there.
666980	669980	And you can see here,
669980	673260	the previous one was showing that there was an error.
673260	677040	This user is not found by the client.
678700	681520	And here it's saying that the authentication failed
681520	683380	or the pre-authentication failed,
683380	689440	which means that we are able to identify
689970	691980	valid usernames.
693240	696720	And then I started building word list
696720	700460	based on different things to identify more usernames
700750	704310	so that I can brute force them.
705280	711680	I compiled the word list from the pattern that I have seen.
711680	716500	So the pattern that I have seen for the Zoom emails
716500	721740	are firstname.lastname at zoom.us.
721760	726760	Also the common usernames that I was able to find to get
726760	728900	and employee names, of course.
728900	734580	I compiled them all and I did that for user enumeration.
734580	740740	The only users that I found was admin at idm.mezoom.us.
741450	746970	I then ran a number of brute force sessions on them.
747560	750820	Nothing interesting happened.
751100	756160	Then I saw that I'm hitting a rabbit hole
756160	758460	and it's a dead end.
758460	762060	So I just moved to another more interesting thing
762060	763350	that I can find.
766160	770060	And yeah, it was a good choice.
770840	773020	So the discovery of a memory leak
773020	776100	on our Zoom production server.
779340	783920	Zoom allows uploading profile pictures on accounts,
783920	785820	which is the typical thing.
786720	790200	The process for that is first,
790200	792660	the user uploads a profile image.
793420	800140	And the profile image is either JPEG, GIF, or PNG.
800840	802980	And this is the tricky one.
802980	808660	If the image is PNG or GIF, it's converted to JPEG.
808660	812180	And if the image is JPEG,
812920	815860	the image conversion is not triggered.
817520	820260	And there is another thing here
820260	824160	that if the image contains an invalid image header,
824160	828640	the updating profile API aborts the process.
828640	833400	So there is a good check in that image header.
834480	836680	And it's using, of course, magic bytes,
837000	839600	by checking the magic bytes.
841500	847620	I like to test image conversion or processing softwares.
847620	850860	Or whenever I see an API that is utilizing that
851380	855760	or using that, I know for a fact that there is a large
856330	859500	potential of having something bad happening.
859800	864220	And the reason is because image conversion
864220	869440	is not a vital functionality in an infrastructure
869440	874770	of a company or even a web startup.
876520	881780	So what happens is it often gets forgotten
881780	883880	and there's no security updates
883880	885640	that are being applied there.
885640	887880	As far as it's working, then it's fine.
887880	890520	This is something that I have seen as a pattern.
891140	894840	And that's why I started testing that or focused on that.
896720	900320	So one cool exploit here or security vulnerability
900780	903720	that was released in 2016,
903720	909400	it was known as the ImageTragic exploit or vulnerability.
909400	913620	And this vulnerability allowed having remote code execution
913620	918880	into the instance that is running the image processing
918880	922260	when providing certain payloads.
922260	925940	You can read more about the CVE offline.
927520	929660	So I have tested this one
929660	933780	and they seem to have this one patched.
933780	938080	So I moved to the next one, it did not work.
938080	940900	So I moved to the next one.
944900	947780	There is a vulnerability in ImageMagick
947780	950240	that was reported in 2017.
950700	952680	And it works by having,
952680	956340	whenever the palette is uninitialized
957380	960600	or not presented in the GIF file, basically,
962860	965460	ImageMagick leaks portions of the memory
965800	968400	to the generated or the rendered image.
969800	973220	And this is the fix for the vulnerability
973480	978280	that was issued at that time around July, 2017.
980220	983740	I generated a payload that renders this way
984320	990220	in a normal browser or normal software that is patched.
990580	995400	But when I upload the payload to Zoom,
995460	997780	it renders this way.
1000770	1004490	But if you are reading the report for that CVE,
1004490	1007150	this is the typical behavior
1007150	1011550	of having the exploit being successful.
1013550	1017430	And if you download this image
1017430	1026290	and try to obtain the strings from it,
1026510	1030930	you will find that it's taking some portions of the memory.
1034800	1039660	Then I thought that maybe this is an,
1039660	1044160	let's say, image processing software fault
1044600	1050840	or best effort just to render the image that is corrupted.
1050840	1054280	Or there is a problem that is happening
1054280	1057360	because of rendering a black image.
1057360	1061460	So I generated a new one that is not the,
1061460	1064860	like the payload, it's not the one that,
1064860	1068280	this one has initialized palettes.
1069360	1072520	And when I report it, it renders normally.
1073300	1075660	Okay, this sounds really interesting.
1075960	1079220	We have a memory leak on Zoom production.
1082600	1086820	Typical thing is to automate the exploitation for that.
1086820	1089900	And the flow for that would be
1089900	1092920	to generate a new unique payload,
1092920	1095340	then to upload it to Zoom,
1095340	1098260	wait for the rendering to happen,
1098260	1101220	download the rendered file,
1101220	1103620	extract the data from the corrupted file
1103620	1105960	that was rendered by Zoom,
1105960	1110160	repeat and store leaked memory portions.
1112340	1115160	So this proof of concept does that.
1116000	1121320	So I'm going to have a demo time, which is cool.
1139230	1143990	Here it generated the image and uploaded it to Zoom.
1148480	1150580	I'm downloading the image now.
1151700	1155560	And here, recovering the dump.
1183780	1188160	So here, a memory leak on Zoom production
1188620	1190800	was not the end for that.
1193900	1198320	I remember that in 2018,
1198320	1203020	Travis Romande released a research on Ghostscript,
1203020	1206860	which was used by ImageMagick.
1207020	1211380	And his research revealed a number of critical vulnerabilities
1211380	1213420	in Ghostscript.
1213680	1217940	And the proof of concept that he shared in the research
1217940	1219880	when doing image conversion
1220470	1225620	can lead to a remote code execution.
1225700	1228000	And it was really cool to see this.
1228000	1231320	And what I did is I used the proof of concept
1231320	1234280	that Travis wrote.
1236020	1240460	And I will show you this thing first.
1242080	1248500	So we know for a fact that the 2016 v7.1.4,
1248500	1250960	the image Tragic is patched.
1250960	1254200	But we kind of think that the ImageMagick memory leak
1254200	1260660	is presented based on the proof of exploitation we had here.
1262720	1266780	And that one was patched and released,
1266780	1269900	the patch was released in May 2016.
1269900	1275740	And the patch for the memory leak was released in July 2017.
1275940	1277680	And it's not patched.
1278100	1282220	Based on that, we can safely say that
1284580	1287640	the Ghostscript ROC is not patched, right?
1290550	1296330	So I wrote, like I brought the proof of concept
1296330	1300550	from the research that Travis Sormandy wrote.
1300890	1306250	And I replicated it locally with the same environment
1306250	1308670	I assume Zoom have it on their setup
1308670	1317830	with the same range of versions that Zoom is using mostly.
1318470	1320780	And yeah, it's working.
1324490	1328490	Unfortunately for, or fortunately,
1328490	1331010	I'm not sure which one would suit that,
1331010	1336970	that Zoom API slash p slash upload checks for magic bytes.
1337170	1340790	Otherwise a full exploitation would have been possible.
1341730	1347170	But still, this does not mean that like Zoom is safe.
1347170	1350590	If there is any particular API
1350590	1352890	that is utilizing the same functionality
1354250	1357070	and it's not checking the magic bytes,
1358170	1361770	this would lead to a full remote code execution.
1362110	1364110	This doesn't sound nice.
1364110	1366890	This doesn't sound good by any means.
1370920	1373680	And I don't know how to say this,
1373680	1377660	but the RCE vulnerability is probably still there
1377660	1379440	on Zoom production.
1384400	1389680	Another thing we have here is the shadow IT and Zoom.
1394240	1398560	I have noticed that there is a number of instances
1398560	1403340	or cases where Zoom have shadow IT servers
1403340	1406060	running in different host names
1407300	1409980	and are not properly configured.
1409980	1413620	And they may be a good target
1413620	1417220	for conducting a successful attack.
1417220	1420000	I have seen this in multiple occasions.
1420000	1424780	This example here is showing an instance
1425900	1430440	that did not have any patches since,
1430820	1434940	let me check, September 10th, 2019.
1434940	1438740	I took this picture in July 4th, 2020,
1438740	1444600	around 10 or nine months of timeframe.
1444600	1449940	There was no patches on that server or all new builds.
1451200	1455540	And we all know that there was plenty of security vulnerabilities
1455540	1458260	that was reported to them.
1458260	1461480	And yeah, you can imagine.
1463020	1466680	Another cool thing here is the same host
1466680	1471040	had nine active connections, including me.
1471700	1475820	Makes it an excellent fit for doing any type of testing
1475820	1479080	without triggering alerts, which is cool,
1479080	1483400	so that you can test it and be safe in the part
1483400	1487640	that won't be as detected or detectable
1487640	1493660	as in testing zoom.us, the main website, or yeah.
1495930	1498330	Enough about all this,
1498330	1502470	and let's start to talk about the Zoom app for Linux.
1506990	1512730	One cool finding here, Zoom Linux client,
1512730	1517410	so the TLS is broken by design on Linux,
1517410	1520130	and you're gonna see how that is happening.
1520510	1523090	I don't see this as the best practice,
1523090	1528330	especially for the Zoom, but we can talk about that.
1528330	1531270	So whenever there is any traffic that is intercepted
1531270	1537450	with a custom TLS certificate, Zoom prompts this message.
1538050	1541070	While it looks normal, everything is fine here.
1541070	1543850	And whenever you click Trust Anyway,
1543850	1550530	then you would have the traffic going with that,
1550530	1552790	like with this accepted certificate,
1553710	1555790	which is the unlisted one.
1559840	1564020	But what happens here is that this certificate,
1564020	1567040	like the fingerprint for this certificate
1567440	1572160	is saved locally with the same permissions of the user.
1572840	1577920	And you can simply just plug in,
1577920	1582920	like if you have a malware that is able to have access
1583660	1588300	to your machine, this malware can safely or easily
1588780	1594280	just plug in to the fingerprint of the certificate,
1594280	1596880	and then all of the traffic that is going to Zoom
1596880	1602800	can be intercepted, even if it's using SSL or TLS,
1602800	1607560	because the certificate will be accepted
1607560	1610760	without having to have this type of prompts,
1610760	1614680	because it was added to the local database
1616040	1618500	on the background.
1619160	1622240	So I wrote a simple proof of concept
1622240	1626900	as a sample of what a malware would look like
1626900	1631980	as just in a way or another as a concept.
1632680	1636580	And this particular part of the malware
1637000	1641320	or the proof concept would get the fingerprints
1641320	1645800	for all of the forged certificates that we have.
1645800	1650800	And then it would add it to the Zoom database,
1650800	1654940	local database, and once it's added,
1654940	1661000	these certificates can be provided to Zoom
1661380	1665960	and all the traffic would be passing
1667040	1670660	without having any error like this.
1670660	1673760	And yeah, all of the encrypted traffic
1673760	1678460	could be intercepted when having a malware
1678460	1682580	running on the same user access as this one.
1684860	1690060	Well, I have to say, this is not a really bad vulnerability.
1690060	1694760	It's just a little bit not the best practice to do that.
1696180	1698260	But as we are going now,
1698260	1700100	we're gonna see something that is really bad
1700620	1702260	and we're gonna see it now.
1703740	1706580	So I would start with this question.
1707580	1711280	What's a bad design for an application launcher?
1712780	1713880	Good question.
1713880	1715700	And we're gonna know the answer.
1715700	1721800	So userbin slash zoom is a summary of OPT
1721800	1725360	slash Zoom slash Zoom launcher.
1727690	1730790	And whenever Zoom is called,
1732390	1736170	Zoom is printing the following logging
1738450	1741590	logging data on the SCD out.
1742750	1745630	And there is a part where you can see
1746650	1751490	Zoom path is OPT Zoom
1751490	1755070	and then Zoom not exist at current directory.
1755970	1758570	Okay, this looks interesting already.
1762410	1764790	What's happening in the background?
1765530	1769010	Zoom checks for files within PWD.
1769760	1774740	And if there is an executable called Zoom, literally,
1775770	1780130	on PWD, it executes it as a chat process
1780860	1783230	for userbin Zoom.
1783720	1785860	I was mind blown when I saw that.
1786910	1790090	Why would this be there?
1790190	1792370	This is a proof concept.
1793040	1796990	I created a file called Zoom
1797590	1801750	and then Zoom checks on the PWD
1801750	1805170	if there is a file called Zoom, literally,
1805870	1807790	and executes it.
1807870	1810870	Of course, it has to be with an executable for permission,
1810870	1813070	but this is not a thing.
1815110	1821550	So imagine this, you have application-wide listing.
1821590	1825450	There are a lot of points that I can make here,
1825450	1826470	to be honest.
1826470	1829770	I can make a lot of things that would show
1829770	1833770	how this old design is there for.
1833970	1838210	And if there's anything related to application-wide listing
1838210	1840430	and your wide listing Zoom,
1841290	1843470	this would literally break that
1844150	1848450	because this is executed as a child process
1848450	1851570	of a trusted application, Zoom.
1855920	1858700	And yeah, it's bad practice and bad design
1858700	1860800	by all means.
1860800	1864310	Like why would this be implemented this way?
1867870	1869980	So that's my answer.
1870100	1872860	If it was a bad design for an application launcher,
1872860	1876880	I would be Zoom application launcher for Linux.
1879430	1881920	Another bad thing happening here.
1883310	1887990	So the Zoom local database implementation,
1890610	1892220	you'll see now.
1893570	1895870	So in the configuration files
1895870	1898890	of the configuration directory of Zoom,
1900210	1902450	there is this file,
1902450	1906310	the local database is zoomus.db.
1906310	1908450	This is the default database
1908450	1912410	and a lot of other files that are there for Zoom.
1913310	1916270	The most important file is the zoomus
1916270	1918390	because it has the access tokens,
1918390	1922630	it has all of the PII for the user and everything.
1923620	1927260	And as we can see here in the screen,
1927870	1933930	the file permission is 644.
1934680	1936180	I'll show you this.
1939160	1940580	644.
1940580	1946960	This gives to the user a write and read access.
1947420	1949700	Okay, sounds reasonable.
1949700	1952270	Nothing bad on that.
1953270	1959150	Group access to give it read access.
1959150	1960750	Why?
1960870	1963130	I really like, really?
1963130	1965590	Are you sure about that?
1966830	1971930	But everyone to have read access
1971930	1976570	into the Zoom local database
1976570	1979370	of the Zoom user.
1979890	1980910	Why?
1980910	1983410	Literally, that's what I had in mind.
1986280	1990240	Any code on the user machine that have access to the,
1990240	1992740	like any code that have access to the user machine
1992740	1997220	can read and exfiltrate Zoom local database
1997220	2002220	and configurations and more, of course.
2002860	2007420	Because the permission or the file permission
2007420	2014540	for the Zoom local database is set to be read by everyone.
2017800	2022460	And, okay, another thing that is quite cool.
2023300	2026460	Zoom is end-to-end encrypted.
2026860	2028020	Is it?
2028940	2034220	We can see later, but my answer is not fully.
2035860	2041600	One awesome product by Zoom is Zoom chat.
2041600	2045860	And it's advertised in the website
2045860	2050230	and that we can see here
2052000	2055780	as a platform that is,
2055780	2060280	that makes work and collaboration much easier
2060280	2062180	in mobile and desktop
2062180	2067260	and with a really clean design and UI
2067920	2072760	that looks kind of similar to what Slack is having.
2072860	2074500	This is not the point,
2074500	2078180	but it looks good as a product, right?
2079560	2084380	And as we go back here is, yeah.
2085900	2087980	There are so many cool things to read,
2087980	2090140	but I would focus on the security part.
2091140	2095160	As we can see in the security and archiving and in I-Code,
2095160	2101660	Zoom encrypts data at all times.
2101980	2106800	Again here,
2106800	2111640	encryption of data in transit and at rest
2111640	2117800	and then encryption for data and mobile devices.
2118640	2122060	Your messages in this chat are secured.
2122080	2123640	Another one.
2123940	2127060	So there are a lot of advertisement
2127060	2132180	that is going with how secure Zoom chat is happening.
2132300	2135200	And by security, they don't really
2135200	2138660	or necessarily talk about application security,
2138660	2141480	level of security,
2142420	2145700	but they are talking about how all of the data
2145700	2149240	that are being passing here is encrypted
2149240	2152020	both at rest and in transit,
2152840	2156980	which is in transit, I assume they're saying
2156980	2159520	that it goes in SSL.
2159520	2160800	It's cool.
2161300	2164280	But at rest, this means that they have full
2164280	2166780	end-to-end encryption happening, right?
2169760	2173520	And yeah, repeating again the same sentences.
2175740	2177640	And let's pause this.
2206960	2209580	I'm not sure.
2211060	2213360	This way is fine.
2213580	2216740	But on the right screen, we have Zoom chat running
2216740	2224420	and I have my group chat that is clear with no messages.
2224420	2227800	And then I'm sending some sort of an encrypted message
2228600	2234080	that is here because Zoom is E2E by now,
2234860	2236800	E2E encrypted by now.
2237700	2239680	As advertised.
2239680	2244340	And then on the left side, we can see the local database,
2245800	2248400	a custom one that is made by Zoom
2249580	2253320	that we can see that they have it.
2253320	2257180	And I can just read what's happening there
2257530	2261540	and what they are storing on your local device.
2264950	2267230	So here I sent a message
2267230	2271810	and it's saying that this is secret.
2272630	2275770	Oh, well, just one second.
2275770	2277190	I have to repeat that.
2292650	2300370	The message is being stored locally at rest in clear text.
2304630	2309130	And here, anyone who is able to have access
2309130	2312570	to the user machine is able to pull a full archive
2312570	2315410	of all messages that are being sent
2315990	2320830	that were or are supposed to be end-to-end encrypted
2320830	2323950	and it's saved in plain text.
2325450	2327450	And yeah, this does not sound good.
2327450	2331010	And it's not the one that you can have a record
2331010	2332630	or a backup for your messages.
2332630	2338050	It's just a debugging feature that they left open
2338780	2343230	in production for the Linux build.
2343270	2348490	I'm not sure if this is applicable in macOS or in Windows,
2348490	2355990	but you can see if that's being applicable here in Linux.
2358450	2362270	By the way, the fact that the same database
2362270	2366280	that for messages is having the 644,
2366750	2367910	where is it?
2367910	2371110	The 644 user permission,
2371110	2374390	which means that any code that is running
2374390	2378810	despite what type of user permission is running
2378810	2385690	is able to access this end-to-end encrypted chat archive.
2385910	2387390	Doesn't sound good.
2389490	2394410	Yeah, so of course I could have gone more and tested more,
2394410	2397950	but at the end, this is just a time
2397950	2403370	that I have spending just to fuzz around with Zoom.
2403370	2408670	I did this for curiosity purposes mainly,
2409530	2412930	but definitely I could have spent more time.
2413950	2418850	But then, yeah, I jumped to the responsible disclosure now,
2418850	2424390	and I started the experiment in around April.
2424410	2429010	April 15, reported that in April 18,
2429010	2432910	I contacted Lotus Security in Twitter,
2433570	2441670	followed up with the vulnerability disclosure again on 26,
2441670	2446850	couple of messages on the background.
2446850	2450570	And May 5th of 2020,
2450570	2454560	I received request closed to memory leak at Zoom.us.
2455670	2457560	Yeah, here.
2458570	2460680	So yeah, I wasn't happy.
2465420	2467950	So what's next?
2467950	2470200	Tweeted about that.
2471090	2476370	And then I was asked to send it via HackerOne,
2476370	2480930	turn on communication running to run my automated exploit
2480930	2483950	for the memory leak.
2484430	2489630	Then when nothing seems to be happening,
2489630	2492010	I informed Zoom that I'm planning to present
2492010	2495350	my ongoing research here at DEF CON.
2496250	2502050	And then Zoom told me that they cannot assess the issue
2502050	2505450	as there was no sensitive data seen
2506490	2509130	despite the predictability of the vulnerability
2509130	2510690	on the provided exploit.
2511730	2516550	Then it was closed as not applicable.
2518410	2519990	Sure.
2522520	2526180	Then I sent on July 11th,
2526180	2528680	my new research results,
2528680	2532480	reporting new seven different security vulnerabilities,
2533360	2536200	six to seven new vulnerabilities.
2536940	2540660	I got an acknowledgement about receiving my report.
2540660	2544700	By the way, this is the first conclusive response
2544700	2547400	regarding the memory leak issue.
2549100	2553640	By conclusive, I mean that they did a full analysis
2553640	2555100	of what was happening.
2555100	2557700	On the previous ones on HackerOne,
2557700	2560520	they triggered it as valid,
2560520	2563260	and then they were trying to run my exploit,
2563260	2564900	and that's all.
2565060	2569740	But this one, they researched more and analyzed more
2569740	2571040	about how this is happening
2571040	2573340	and what was the cause of the issue.
2573800	2577720	And it was in like literally three months
2577720	2579570	after I reported it.
2580800	2583200	Then further explanation from Zoom
2583200	2586860	regarding the vulnerability or the findings in general.
2588520	2592500	Okay, now with what was happening
2592500	2595960	and then from their explanation,
2595960	2599540	and then my response regarding each analysis
2599540	2601080	that they provided.
2604180	2606700	So for the public authentication,
2606700	2608600	yeah, you can see what's happening here,
2608600	2610600	what they wrote.
2611200	2613380	And well, yeah, for me, yeah.
2613380	2616260	Well, again, this may be a forgotten server
2616260	2618740	that was mistakenly exposed.
2618740	2622780	I haven't seen any references of 2FA being implemented,
2623820	2626500	but in all cases, it's down now, so it's great.
2628740	2634300	Oh, wait, I think I messed up with the messages here.
2634380	2640980	Anyway, so this is the same slide from the last one.
2644120	2647480	So we did check that ImageMagick
2648680	2651980	is not used for image conversions here,
2653080	2657360	but wait, the same vulnerability is being reproduced.
2657360	2659200	It's maybe a fork of ImageMagick
2659710	2661680	or an image processing software
2661680	2664020	that is vulnerable to the same CVE
2665160	2669360	of not being able to parse GIF images
2669770	2673560	that have an initialized palettes.
2674060	2677180	This sounds reasonable.
2677180	2681340	In all cases, it's clear that something is wrong, right?
2684660	2688120	Shadow IT and Zoom.
2688120	2693200	So these are non-sensitive information disclosure
2693200	2695200	from a shared environment.
2695560	2697940	Information hygiene is important to us
2697940	2700820	and we appreciate you reporting this finding.
2700820	2701900	So that's great.
2701900	2703640	So Full Hunt can help here,
2703640	2705160	probably the best product out there
2705160	2707840	for mitigating shadow IT risks.
2710880	2714900	Oh, I think part of the discussion
2714900	2717880	regarding the image conversion
2717880	2721080	is not placed on the slide,
2721080	2723180	but please check my blog after that
2723180	2727180	to have the full list of discussion.
2727640	2733020	So for what was happening for the Linux app findings,
2733020	2738410	yeah, they fixed it or patched it in 5.2.0
2738760	2742840	that was released in August 3rd, I think.
2743480	2747360	They were supposed to patch or release it on August 2nd,
2747360	2750120	but it was released on August 3rd.
2750120	2753920	In all cases, I have read the change log.
2753920	2760140	There was no mention whatsoever for any security patches.
2760140	2763600	So clearly it was a silent fix,
2763600	2766700	which it wasn't a nice thing.
2766700	2771020	At least users should have some transparency
2771020	2773980	of the state of security for the company
2773980	2776280	that they use or trust.
2784490	2785990	Yeah, the patches.
2785990	2790150	I just told you about the patches
2790150	2794240	for what happened for the Zoom Linux app.
2795390	2800680	For what was happening with the image conversion,
2801170	2803470	they decided to not patch it
2803470	2806250	because they are not seeing sensitive data
2806250	2811310	and then that are being exposed.
2812150	2815660	Then what happened is they asked,
2816550	2820430	they stated that they are not using image magic,
2820430	2825030	but still the same behavior of the vulnerability
2825030	2828310	is being reproduced as a result of the image conversion.
2828310	2831330	So clearly something bad is happening,
2831330	2834630	but I'm not a part of Zoom
2835120	2839310	or I don't have a say on Zoom to have them fix that.
2839310	2844310	So my responsibility is just to,
2844310	2847190	as part of the research that I'm conducting,
2847190	2849630	is to just let them know.
2849630	2850710	And that's all.
2851690	2853050	What else?
2853350	2855510	The findings, the shadow IT,
2855510	2860510	I'm not sure if they started reviewing
2861270	2863450	all of their shadow IT instances.
2863450	2866150	That's something that they are supposed to do.
2866150	2868830	For the Kerberos server, they took it down,
2868830	2870910	which is good, which is awesome.
2872630	2876430	And yeah, they told us,
2876430	2878570	they told me that they are patching
2878570	2881330	all of the vulnerabilities for the Linux app
2881330	2887990	on the release of August 2nd or August 3rd.
2887990	2891270	It was released with no mention
2891270	2895570	for any security fixes or updates.
2898260	2902780	Yeah, for me, it was a difficult experience
2902780	2907400	to be able to report these vulnerabilities to them.
2907400	2910260	In the beginning, there was a lack of communication,
2910260	2911820	despite all of what was happening
2911820	2914780	or that I was hearing in the media.
2915900	2919040	Every now and then, I see that Zoom has patched
2919620	2921280	a critical or severe vulnerability
2921280	2927020	that was even attacking things that are less riskier
2927020	2928680	than what I have found,
2928680	2933840	but it was generating a lot of media PR
2933840	2937420	that is bad for or negative to Zoom.
2937420	2940460	And I assume that was the reason
2940460	2943140	why they are patching it that quickly,
2943800	2948420	comparing to my experience to Zoom VDP.
2950080	2953340	And yeah, of course, I did not release anything
2953340	2956140	that I found before this talk.
2957880	2963400	To other parties or unauthorized parties.
2965540	2969140	And yeah, so it was not mentioned in the media before.
2969140	2971340	I did not share it with anyone in the media.
2971340	2975360	That's probably one reason it wasn't that fixed
2975360	2977420	or my experience wasn't as the same
2977420	2980780	as the vulnerabilities that was shared in the media.
2981280	2983040	And that's one thing.
2983140	2985920	I'm not sure, but I would be surprised
2985920	2990040	if I'm the only researcher in the world
2990040	2994220	that had this experience with Zoom security.
2994220	2996740	I would be really surprised about that.
2998060	3003400	Another part is the massive growth versus security.
3004820	3008160	Zoom has massively grown in 2020
3008480	3011300	in a way that no one could have imagined.
3011820	3014500	Zoom has been here forever.
3014500	3018780	And what the growth that they got during 2020
3020160	3023440	was something that for me,
3023440	3026520	it was like no one would have expected this to happen.
3028580	3032100	And this reflected a lot on the security.
3032100	3036620	A lot of people have a clear focus on the security of Zoom
3036620	3040100	since it became a part of our lives.
3040820	3042200	Everyone is using it.
3042200	3045760	I use it, my company use it,
3045760	3049000	everyone that I know use Zoom.
3050400	3055000	And that's why security is extremely important now for Zoom.
3055100	3060040	And the thing is having security means
3060040	3063260	that you have to have a full security program running.
3063300	3066540	It's not that easy to have a full security program.
3066540	3070060	And there are a lot of things to consider when doing that.
3070560	3074260	For me, when I build security programs in companies,
3074260	3078220	I take a lot of time to do that.
3078220	3080240	And this is a typical thing.
3080360	3083280	Even if we have the highest budget,
3084600	3086780	similar to what Zoom is having,
3086780	3093520	it does not come to how much budget is allocated to Zoom,
3094120	3095340	to Zoom security.
3095340	3097680	It's about different processes
3097680	3101620	that should have been already done before the pandemic.
3102840	3105540	And having a last-minute security program
3105540	3108100	or a last-minute VDP,
3108600	3110520	Probability Disclosure Program,
3111500	3115820	is not easy and can cause a lot of errors
3115820	3118180	and mistakes happening.
3119060	3122740	Lack of communications and focus.
3122740	3126820	These type of patterns that I have seen with Zoom
3126820	3129440	is something that are possibly happening
3129440	3131020	to all of the researchers
3131720	3137120	that have been reporting to Zoom responsibly.
3138500	3141480	I'm just saying that there is a lot of work
3141480	3145100	for the security program at Zoom to be done.
3147110	3148490	The reward?
3148490	3150070	Yeah, that's another thing.
3152050	3155150	One thing that I also seen that Zoom accounts
3155780	3159550	like have as advertised a bug bounty program
3160440	3164370	and then have the reward for all of the research
3164370	3168670	that they have conducted as zero USD.
3168930	3170550	This is not a...