1 00:00:00,000 --> 00:00:05,000 - This is Patrick Wordle and his talk is You're Muted. 2 00:00:07,290 --> 00:00:08,943 Scratch that, Rooted. 3 00:00:12,133 --> 00:00:15,133 (audience applauds) 4 00:00:19,950 --> 00:00:24,120 - Loha and welcome to my talk on exploiting Zoom. 5 00:00:24,120 --> 00:00:24,953 My name is Patrick. 6 00:00:24,953 --> 00:00:28,170 I am the founder of the Objective-See Foundation. 7 00:00:28,170 --> 00:00:30,240 House write free open source Mac security tools. 8 00:00:30,240 --> 00:00:31,710 Write some books on Mac malware 9 00:00:31,710 --> 00:00:33,870 and organize the Objective by the see 10 00:00:33,870 --> 00:00:35,403 Mac security conference. 11 00:00:36,810 --> 00:00:37,830 So today we're gonna learn about 12 00:00:37,830 --> 00:00:40,080 local privilege escalation vulnerabilities 13 00:00:40,080 --> 00:00:42,600 impacting Zoom's Mac OS clients. 14 00:00:42,600 --> 00:00:45,390 Bugs that allowed a local attacker 15 00:00:45,390 --> 00:00:47,700 or an unprivileged piece of malware, 16 00:00:47,700 --> 00:00:49,263 the ability to gain root. 17 00:00:50,160 --> 00:00:51,510 So we'll start the talk, 18 00:00:51,510 --> 00:00:54,630 highlighting some previous but relevant research. 19 00:00:54,630 --> 00:00:57,300 And also talk about an interesting new feature 20 00:00:57,300 --> 00:00:59,910 that was introduced recently in Zoom. 21 00:00:59,910 --> 00:01:03,930 We'll then discuss a crypto bug, a downgrade attack, 22 00:01:03,930 --> 00:01:05,760 and then end the talk talking about 23 00:01:05,760 --> 00:01:08,490 how Zoom fix these vulnerabilities. 24 00:01:08,490 --> 00:01:10,200 Now, besides learning about these bugs. 25 00:01:10,200 --> 00:01:13,260 I also hope that this talk highlights the techniques and 26 00:01:13,260 --> 00:01:16,290 approaches I use to find vulnerabilities on Mac OS 27 00:01:16,290 --> 00:01:19,113 that maybe you can apply to your own research as well. 28 00:01:20,760 --> 00:01:23,520 So let's start the talk by looking at some relevant 29 00:01:23,520 --> 00:01:26,610 background information, some previous research, 30 00:01:26,610 --> 00:01:28,530 as well as highlighting a new feature 31 00:01:28,530 --> 00:01:30,750 that was recently added to Zoom, 32 00:01:30,750 --> 00:01:34,170 a feature that is central to all the new bugs 33 00:01:34,170 --> 00:01:35,720 you'll be learning about today. 34 00:01:37,380 --> 00:01:41,100 So if you are at DEFCON 25 in 2017, 35 00:01:41,100 --> 00:01:43,590 you might have seen in my talk on installers, 36 00:01:43,590 --> 00:01:47,880 the TLDR of that talk was basically as follows, 37 00:01:47,880 --> 00:01:51,060 installers often run as root, 38 00:01:51,060 --> 00:01:55,410 but with these elevated privileges perform unsafe actions 39 00:01:55,410 --> 00:01:59,400 that would allow local attacker or unprivileged malware, 40 00:01:59,400 --> 00:02:02,340 the opportunity to surreptitiously subvert, 41 00:02:02,340 --> 00:02:04,770 the install process to gain root access. 42 00:02:04,770 --> 00:02:07,710 So for example, as we can see on the slide, 43 00:02:07,710 --> 00:02:11,190 an installer will authenticate with user 44 00:02:11,190 --> 00:02:14,460 and then maybe drop a file to a temporary location 45 00:02:14,460 --> 00:02:17,430 or some other world writeable location. 46 00:02:17,430 --> 00:02:20,250 It will then execute sometime thereafter, 47 00:02:20,250 --> 00:02:21,083 this file. 48 00:02:21,083 --> 00:02:24,060 So obviously there's a window where a local attacker or 49 00:02:24,060 --> 00:02:26,700 unprivileged malware could go in and subvert that file 50 00:02:26,700 --> 00:02:29,550 'cause it's world writeable, add some malicious commands. 51 00:02:29,550 --> 00:02:31,710 And then when the installer comes to complete the install, 52 00:02:31,710 --> 00:02:33,570 it'll execute those additional commands, 53 00:02:33,570 --> 00:02:34,893 giving the attacker root. 54 00:02:36,930 --> 00:02:39,150 More recently in 2020, 55 00:02:39,150 --> 00:02:40,560 kind of the beginning of the pandemic 56 00:02:40,560 --> 00:02:43,470 when Zoom was really blowing up in terms of popularity, 57 00:02:43,470 --> 00:02:46,980 I dug around in Zoom and the motivation for that. 58 00:02:46,980 --> 00:02:49,080 And also the other bugs we're talking today 59 00:02:49,080 --> 00:02:51,510 is I'm a user of Mac, sorry of Zoom. 60 00:02:51,510 --> 00:02:53,820 And if it's running on my system, 61 00:02:53,820 --> 00:02:56,100 I wanna make sure that it's reasonably safe 62 00:02:56,100 --> 00:03:00,270 and not opening up my computer to a large amount of attacks. 63 00:03:00,270 --> 00:03:02,400 So I was digging around in its installer code 64 00:03:02,400 --> 00:03:04,470 and I found exactly the type of flaw 65 00:03:04,470 --> 00:03:06,770 that I talked about at my DEFCON presentation. 66 00:03:07,620 --> 00:03:08,490 So we can see on the slide, 67 00:03:08,490 --> 00:03:12,180 I ran a process monitor to see exactly what the zoom 68 00:03:12,180 --> 00:03:14,700 installer was doing behind the scenes. 69 00:03:14,700 --> 00:03:16,500 And we can see that it's executing 70 00:03:16,500 --> 00:03:19,110 a script called run with root. 71 00:03:19,110 --> 00:03:22,200 If we look at the UUID, the UID we can see it zero, 72 00:03:22,200 --> 00:03:25,350 which means it's actually yes, executing as root. 73 00:03:25,350 --> 00:03:27,540 However, if we look at the permissions of this file, 74 00:03:27,540 --> 00:03:29,220 we can see it's world writeable. 75 00:03:29,220 --> 00:03:30,240 It's owned by the user, 76 00:03:30,240 --> 00:03:31,950 even though it's being executed by root. 77 00:03:31,950 --> 00:03:33,030 So you get a local attacker could 78 00:03:33,030 --> 00:03:34,800 very easily modify this file. 79 00:03:34,800 --> 00:03:36,120 And then when the installer comes along 80 00:03:36,120 --> 00:03:37,710 and runs it with root privileges, 81 00:03:37,710 --> 00:03:40,170 whatever the attacker has added will be executed, 82 00:03:40,170 --> 00:03:42,150 giving the attacker the ability 83 00:03:42,150 --> 00:03:43,950 to elevate their privileges to root. 84 00:03:45,570 --> 00:03:47,850 Moving on, end of last year, 85 00:03:47,850 --> 00:03:49,050 this is where we're kind of transitioning 86 00:03:49,050 --> 00:03:50,130 to the new research. 87 00:03:50,130 --> 00:03:54,330 I noticed a new feature in Zoom unsurprisingly, 88 00:03:54,330 --> 00:03:57,450 when you either install Zoom or uninstall Zoom, 89 00:03:57,450 --> 00:03:59,790 it will prompt you for a password 90 00:03:59,790 --> 00:04:01,080 as we can see on the slide. 91 00:04:01,080 --> 00:04:03,750 This makes sense as the installer and conversely, 92 00:04:03,750 --> 00:04:06,783 the uninstall need to perform privilege actions. 93 00:04:07,680 --> 00:04:08,760 However, there was a new feature 94 00:04:08,760 --> 00:04:13,110 I noticed, an auto update, which is enabled by default, 95 00:04:13,110 --> 00:04:16,860 and it appeared to be able to install new updates without 96 00:04:16,860 --> 00:04:20,520 requiring any user interaction, no password, 97 00:04:20,520 --> 00:04:22,230 no need to authenticate. 98 00:04:22,230 --> 00:04:25,380 Now, this is obviously neat from a usability point of view, 99 00:04:25,380 --> 00:04:26,940 but from a security point of view, 100 00:04:26,940 --> 00:04:28,350 this really peaked my interest. 101 00:04:28,350 --> 00:04:29,460 I was like, how is this working? 102 00:04:29,460 --> 00:04:30,293 What's going on? 103 00:04:31,200 --> 00:04:33,150 So let's dig into this a little more 104 00:04:33,150 --> 00:04:35,130 because we need to gain a fundamental understanding 105 00:04:35,130 --> 00:04:36,900 of how this new feature works 106 00:04:36,900 --> 00:04:38,640 in order to understand the bugs 107 00:04:38,640 --> 00:04:41,490 we will talk about shortly thereafter. 108 00:04:41,490 --> 00:04:43,710 So again, if we fire up a process monitor, 109 00:04:43,710 --> 00:04:46,530 we can watch what's going on behind the scenes. 110 00:04:46,530 --> 00:04:49,170 I'd like to start with a file monitor process monitor, 111 00:04:49,170 --> 00:04:51,450 before jumping into disassembly or debugging. 112 00:04:51,450 --> 00:04:53,550 'Cause oftentimes you can get a very good insight 113 00:04:53,550 --> 00:04:55,080 into what is going on 114 00:04:55,080 --> 00:04:57,510 without actually having to do a lot of work. 115 00:04:57,510 --> 00:05:01,110 So we can see that the Zoom application executes 116 00:05:01,110 --> 00:05:05,283 an updater application called ZoomAutoUpdater.app, 117 00:05:06,270 --> 00:05:07,860 and I've highlighted two things about it. 118 00:05:07,860 --> 00:05:09,840 We can see the path to the application 119 00:05:09,840 --> 00:05:11,520 and also the fact that it contains 120 00:05:11,520 --> 00:05:14,490 or rather takes a myriad of command line options. 121 00:05:14,490 --> 00:05:16,530 And one of these options is the path 122 00:05:16,530 --> 00:05:20,223 to the update package containing the new code. 123 00:05:21,570 --> 00:05:23,190 So now let's do some disassembly. 124 00:05:23,190 --> 00:05:25,530 If we disassemble the updater app, 125 00:05:25,530 --> 00:05:28,440 we can see it making an XPC connection 126 00:05:28,440 --> 00:05:31,460 to a mock service named uszoom.ZoomDaemon. 127 00:05:32,569 --> 00:05:35,220 This is just kind of like IPC mechanism, 128 00:05:35,220 --> 00:05:37,200 one process connecting to another. 129 00:05:37,200 --> 00:05:38,040 So that was interesting. 130 00:05:38,040 --> 00:05:40,350 It was like what's going on here? 131 00:05:40,350 --> 00:05:41,183 So it did a little more research 132 00:05:41,183 --> 00:05:44,550 and I found this maps to a privilege Zoom Daemon 133 00:05:44,550 --> 00:05:47,040 that runs with root privileges. 134 00:05:47,040 --> 00:05:50,040 If we look at the Daemon's property list, 135 00:05:50,040 --> 00:05:52,230 we can see as it's shown on the slide, 136 00:05:52,230 --> 00:05:54,750 the path to the binary of this Daemon 137 00:05:54,750 --> 00:05:56,910 and it's exists or lives in the 138 00:05:56,910 --> 00:05:59,883 protected privileged helper tool directory. 139 00:06:01,410 --> 00:06:03,660 So let's dig a little deeper into this binary. 140 00:06:03,660 --> 00:06:05,310 Again, this appeared to be a new binary 141 00:06:05,310 --> 00:06:06,270 and it's running as roots. 142 00:06:06,270 --> 00:06:07,830 So from a security point of view, 143 00:06:07,830 --> 00:06:09,540 always good to audit those. 144 00:06:09,540 --> 00:06:12,180 So the first thing I did, I used a tool called class dump, 145 00:06:12,180 --> 00:06:15,780 which allows you to dump classes and methods implemented in 146 00:06:15,780 --> 00:06:18,270 this privileged Zoom Daemon. 147 00:06:18,270 --> 00:06:21,240 Here's a snippet from that output and it includes 148 00:06:21,240 --> 00:06:24,630 an XPC protocol class and its method. 149 00:06:24,630 --> 00:06:26,460 And one of the methods that stood out to me 150 00:06:26,460 --> 00:06:29,670 was something called install new package. 151 00:06:29,670 --> 00:06:31,440 And as we'll see on the next slide, 152 00:06:31,440 --> 00:06:33,900 this is what was invoked by the Zoom clients 153 00:06:33,900 --> 00:06:35,970 to perform a privileged install 154 00:06:35,970 --> 00:06:37,570 without the need for a password. 155 00:06:38,880 --> 00:06:41,460 So if we step back to the updater application, 156 00:06:41,460 --> 00:06:43,920 looking more at its disassembly, 157 00:06:43,920 --> 00:06:48,090 we can see it connecting to the privileged Zoom Daemon, 158 00:06:48,090 --> 00:06:50,580 and then invoking that aforementioned 159 00:06:50,580 --> 00:06:52,563 install new package method, 160 00:06:53,520 --> 00:06:54,990 really neat feature of Objective-See 161 00:06:54,990 --> 00:06:58,380 is processes can actually invoke other methods 162 00:06:58,380 --> 00:06:59,550 in a remote process. 163 00:06:59,550 --> 00:07:01,500 So that's exactly what's going on here. 164 00:07:02,490 --> 00:07:04,775 So once the updater application calls 165 00:07:04,775 --> 00:07:08,250 into the Daemon to install a new package, 166 00:07:08,250 --> 00:07:10,530 the install is completed when the Daemon 167 00:07:10,530 --> 00:07:15,240 actually executes Mac OS's built in installer binary, 168 00:07:15,240 --> 00:07:16,560 along with the update package. 169 00:07:16,560 --> 00:07:18,900 And as this Zoom Daemon is running 170 00:07:18,900 --> 00:07:20,460 with elevated privileges, right? 171 00:07:20,460 --> 00:07:21,840 It's running as root. 172 00:07:21,840 --> 00:07:24,840 The installer that it spawns also runs with root. 173 00:07:24,840 --> 00:07:27,030 So this is why the user does not have 174 00:07:27,030 --> 00:07:29,550 to type or reenter their password 175 00:07:29,550 --> 00:07:32,583 when an auto update or a new install is performed. 176 00:07:34,230 --> 00:07:37,380 So now we know how updates can be installed 177 00:07:37,380 --> 00:07:40,350 without the need for a user's password. 178 00:07:40,350 --> 00:07:43,050 Now, this privilege Daemon, as I mentioned, 179 00:07:43,050 --> 00:07:45,090 was new and kind of a new attack surface. 180 00:07:45,090 --> 00:07:46,620 So as a Zoom user, 181 00:07:46,620 --> 00:07:49,440 my first question was is this secure? 182 00:07:49,440 --> 00:07:52,800 Or is this opening up my system to new vulnerabilities? 183 00:07:52,800 --> 00:07:55,650 And well, the good news was at first glance, 184 00:07:55,650 --> 00:07:57,120 the answer appeared to be yes, 185 00:07:57,120 --> 00:07:59,850 and Zoom was doing two important things to ensure, 186 00:07:59,850 --> 00:08:01,650 or at least try to ensure that the security 187 00:08:01,650 --> 00:08:04,830 of this privileged Daemon. 188 00:08:04,830 --> 00:08:07,290 So first they implement some code and we'll look at this on 189 00:08:07,290 --> 00:08:12,120 the next slide to only allow privileged and authenticated 190 00:08:12,120 --> 00:08:14,700 Zoom clients to talk to the Daemon. 191 00:08:14,700 --> 00:08:15,533 This is really good. 192 00:08:15,533 --> 00:08:17,640 You don't want random binaries connecting 193 00:08:17,640 --> 00:08:20,940 to your privileged Daemon and invoking its method. 194 00:08:20,940 --> 00:08:22,440 Secondly, it also appeared that 195 00:08:22,440 --> 00:08:25,050 Zoom was validating the cryptographic signatures 196 00:08:25,050 --> 00:08:26,340 of the update package. 197 00:08:26,340 --> 00:08:28,140 Again, this is a great idea. 198 00:08:28,140 --> 00:08:29,610 You don't want the Zoom updater 199 00:08:29,610 --> 00:08:33,180 running arbitrary packages again as root. 200 00:08:33,180 --> 00:08:36,180 So let's take a closer look at both of these. 201 00:08:36,180 --> 00:08:38,460 First up, in the privileged Zoom Daemon, 202 00:08:38,460 --> 00:08:41,580 there is a method called isValidConnection, 203 00:08:41,580 --> 00:08:45,210 which is invoked automatically anytime a client attempts to 204 00:08:45,210 --> 00:08:46,590 connect to the Daemon 205 00:08:46,590 --> 00:08:49,410 and then execute its privileged methods. 206 00:08:49,410 --> 00:08:51,180 So as we can see on the slide, 207 00:08:51,180 --> 00:08:54,780 the Zoom Daemon will validate the cryptographic signature of 208 00:08:54,780 --> 00:08:56,820 the client that is trying to connect to it 209 00:08:56,820 --> 00:08:59,190 and only allow that connection 210 00:08:59,190 --> 00:09:02,610 if it has been signed with, by Zoom proper. 211 00:09:02,610 --> 00:09:03,810 So this code looks solid. 212 00:09:03,810 --> 00:09:05,210 This all looks really great. 213 00:09:06,450 --> 00:09:10,200 The second security check, the Zoom Daemon also checks, 214 00:09:10,200 --> 00:09:11,033 as I mentioned, 215 00:09:11,033 --> 00:09:13,590 the signature of the package that it's about to install, 216 00:09:13,590 --> 00:09:14,820 the auto update package. 217 00:09:14,820 --> 00:09:16,140 And it does this in a method called 218 00:09:16,140 --> 00:09:19,170 check PKG package authority. 219 00:09:19,170 --> 00:09:21,270 And what we can see if we look at the disassembly 220 00:09:21,270 --> 00:09:25,050 is that it actually executes a built in command line utility 221 00:09:25,050 --> 00:09:27,930 for Mac OS called package utility 222 00:09:27,930 --> 00:09:30,060 with the check signature flag. 223 00:09:30,060 --> 00:09:32,310 And then it grabs the output from this, 224 00:09:32,310 --> 00:09:34,440 looks for the certificate authority chain 225 00:09:34,440 --> 00:09:36,570 to make sure that the package that it's about 226 00:09:36,570 --> 00:09:39,060 to install is installed by Zoom proper, 227 00:09:39,060 --> 00:09:41,523 so far, so good, right? 228 00:09:42,420 --> 00:09:43,833 Well, unfortunately not. 229 00:09:45,090 --> 00:09:48,450 So we just showed that the Zoom Daemon checks the signature 230 00:09:48,450 --> 00:09:50,610 of any installer update package 231 00:09:50,610 --> 00:09:51,780 in an attempt to ensure that 232 00:09:51,780 --> 00:09:54,690 only Zoom packages are executed. 233 00:09:54,690 --> 00:09:55,523 As I mentioned, obviously, 234 00:09:55,523 --> 00:09:58,050 this is a good idea, but as is the case, 235 00:09:58,050 --> 00:10:01,230 almost always the security or the insecurity 236 00:10:01,230 --> 00:10:04,143 of a good idea comes down to the implementation. 237 00:10:05,190 --> 00:10:08,550 So we noted that Zoom executes Mac OS PKG utility with a 238 00:10:08,550 --> 00:10:09,810 check signature flag. 239 00:10:09,810 --> 00:10:11,910 This will check that the package is validly signed, 240 00:10:11,910 --> 00:10:14,880 and then also extract the certificate chain. 241 00:10:14,880 --> 00:10:16,320 We can see this on the slide. 242 00:10:16,320 --> 00:10:17,153 For example, 243 00:10:17,153 --> 00:10:22,110 if you execute the PKG utility yourself 244 00:10:22,110 --> 00:10:22,943 and give it a package, 245 00:10:22,943 --> 00:10:24,120 you can kind of see the output, right? 246 00:10:24,120 --> 00:10:26,403 So we see things like the certificate chain. 247 00:10:28,590 --> 00:10:31,470 Using the PKG utility is fine, right? 248 00:10:31,470 --> 00:10:32,730 That code is solid, 249 00:10:32,730 --> 00:10:34,710 but we need to take a closer look 250 00:10:34,710 --> 00:10:37,920 at how Zoom then ingests and processes 251 00:10:37,920 --> 00:10:40,320 the output from this utility. 252 00:10:40,320 --> 00:10:41,153 So on the slide, 253 00:10:41,153 --> 00:10:42,150 we have the disassembly from 254 00:10:42,150 --> 00:10:44,700 the Daemons checkPkgAuthority method, 255 00:10:44,700 --> 00:10:48,390 and we can see that after they execute the PKG utility, 256 00:10:48,390 --> 00:10:51,480 they open a pipe and read all its input, 257 00:10:51,480 --> 00:10:53,280 rather all its output from standard out, 258 00:10:53,280 --> 00:10:55,920 and then look for the strings in the certificate authority 259 00:10:55,920 --> 00:10:57,663 chain, that match Zoom. 260 00:10:59,970 --> 00:11:02,160 Now the rather hilarious flaw, 261 00:11:02,160 --> 00:11:05,190 the issue is that Zoom looks for the certificate strings in 262 00:11:05,190 --> 00:11:08,220 the entire output from PKG utility. 263 00:11:08,220 --> 00:11:09,840 And guess what else is included 264 00:11:09,840 --> 00:11:12,450 in the output from the PKG utility? 265 00:11:12,450 --> 00:11:15,030 The name of the package, such fail. 266 00:11:15,030 --> 00:11:17,370 So what we can do is we can just rename any package, 267 00:11:17,370 --> 00:11:20,130 even malicious ones, Zoom Video Communications Inc 268 00:11:20,130 --> 00:11:21,990 developer ID, certificate authority, apple, 269 00:11:21,990 --> 00:11:26,193 root CA.PKG, and bypass the verification. 270 00:11:27,253 --> 00:11:28,620 As we can see on the slide again, 271 00:11:28,620 --> 00:11:31,770 this is because that the name is first printed out 272 00:11:31,770 --> 00:11:33,540 by the PKG utility, 273 00:11:33,540 --> 00:11:36,270 meaning that the strings Zoom is looking for. 274 00:11:36,270 --> 00:11:37,103 Because again, 275 00:11:37,103 --> 00:11:39,750 they're looking for these strings in the entire output from 276 00:11:39,750 --> 00:11:41,913 PKG utility will be found. 277 00:11:43,140 --> 00:11:46,740 We can confirm this by popping into a debugger specifically, 278 00:11:46,740 --> 00:11:50,880 we debug the checkPkgAuthority method in the Daemon. 279 00:11:50,880 --> 00:11:53,730 So on the slide note that the package we're asking Zoom to 280 00:11:53,730 --> 00:11:56,010 install is named in that malicious manner. 281 00:11:56,010 --> 00:11:57,900 Essentially, we put the strings it's looking for 282 00:11:57,900 --> 00:12:00,390 in the certificate chain, in the name of the package. 283 00:12:00,390 --> 00:12:02,940 And then we can see the verification method 284 00:12:02,940 --> 00:12:06,900 at the bottom of the slide is returning one or true, 285 00:12:06,900 --> 00:12:09,990 meaning it thinks that the package has been signed by Zoom, 286 00:12:09,990 --> 00:12:12,093 even though obviously it has not. 287 00:12:13,920 --> 00:12:17,550 Now around the time I found this bug, I was really stoked, 288 00:12:17,550 --> 00:12:20,100 but that same week Zoom pushed out 289 00:12:20,100 --> 00:12:22,170 an unrelated security update, 290 00:12:22,170 --> 00:12:24,960 which actually meant that I had to find another bug for a 291 00:12:24,960 --> 00:12:28,560 full exploit chain, but it turns out that wasn't problem. 292 00:12:28,560 --> 00:12:32,850 So Zoom version 5.9 was released with security enhancements. 293 00:12:32,850 --> 00:12:35,370 And one of these enhancements impacted 294 00:12:35,370 --> 00:12:38,310 the exploitation of this package, renamed check, 295 00:12:38,310 --> 00:12:39,900 I just talked about. 296 00:12:39,900 --> 00:12:43,710 Though Zoom didn't fix the buggy package validation, 297 00:12:43,710 --> 00:12:47,400 they still executed the PKG utility, read all the output, 298 00:12:47,400 --> 00:12:48,930 look for the strings. 299 00:12:48,930 --> 00:12:51,870 Another part of their security enhancement logic 300 00:12:51,870 --> 00:12:54,360 meant that they now renamed the package 301 00:12:54,360 --> 00:12:56,253 before doing the verification. 302 00:12:57,270 --> 00:13:00,990 So unfortunately that means when they rename the package. 303 00:13:00,990 --> 00:13:03,600 If we have a package with the certificate authorities 304 00:13:03,600 --> 00:13:05,940 in the name, that doesn't matter anymore, 305 00:13:05,940 --> 00:13:08,070 because Zoom is gonna rename the package first, 306 00:13:08,070 --> 00:13:11,010 essentially wiping out those strings. 307 00:13:11,010 --> 00:13:13,717 Now I noted the check is still done via the PKG utility. 308 00:13:13,717 --> 00:13:16,020 So they're still looking for those strings. 309 00:13:16,020 --> 00:13:19,380 So it did appear that there's perhaps other ways to still 310 00:13:19,380 --> 00:13:21,840 exploit that perhaps you could get a certificate that had 311 00:13:21,840 --> 00:13:24,900 all those strings in one name or something, 312 00:13:24,900 --> 00:13:26,673 but now it was definitely harder. 313 00:13:28,020 --> 00:13:31,860 So I was kind of pondering this in the shower as one does. 314 00:13:31,860 --> 00:13:34,560 And I had this shower thought and I was like, wait a minute. 315 00:13:34,560 --> 00:13:37,770 So yeah, it sucks that Zoom pushed out this update, 316 00:13:37,770 --> 00:13:40,950 but can I ask Zoom just to install 317 00:13:40,950 --> 00:13:42,330 an older version of itself, 318 00:13:42,330 --> 00:13:45,540 one that doesn't have these additional security checks? 319 00:13:45,540 --> 00:13:47,280 So I went back to the installer 320 00:13:47,280 --> 00:13:50,070 and I looked at its update logic in the Daemon, 321 00:13:50,070 --> 00:13:52,050 and we can see that there was no check 322 00:13:52,050 --> 00:13:54,420 on the version that they're installing. 323 00:13:54,420 --> 00:13:57,780 So this means it will gladly end naively install, 324 00:13:57,780 --> 00:14:01,050 any version of Zoom, even older buggy ones, 325 00:14:01,050 --> 00:14:02,970 as long as they are still signed by Zoom. 326 00:14:02,970 --> 00:14:04,120 And they all still are. 327 00:14:05,850 --> 00:14:07,380 So armed with these bugs, 328 00:14:07,380 --> 00:14:09,420 now let's talk about exploiting Zoom 329 00:14:09,420 --> 00:14:11,223 from Zoom to root. 330 00:14:12,630 --> 00:14:14,190 First off, we kind of have an issue that 331 00:14:14,190 --> 00:14:17,640 I've ignored or glossed over so far. 332 00:14:17,640 --> 00:14:19,860 So recall that Zoom the privileged Zoom, 333 00:14:19,860 --> 00:14:24,360 Daemon only allows validly sign Zoom clients 334 00:14:24,360 --> 00:14:25,890 to talk to this. 335 00:14:25,890 --> 00:14:30,030 So does this mean that we can't trigger the bug at any time? 336 00:14:30,030 --> 00:14:32,610 Do we have to wait until there's a legitimate install 337 00:14:32,610 --> 00:14:33,750 that comes down for Zoom 338 00:14:33,750 --> 00:14:36,810 and then hopefully pop in at the right time? 339 00:14:36,810 --> 00:14:37,960 That would suck. Right? 340 00:14:39,120 --> 00:14:42,150 Well, while we were reversing the auto update process, 341 00:14:42,150 --> 00:14:45,510 we saw that the update request to the update daemon 342 00:14:45,510 --> 00:14:48,270 was triggered by a standalone application, 343 00:14:48,270 --> 00:14:50,400 the Zoom auto update application. 344 00:14:50,400 --> 00:14:52,620 And if we reverse engineer that, 345 00:14:52,620 --> 00:14:55,320 we see that the updater application takes 346 00:14:55,320 --> 00:14:57,720 a myriad of arguments, including, as I mentioned before, 347 00:14:57,720 --> 00:15:00,153 the path to the installed package. 348 00:15:01,110 --> 00:15:03,360 Now, as the Zoom auto update application 349 00:15:03,360 --> 00:15:05,280 is obviously signed by Zoom, 350 00:15:05,280 --> 00:15:07,170 it is a trusted client. 351 00:15:07,170 --> 00:15:10,290 So that means we can trigger an update anytime by just 352 00:15:10,290 --> 00:15:14,313 manually executing the Zoom auto update application ourself. 353 00:15:15,990 --> 00:15:18,480 All right. So now I'm gonna do a brief demo. 354 00:15:18,480 --> 00:15:21,150 It's always a good idea to do live demos, right? 355 00:15:21,150 --> 00:15:22,980 We're just gonna show the fact that we can trigger 356 00:15:22,980 --> 00:15:24,810 and install of Zoom at any time. 357 00:15:24,810 --> 00:15:25,830 So this isn't an exploit. 358 00:15:25,830 --> 00:15:29,370 I'm basically just gonna tell the privilege Daemon, Hey, 359 00:15:29,370 --> 00:15:32,010 I have an update for you and I'm gonna give it 360 00:15:32,010 --> 00:15:33,750 a real version of Zoom. 361 00:15:33,750 --> 00:15:35,310 So the first thing I wanna show you on the slide, 362 00:15:35,310 --> 00:15:38,040 we've run the PKG utility and the package 363 00:15:38,040 --> 00:15:40,803 I'm going to update is signed by Zoom. 364 00:15:42,000 --> 00:15:43,980 So execute this. This is obviously gonna work. 365 00:15:43,980 --> 00:15:47,040 I'm just telling the Daemon, oh, sorry. 366 00:15:47,040 --> 00:15:48,873 We lost the monitors. Thank you. 367 00:15:54,300 --> 00:15:55,800 Maybe if I turn off mirroring. 368 00:16:02,760 --> 00:16:04,800 Okay, let's try this again. 369 00:16:04,800 --> 00:16:08,883 Okay. So now we have the, make this a little bigger. 370 00:16:09,780 --> 00:16:12,450 We can see again, we run the PKG utility on the package. 371 00:16:12,450 --> 00:16:15,720 I'm going to tell Zoom to upgrade to, again, 372 00:16:15,720 --> 00:16:17,520 this is a legitimate version of Zoom. 373 00:16:17,520 --> 00:16:19,320 I'm not doing any exploit at this point. 374 00:16:19,320 --> 00:16:22,140 I'm basically running the auto update application. 375 00:16:22,140 --> 00:16:24,120 We can see here's the prompt from Zoom, 376 00:16:24,120 --> 00:16:27,600 and this is gonna just install a version of Zoom. 377 00:16:27,600 --> 00:16:28,440 Hooray, so again, 378 00:16:28,440 --> 00:16:30,450 this just shows that at any time 379 00:16:30,450 --> 00:16:33,780 we can tell the updated Daemon that, Hey, 380 00:16:33,780 --> 00:16:35,250 just to let you know, 381 00:16:35,250 --> 00:16:36,500 we can trigger an update. 382 00:16:38,100 --> 00:16:40,113 Okay, let's continue this. 383 00:16:42,600 --> 00:16:43,740 Okay, so now what we wanna do is 384 00:16:43,740 --> 00:16:46,170 we want to exploit to gain root. 385 00:16:46,170 --> 00:16:48,660 So we can do this in two steps. 386 00:16:48,660 --> 00:16:51,000 The first thing we do is we execute the auto update 387 00:16:51,000 --> 00:16:52,290 application that we just demoed. 388 00:16:52,290 --> 00:16:54,450 And we have it, an older version of Zoom. 389 00:16:54,450 --> 00:16:56,130 This is a validly signed version of Zoom, 390 00:16:56,130 --> 00:16:58,380 but it doesn't have the additional security enhancements 391 00:16:58,380 --> 00:17:00,600 that break the name trick. 392 00:17:00,600 --> 00:17:02,220 Once this has completed, 393 00:17:02,220 --> 00:17:05,400 we then execute the update application again, 394 00:17:05,400 --> 00:17:08,310 this time with our malicious package, 395 00:17:08,310 --> 00:17:11,430 that we've renamed so that it finds the certificate 396 00:17:11,430 --> 00:17:13,590 authority strings in the packaging, 397 00:17:13,590 --> 00:17:15,180 end result, we'll have a root shell. 398 00:17:15,180 --> 00:17:17,640 So here is a prerecorded demo. 399 00:17:17,640 --> 00:17:21,000 We can see we're gonna first execute the update installer, 400 00:17:21,000 --> 00:17:22,530 just like we did in the other demo. 401 00:17:22,530 --> 00:17:25,623 This is going to install an old version of Zoom. 402 00:17:26,460 --> 00:17:27,570 Once this is done, 403 00:17:27,570 --> 00:17:31,740 we're just gonna execute the auto update application again. 404 00:17:31,740 --> 00:17:32,573 This time though, 405 00:17:32,573 --> 00:17:35,700 you'll see the name of the package has this long name with 406 00:17:35,700 --> 00:17:36,873 all the certificate authority strengths 407 00:17:36,873 --> 00:17:40,350 that Zoom is looking for right there. 408 00:17:40,350 --> 00:17:45,120 And then this is gonna be executed and pop as root shell. 409 00:17:45,120 --> 00:17:45,953 So hooray. 410 00:17:48,233 --> 00:17:51,233 (audience applauds) 411 00:17:54,270 --> 00:17:56,940 But wait, we can make this better. 412 00:17:56,940 --> 00:17:58,140 In the video, the demo, 413 00:17:58,140 --> 00:18:00,930 we saw there was a big popup saying Zoom is updating. 414 00:18:00,930 --> 00:18:03,150 If you're an attacker, that's not good news. 415 00:18:03,150 --> 00:18:06,600 So I said, okay, how can we make this better? 416 00:18:06,600 --> 00:18:08,280 So I continue to reverse engineer 417 00:18:08,280 --> 00:18:09,720 the auto update application. 418 00:18:09,720 --> 00:18:10,553 And as I mentioned, 419 00:18:10,553 --> 00:18:12,420 it takes a myriad of arguments. 420 00:18:12,420 --> 00:18:15,030 Two of these arguments control the UI. 421 00:18:15,030 --> 00:18:17,430 These are interface of the upgrade, 422 00:18:17,430 --> 00:18:19,860 specifically the fifth and sixth, 423 00:18:19,860 --> 00:18:22,860 RB six and RB five arguments. 424 00:18:22,860 --> 00:18:25,440 If you set those to zero or false, 425 00:18:25,440 --> 00:18:29,640 this tells the updater to perform with no alerts silently. 426 00:18:29,640 --> 00:18:33,810 So this makes our exploit now 100% invisible. 427 00:18:33,810 --> 00:18:34,920 Hooray. 428 00:18:34,920 --> 00:18:38,580 So now let's talk about how Zoom fixed these bugs. 429 00:18:38,580 --> 00:18:40,920 I'm always interested in what they do. 430 00:18:40,920 --> 00:18:41,753 So first off, 431 00:18:41,753 --> 00:18:44,070 they assigned a CVE for the downgrade attack. 432 00:18:44,070 --> 00:18:47,460 This was fixed in version 5.9.6, 433 00:18:47,460 --> 00:18:50,460 which was released in April of this year, 434 00:18:50,460 --> 00:18:51,870 took about four months to fix that. 435 00:18:51,870 --> 00:18:55,380 And they gave out a nice bug bounty for that. 436 00:18:55,380 --> 00:18:59,670 This is the kind of security details from that. 437 00:18:59,670 --> 00:19:01,140 So let's dive now into the disassembly 438 00:19:01,140 --> 00:19:02,850 to see how they patch this. 439 00:19:02,850 --> 00:19:06,000 So this patch exists in the privilege Zoom Daemon, 440 00:19:06,000 --> 00:19:07,440 that's running with root privileges. 441 00:19:07,440 --> 00:19:10,920 And now what we can see is they're checking the version to 442 00:19:10,920 --> 00:19:14,610 make sure that whatever version is about to be installed 443 00:19:14,610 --> 00:19:16,980 is in fact, an equal or an upgrade. 444 00:19:16,980 --> 00:19:18,660 So it's not a downgrade. 445 00:19:18,660 --> 00:19:21,090 So they do this by unzipping the package, 446 00:19:21,090 --> 00:19:24,150 extracting the version number, and then new comparison, 447 00:19:24,150 --> 00:19:25,110 the very bottom of the slide, 448 00:19:25,110 --> 00:19:26,490 we can see where they do the comparison. 449 00:19:26,490 --> 00:19:29,100 And again, this ensures that the update version 450 00:19:29,100 --> 00:19:31,050 is indeed either equal to 451 00:19:31,050 --> 00:19:34,290 or greater than the currently installed version. 452 00:19:34,290 --> 00:19:36,570 So now if we try to perform the downgrade attack, 453 00:19:36,570 --> 00:19:38,583 as we can see on the slide, this is gonna fail. 454 00:19:38,583 --> 00:19:41,820 It's basically gonna say GTFO, this is an old version. 455 00:19:41,820 --> 00:19:43,530 I'm not gonna install this anymore. 456 00:19:43,530 --> 00:19:44,363 So that's great. 457 00:19:45,900 --> 00:19:47,160 The package validation vulnerability 458 00:19:47,160 --> 00:19:49,770 took a little longer to fix about seven months, but again, 459 00:19:49,770 --> 00:19:51,750 it paid out a nice bug bounty for that, 460 00:19:51,750 --> 00:19:53,943 this was fixed in July, 2022. 461 00:19:55,052 --> 00:19:57,690 And if we look at how they do this, 462 00:19:57,690 --> 00:20:00,240 we can figure out the new implementation 463 00:20:00,240 --> 00:20:02,880 to see how they securely patch 464 00:20:02,880 --> 00:20:05,940 and check the verification of packages. 465 00:20:05,940 --> 00:20:10,260 So if we use the O tool utility to dump the dependencies and 466 00:20:10,260 --> 00:20:13,830 then the NM tool to look at the new imports and methods, 467 00:20:13,830 --> 00:20:15,930 we can see that they're now leveraging some new 468 00:20:15,930 --> 00:20:18,150 cryptographic APIs. 469 00:20:18,150 --> 00:20:20,940 So instead of executing the PKG utility, 470 00:20:20,940 --> 00:20:23,340 they're now using various cryptographic APIs 471 00:20:23,340 --> 00:20:26,910 to check the code signing certificates 472 00:20:26,910 --> 00:20:28,890 of the package securely. 473 00:20:28,890 --> 00:20:30,930 So again, this is a sufficient fix 474 00:20:30,930 --> 00:20:33,180 and we can see that when we execute 475 00:20:33,180 --> 00:20:35,670 now a unsigned package or package 476 00:20:35,670 --> 00:20:38,823 that has been signed by anybody, but Zoom, this will fail. 477 00:20:41,250 --> 00:20:42,360 A better option, in my opinion, 478 00:20:42,360 --> 00:20:45,510 would be, do exactly what PKG utility does. 479 00:20:45,510 --> 00:20:47,640 So what I did is I reverse PKG utility 480 00:20:47,640 --> 00:20:50,550 and found the private framework it utilizes. 481 00:20:50,550 --> 00:20:53,340 And in that framework are some very powerful APIs that can 482 00:20:53,340 --> 00:20:57,300 check the digital certificate of any PKG for you. 483 00:20:57,300 --> 00:20:58,530 And so I release some code. 484 00:20:58,530 --> 00:21:01,350 This is actually how I verify packages in my tool. 485 00:21:01,350 --> 00:21:04,470 I mentioned it's a private framework, but other than that, 486 00:21:04,470 --> 00:21:06,480 that's exactly how Apple goes about doing it. 487 00:21:06,480 --> 00:21:09,510 So I figured, Hey, why not be inspired by them? 488 00:21:09,510 --> 00:21:10,410 So this is open source. 489 00:21:10,410 --> 00:21:11,310 If you pop on GitHub, 490 00:21:11,310 --> 00:21:15,000 you can check out how to securely validate packages using 491 00:21:15,000 --> 00:21:18,513 the same technique that Apple's PKG utility does. 492 00:21:20,580 --> 00:21:24,120 So that wasn't my DEFCON talk up to about a week ago. 493 00:21:24,120 --> 00:21:26,280 And I was like, okay, that's a solid talks, neat bugs. 494 00:21:26,280 --> 00:21:27,113 Everything's sticks. 495 00:21:27,113 --> 00:21:28,260 We talk about some reverse engineering, 496 00:21:28,260 --> 00:21:30,960 but I thought this is DEFCON, 497 00:21:30,960 --> 00:21:32,250 DEFCON demands great talk. 498 00:21:32,250 --> 00:21:34,380 So I wanted to dig a little bit more and again, 499 00:21:34,380 --> 00:21:36,870 I was in the shower pondering life now, and just kidding. 500 00:21:36,870 --> 00:21:38,821 I was pondering Zoom and I was like, 501 00:21:38,821 --> 00:21:40,650 there's still something that isn't quite 502 00:21:40,650 --> 00:21:41,820 sitting right with me. 503 00:21:41,820 --> 00:21:45,390 So now let's talk about another flaw that currently exists, 504 00:21:45,390 --> 00:21:47,010 even in the latest version of Zoom. 505 00:21:47,010 --> 00:21:49,193 So this is currently a zero day vulnerability. 506 00:21:50,220 --> 00:21:53,070 Recall that the update package 507 00:21:53,070 --> 00:21:56,250 is moved and renamed and then validated. 508 00:21:56,250 --> 00:21:58,320 And again, this was part of a security enhancement 509 00:21:58,320 --> 00:22:01,053 that broke my initial bug indirectly. 510 00:22:02,040 --> 00:22:04,140 So if we look at this a little closer, 511 00:22:04,140 --> 00:22:06,240 we can see the name of the package is always gonna be 512 00:22:06,240 --> 00:22:08,310 Zoom TMP.PKG. 513 00:22:08,310 --> 00:22:09,920 This is what Zoom renames it to. 514 00:22:09,920 --> 00:22:11,370 If we look at in a debugger, 515 00:22:11,370 --> 00:22:13,620 we can see the copy operation is performing. 516 00:22:13,620 --> 00:22:16,320 And what they're doing is they're copying it into a 517 00:22:16,320 --> 00:22:18,840 directory that is owned by root. 518 00:22:18,840 --> 00:22:23,280 Specifically the library application support, zoom.us. 519 00:22:23,280 --> 00:22:26,730 Once the package is copied into this directory, 520 00:22:26,730 --> 00:22:28,710 it is then verified correctly. 521 00:22:28,710 --> 00:22:33,710 Now using the more secure APIs and only if it passes the 522 00:22:33,780 --> 00:22:35,550 verification it's executed. 523 00:22:35,550 --> 00:22:36,510 So again, if we look at this, 524 00:22:36,510 --> 00:22:38,100 it's like, okay, this is great. 525 00:22:38,100 --> 00:22:39,600 Directory is owned by root. 526 00:22:39,600 --> 00:22:42,360 This means user just can't create new files. 527 00:22:42,360 --> 00:22:44,040 Can't delete files. 528 00:22:44,040 --> 00:22:45,330 They're using the new APIs. 529 00:22:45,330 --> 00:22:46,280 Everything's great. 530 00:22:47,130 --> 00:22:49,410 But, and this is a big but. 531 00:22:49,410 --> 00:22:52,050 There's a very nuanced issue here. 532 00:22:52,050 --> 00:22:54,270 So I mentioned the directory is owned by root. 533 00:22:54,270 --> 00:22:58,320 The problem is that when Zoom copies in the update package, 534 00:22:58,320 --> 00:23:00,540 they don't change the permissions. 535 00:23:00,540 --> 00:23:04,290 So even though it exists in a root owned directory, 536 00:23:04,290 --> 00:23:07,383 the update package is still world writeable. 537 00:23:07,383 --> 00:23:12,180 This means any local attacker unprivileged malware 538 00:23:12,180 --> 00:23:15,663 can surreptitiously modify the update package. 539 00:23:16,560 --> 00:23:21,450 This is a classic time to check, time to use race condition. 540 00:23:21,450 --> 00:23:23,400 Basically what happens as I mentioned is Zoom. 541 00:23:23,400 --> 00:23:25,500 The privilege Daemon comes along and copies, 542 00:23:25,500 --> 00:23:27,900 renames the application into the root directory. 543 00:23:28,830 --> 00:23:31,500 It verifies the signature, unzips it, 544 00:23:31,500 --> 00:23:33,690 and then installs it as root. 545 00:23:33,690 --> 00:23:36,330 So again, if we're correctly timed, 546 00:23:36,330 --> 00:23:39,210 is there an opportunity for us to surreptitiously pop in and 547 00:23:39,210 --> 00:23:42,210 modify this after the verification, 548 00:23:42,210 --> 00:23:44,610 but before the application is installed? 549 00:23:44,610 --> 00:23:46,260 It's a great question. 550 00:23:46,260 --> 00:23:50,040 The good news is this race window is rather large. 551 00:23:50,040 --> 00:23:53,430 And this is because that Zoom performs many other 552 00:23:53,430 --> 00:23:56,220 very expensive and slow operations 553 00:23:56,220 --> 00:23:58,620 after they have verified the package. 554 00:23:58,620 --> 00:24:00,540 But before they install it. 555 00:24:00,540 --> 00:24:02,760 Specifically, they unzip the package 556 00:24:02,760 --> 00:24:03,990 as part of the version check. 557 00:24:03,990 --> 00:24:06,840 And they do that by spawning additional processes, 558 00:24:06,840 --> 00:24:09,540 which is a very expensive and slow operation. 559 00:24:09,540 --> 00:24:11,733 So basically we have a very large window. 560 00:24:13,080 --> 00:24:14,220 So here's the exploit. 561 00:24:14,220 --> 00:24:15,240 It's about 10 lines of code. 562 00:24:15,240 --> 00:24:17,630 As I mentioned, works on the latest version of Zoom. 563 00:24:17,630 --> 00:24:20,130 So if you're running Zoom, lucky you 564 00:24:20,130 --> 00:24:22,290 and we can see it basically does three things. 565 00:24:22,290 --> 00:24:25,740 We execute the Zoom auto update application. 566 00:24:25,740 --> 00:24:29,010 Again, this allows us to trigger an update. 567 00:24:29,010 --> 00:24:31,890 We have to give it a validly signed package from Zoom. 568 00:24:31,890 --> 00:24:33,450 So we just grab the latest version. 569 00:24:33,450 --> 00:24:35,670 We don't actually care what it's installing. 570 00:24:35,670 --> 00:24:38,040 We just need to trigger any installation logic. 571 00:24:38,040 --> 00:24:39,360 And again, we can do this 572 00:24:39,360 --> 00:24:41,460 because the auto update utility 573 00:24:41,460 --> 00:24:43,140 is allowed to talk to the Zoom client. 574 00:24:43,140 --> 00:24:45,270 And the package we're telling Zoom to install 575 00:24:45,270 --> 00:24:47,640 is initially a valid Zoom claim. 576 00:24:47,640 --> 00:24:51,720 We then wait until the copy of the package comes along, 577 00:24:51,720 --> 00:24:53,670 wait an additional millisecond or two. 578 00:24:53,670 --> 00:24:56,040 And again, because Zoom forgot to update permissions 579 00:24:56,040 --> 00:24:57,240 of this package. 580 00:24:57,240 --> 00:25:00,720 We can now with no privileges, modify that package. 581 00:25:00,720 --> 00:25:03,510 As long as you do it before the installer is invoked. 582 00:25:03,510 --> 00:25:05,850 When the installer comes along with root privileges, 583 00:25:05,850 --> 00:25:08,043 it will then install our package. 584 00:25:09,840 --> 00:25:12,150 All right, I'm gonna say a prayer to the demo gods, 585 00:25:12,150 --> 00:25:14,040 'cause we're gonna try to do a live demo 586 00:25:14,040 --> 00:25:15,630 of a race condition. 587 00:25:15,630 --> 00:25:18,513 Ye Okay, here we go. 588 00:25:21,900 --> 00:25:23,220 So what were we gonna do? 589 00:25:23,220 --> 00:25:25,260 And we'll look at the exploit clothes shortly is 590 00:25:25,260 --> 00:25:27,330 we're going to perform those three steps 591 00:25:27,330 --> 00:25:28,890 and this is obviously gonna work. 592 00:25:28,890 --> 00:25:32,284 So first we see the installation coming along. 593 00:25:32,284 --> 00:25:34,203 I totally jinxed myself. 594 00:25:35,910 --> 00:25:38,253 Wait for it, wait for it. 595 00:25:40,470 --> 00:25:41,460 I didn't actually say a prayer. 596 00:25:41,460 --> 00:25:42,960 So maybe that was the problem. 597 00:25:46,620 --> 00:25:48,540 Sometimes it takes a while. 598 00:25:48,540 --> 00:25:50,140 All right, let's try this again. 599 00:25:53,520 --> 00:25:58,200 So let me just maybe see if the installer 600 00:25:58,200 --> 00:26:02,280 is running now. 601 00:26:02,280 --> 00:26:06,210 Let's see if we can come over here and do the all update. 602 00:26:06,210 --> 00:26:07,660 Might need to reinstall Zoom. 603 00:26:08,790 --> 00:26:09,900 I did make a video of this. 604 00:26:09,900 --> 00:26:11,038 So if this fails, 605 00:26:11,038 --> 00:26:12,513 we'll just look at that. 606 00:26:13,920 --> 00:26:15,330 So I'm just gonna reinstall Zoom, 607 00:26:15,330 --> 00:26:17,763 kinda get a base condition. 608 00:26:20,220 --> 00:26:21,053 Come on. 609 00:26:29,450 --> 00:26:31,713 Okay. Lemme look, one more thing. 610 00:26:39,570 --> 00:26:41,073 See installer. 611 00:26:43,770 --> 00:26:45,970 Okay. Maybe we'll try this again at the end. 612 00:26:48,720 --> 00:26:49,890 Huh? Okay. 613 00:26:49,890 --> 00:26:51,993 Well, clearly I broke something. 614 00:26:58,920 --> 00:27:00,590 Maybe Zoom's asking me to install it. 615 00:27:00,590 --> 00:27:02,220 So let me try one more thing. 616 00:27:02,220 --> 00:27:04,173 And if not, we will move on. 617 00:27:05,070 --> 00:27:07,200 Okay. Lots of Zoom things running. 618 00:27:07,200 --> 00:27:08,750 Let me just kill these quickly. 619 00:27:10,050 --> 00:27:11,493 Appreciate your patience. 620 00:27:14,730 --> 00:27:19,473 Maybe I tried the demo too many times kill dash nine. 621 00:27:20,544 --> 00:27:21,783 And is that all of them? 622 00:27:27,120 --> 00:27:28,050 Oh, wow three more. 623 00:27:28,050 --> 00:27:29,873 I guess I should just done a kill all. 624 00:27:37,330 --> 00:27:38,163 Okay. 625 00:27:43,530 --> 00:27:45,750 All right. One more time for good measure. 626 00:27:45,750 --> 00:27:47,970 Let's come over here. 627 00:27:47,970 --> 00:27:49,980 Tell Zoom to update itself. 628 00:27:49,980 --> 00:27:51,753 Just to get a clean version. 629 00:27:55,558 --> 00:27:56,391 Okay. 630 00:27:57,540 --> 00:27:58,490 Say another prayer. 631 00:28:00,660 --> 00:28:03,393 Come back to the exploit, run it. 632 00:28:04,350 --> 00:28:05,183 Okay. Hooray. 633 00:28:05,183 --> 00:28:06,355 That worked woo. 634 00:28:06,355 --> 00:28:09,355 (audience applauds) 635 00:28:16,800 --> 00:28:20,400 Mahalo for your patience. All right. (laughs) 636 00:28:20,400 --> 00:28:25,400 So now we have a nice exploit, but again, I mentioned that, 637 00:28:25,830 --> 00:28:27,780 or as you saw, there was a bunch of pop up windows. 638 00:28:27,780 --> 00:28:30,507 And so if you're trying to exploit this locally 639 00:28:30,507 --> 00:28:33,030 and there's a user on the system, it's a dead giveaway. 640 00:28:33,030 --> 00:28:34,950 So let's see if we can improve this. 641 00:28:34,950 --> 00:28:39,950 So let's close this root terminal, pop in here, 642 00:28:40,110 --> 00:28:43,890 pop into VIM and modify the exploit. 643 00:28:43,890 --> 00:28:48,360 And I mentioned that the auto update application utility 644 00:28:48,360 --> 00:28:51,960 takes a large number of command line arguments. 645 00:28:51,960 --> 00:28:53,580 And one of those controls the user interface. 646 00:28:53,580 --> 00:28:54,450 So what we're gonna do is we're just 647 00:28:54,450 --> 00:28:56,700 going to update the exploit and say, 648 00:28:56,700 --> 00:28:57,900 don't show a user interface. 649 00:28:57,900 --> 00:29:00,993 So that one's gonna be command argument number six. 650 00:29:02,010 --> 00:29:04,050 So I'm gonna change that to zero. 651 00:29:04,050 --> 00:29:05,300 Ooh. How do you exit VIM? 652 00:29:06,480 --> 00:29:07,313 Kidding. 653 00:29:09,390 --> 00:29:12,100 And now we're gonna run the exploit again 654 00:29:13,950 --> 00:29:16,290 and now we have root shell, 655 00:29:16,290 --> 00:29:21,093 but with no other alerts. (audience applauds) 656 00:29:22,650 --> 00:29:24,000 Now, since everything's working, 657 00:29:24,000 --> 00:29:25,590 I mentioned this is a race condition. 658 00:29:25,590 --> 00:29:27,720 So one of the parameters that the exploit takes is 659 00:29:27,720 --> 00:29:31,290 how long to wait, (indistinct) coded this for this, 660 00:29:31,290 --> 00:29:33,630 or I know the value for my particular system. 661 00:29:33,630 --> 00:29:35,220 Obviously, if you're exploiting this in the wild, 662 00:29:35,220 --> 00:29:37,740 you're gonna have to do a little bit of playing around. 663 00:29:37,740 --> 00:29:39,210 For example, if you do zero, 664 00:29:39,210 --> 00:29:41,070 we're gonna see that's way too fast. 665 00:29:41,070 --> 00:29:46,070 And oh, let me go back and turn the UI on again. 666 00:29:46,470 --> 00:29:48,220 We're popping root shells all over. 667 00:29:50,640 --> 00:29:51,990 So since it's a race condition, 668 00:29:51,990 --> 00:29:54,180 you have to kind of get the timing correct. 669 00:29:54,180 --> 00:29:58,203 So if I come back to here and just anything other than zero, 670 00:30:00,060 --> 00:30:01,890 and we tell it to do exploit zero, 671 00:30:01,890 --> 00:30:03,750 this should probably fail. 672 00:30:03,750 --> 00:30:06,210 It says fails with error code 007. 673 00:30:06,210 --> 00:30:07,890 If you look up what this error code means, 674 00:30:07,890 --> 00:30:10,050 it means that verification failed. 675 00:30:10,050 --> 00:30:11,340 So remember the first thing it does is 676 00:30:11,340 --> 00:30:12,840 it copies it and verifies it. 677 00:30:12,840 --> 00:30:16,050 So if we jump in too fast and replace the package, 678 00:30:16,050 --> 00:30:17,460 the verification is gonna fail. 679 00:30:17,460 --> 00:30:19,740 It's gonna see that it's not signed by Zoom. 680 00:30:19,740 --> 00:30:21,510 So we have to wait a little bit. 681 00:30:21,510 --> 00:30:26,040 Conversely, if we wait too long, two seconds or something, 682 00:30:26,040 --> 00:30:27,450 the installation is gonna install 683 00:30:27,450 --> 00:30:29,610 the legitimate version of Zoom. 684 00:30:29,610 --> 00:30:32,520 And so we've basically missed our opportunity window. 685 00:30:32,520 --> 00:30:36,330 So Zoom, in this case, grabbed the package, installed it. 686 00:30:36,330 --> 00:30:39,000 We replaced it, but it already had gone too long. 687 00:30:39,000 --> 00:30:40,950 So you kind of do some playing around, but again, 688 00:30:40,950 --> 00:30:41,783 as I mentioned, 689 00:30:41,783 --> 00:30:43,950 you can do this silently by changing that flag. 690 00:30:43,950 --> 00:30:46,200 So you could execute this as many times as you want 691 00:30:46,200 --> 00:30:48,750 on a live system or a target system, 692 00:30:48,750 --> 00:30:51,600 changing that until you get the right time and win the race. 693 00:30:51,600 --> 00:30:52,433 So again, 694 00:30:52,433 --> 00:30:56,970 0.1 seems to work pretty well and lots of root shells. 695 00:30:56,970 --> 00:30:57,873 So, okay. 696 00:30:58,830 --> 00:31:01,123 That was stressful. (laughs) 697 00:31:02,785 --> 00:31:05,785 (audience applauds) 698 00:31:08,790 --> 00:31:11,010 Life lesson, don't give up. 699 00:31:11,010 --> 00:31:11,843 All right. 700 00:31:11,843 --> 00:31:14,700 So it's a very nuanced bog. 701 00:31:14,700 --> 00:31:15,870 It's a very subtle bog. 702 00:31:15,870 --> 00:31:19,200 It's a great bog, but it also has a trivial fix. 703 00:31:19,200 --> 00:31:21,810 So again, recall the fact the bog is 704 00:31:21,810 --> 00:31:23,850 Zoom simply forgot to change the permissions 705 00:31:23,850 --> 00:31:25,530 when they copied the upgrade package 706 00:31:25,530 --> 00:31:27,720 into the root owned directory, 707 00:31:27,720 --> 00:31:29,130 all they have to do to fix this 708 00:31:29,130 --> 00:31:30,780 is to update the permissions 709 00:31:30,780 --> 00:31:32,370 once they've copied this in, 710 00:31:32,370 --> 00:31:34,530 before they verify this again, 711 00:31:34,530 --> 00:31:38,160 the directory they copy it into is owned by root. 712 00:31:38,160 --> 00:31:41,040 So if they change the permissions on the package 713 00:31:41,040 --> 00:31:43,020 and then do all their verifications, 714 00:31:43,020 --> 00:31:45,420 that would thwart any local attacker because the local 715 00:31:45,420 --> 00:31:48,540 attacker then would not be able to modify either anything 716 00:31:48,540 --> 00:31:51,360 in that directory or the PKG itself. 717 00:31:51,360 --> 00:31:53,670 So there's a single line, a single API call 718 00:31:53,670 --> 00:31:55,140 you can call in Objective-See, 719 00:31:55,140 --> 00:31:57,390 you could also use See do this in swift 720 00:31:57,390 --> 00:32:00,420 and simply change the permissions on the file. 721 00:32:00,420 --> 00:32:02,670 So I've done, I've gone ahead and done this manually. 722 00:32:02,670 --> 00:32:06,303 And we basically changed the permissions of that Zoom, TMP, 723 00:32:06,303 --> 00:32:07,620 PKG, the update package. 724 00:32:07,620 --> 00:32:09,540 And we said it to be the owner of the directory, 725 00:32:09,540 --> 00:32:11,550 which is root and wheel. 726 00:32:11,550 --> 00:32:12,900 Once we've done this, 727 00:32:12,900 --> 00:32:14,790 our exploit will now fail because 728 00:32:14,790 --> 00:32:17,340 when it goes to try to modify the package, 729 00:32:17,340 --> 00:32:18,600 it doesn't have the permission. 730 00:32:18,600 --> 00:32:20,310 'Cause again, we're running with lower privileges. 731 00:32:20,310 --> 00:32:21,810 We're trying to get root. 732 00:32:21,810 --> 00:32:24,718 So hopefully Zoom will push out of fix for this again, 733 00:32:24,718 --> 00:32:25,923 pretty simple fix. 734 00:32:26,940 --> 00:32:29,790 All right, so let's end with some conclusions, 735 00:32:29,790 --> 00:32:31,230 some takeaways. 736 00:32:31,230 --> 00:32:32,760 First and foremost, be very, 737 00:32:32,760 --> 00:32:36,600 very careful choosing usability over security. 738 00:32:36,600 --> 00:32:39,693 And this applies not just to Zoom, but to everyone. 739 00:32:40,950 --> 00:32:43,440 If I had a critique of Zoom it's that they continually 740 00:32:43,440 --> 00:32:45,720 choose usability over security 741 00:32:45,720 --> 00:32:49,020 and who can blame them, what users want. 742 00:32:49,020 --> 00:32:49,860 That wasn't the case. 743 00:32:49,860 --> 00:32:51,420 Maybe this wouldn't be the reality. 744 00:32:51,420 --> 00:32:53,700 In this case, if Zoom had simply asked the user 745 00:32:53,700 --> 00:32:56,850 for their password and then use the installer every time 746 00:32:56,850 --> 00:32:59,130 an update came along, I wouldn't be here. 747 00:32:59,130 --> 00:33:03,150 None of these bugs would've existed, again, 748 00:33:03,150 --> 00:33:06,690 that's a little more problematic for the user. 749 00:33:06,690 --> 00:33:08,820 I mean, inconvenience them slightly. 750 00:33:08,820 --> 00:33:10,980 So again, from purely a usability point of view, 751 00:33:10,980 --> 00:33:12,150 I understand what Zoom did, 752 00:33:12,150 --> 00:33:13,530 but from a security point of view, 753 00:33:13,530 --> 00:33:16,260 they opened up this huge attack surface, 754 00:33:16,260 --> 00:33:19,650 which in retrospect, I really don't think was a good idea. 755 00:33:19,650 --> 00:33:22,920 Second, the fact that installers have problems 756 00:33:22,920 --> 00:33:25,890 is not a new it's thing. 757 00:33:25,890 --> 00:33:29,820 I talked about this at DEFCON, Zoom had already 3, 4, 5, 6 758 00:33:29,820 --> 00:33:32,250 other bugs in their installer code. 759 00:33:32,250 --> 00:33:33,540 This was all really talked about 760 00:33:33,540 --> 00:33:34,980 in Maya and other people's talks. 761 00:33:34,980 --> 00:33:36,867 So watch DEFCON talks. 762 00:33:36,867 --> 00:33:37,770 And then finally, 763 00:33:37,770 --> 00:33:40,830 and this is another kind of critique I have about Zoom is, 764 00:33:40,830 --> 00:33:43,020 and also applies to other software 765 00:33:43,020 --> 00:33:44,670 where there are bugs, several bugs. 766 00:33:44,670 --> 00:33:46,650 There's likely to be more. 767 00:33:46,650 --> 00:33:48,120 I looked at the installer, 768 00:33:48,120 --> 00:33:51,000 every time I look at installer, there's new bugs. 769 00:33:51,000 --> 00:33:53,010 So this is a little again disappointing, 770 00:33:53,010 --> 00:33:55,200 but from a security research point of view, 771 00:33:55,200 --> 00:33:56,490 if you wanna find a lot of bugs, 772 00:33:56,490 --> 00:34:00,060 find an area that it's new or has other vulnerabilities and 773 00:34:00,060 --> 00:34:01,803 you will likely find more. 774 00:34:04,260 --> 00:34:06,303 I also briefly wanna mention if you're interested, 775 00:34:06,303 --> 00:34:07,650 if you enjoyed this talk, 776 00:34:07,650 --> 00:34:10,860 you're interested in reverse engineering, debugging, 777 00:34:10,860 --> 00:34:12,510 Mac analysis, 778 00:34:12,510 --> 00:34:15,300 I've written a free book on Mac malware analysis 779 00:34:15,300 --> 00:34:16,980 that covers a lot of the topics. 780 00:34:16,980 --> 00:34:19,290 You can grab it, a digital copy for free. 781 00:34:19,290 --> 00:34:21,510 It's also sold by No Starch Press. 782 00:34:21,510 --> 00:34:23,040 So check that out. 783 00:34:23,040 --> 00:34:25,410 I also want to briefly thank the companies 784 00:34:25,410 --> 00:34:27,390 that support the Objective-See Foundation. 785 00:34:27,390 --> 00:34:28,500 As I mentioned, 786 00:34:28,500 --> 00:34:30,810 that's the foundation I founded and work for. 787 00:34:30,810 --> 00:34:34,380 I also wanna thank obviously the amazing DEFCON conference. 788 00:34:34,380 --> 00:34:36,780 It's incredible to be back at full energy. 789 00:34:36,780 --> 00:34:37,920 I'm sure you're all stoked as well. 790 00:34:37,920 --> 00:34:41,430 And also I wanna thank all of you for attending my talk. 791 00:34:41,430 --> 00:34:44,265 So I think we have a few minutes for questions and answers. 792 00:34:44,265 --> 00:34:46,260 So if there's any questions, let me know. 793 00:34:46,260 --> 00:34:48,540 I'll also be here after the talk so we can talk more, 794 00:34:48,540 --> 00:34:49,440 yes, in the front. 795 00:34:52,510 --> 00:34:53,823 (laughs) Yes. 796 00:34:55,342 --> 00:34:59,550 (indistinct audience chatter) 797 00:34:59,550 --> 00:35:01,470 Where is it? No, no, no. 798 00:35:01,470 --> 00:35:02,640 Oh man. Okay. 799 00:35:02,640 --> 00:35:04,073 Let me do this to the fast way. 800 00:35:06,336 --> 00:35:07,236 I think it's here. 801 00:35:12,870 --> 00:35:14,310 Okay. Yes. 802 00:35:14,310 --> 00:35:15,213 Take a picture. 803 00:35:17,280 --> 00:35:18,390 Again, pretty straightforward. 804 00:35:18,390 --> 00:35:20,430 We basically just wait for that package to be, 805 00:35:20,430 --> 00:35:22,350 we trigger an update request, 806 00:35:22,350 --> 00:35:25,020 wait for the package and then replace it. 807 00:35:25,020 --> 00:35:25,860 So again, 808 00:35:25,860 --> 00:35:29,190 this is not some incredibly sophisticated exploit. 809 00:35:29,190 --> 00:35:31,110 It's pretty standard race condition. 810 00:35:31,110 --> 00:35:32,610 That again, is pretty winnable. 811 00:35:32,610 --> 00:35:33,760 Yeah. Another question. 812 00:35:39,060 --> 00:35:40,080 Great question, so the question was, 813 00:35:40,080 --> 00:35:42,385 what are my tools for reverse engineering? 814 00:35:42,385 --> 00:35:45,360 I wrote some of my own tools, the file and process monitors. 815 00:35:45,360 --> 00:35:47,932 If you go to Objective-SEE se.org, 816 00:35:47,932 --> 00:35:50,340 you can grab those, there's a free open source. 817 00:35:50,340 --> 00:35:51,600 For reverse engineering, 818 00:35:51,600 --> 00:35:54,750 I use the Hopper Disassembler, about 99 bucks. 819 00:35:54,750 --> 00:35:55,583 So I think it's good. 820 00:35:55,583 --> 00:35:57,360 It's also very Mac OS specific 821 00:35:57,360 --> 00:36:01,650 and the developer is very responsive to bug requests. 822 00:36:01,650 --> 00:36:03,540 So it's just my tool of choice. 823 00:36:03,540 --> 00:36:05,640 Ghidra, IDA would probably work as well. 824 00:36:05,640 --> 00:36:07,650 And then for debugging, I use LLBE, 825 00:36:07,650 --> 00:36:10,743 which is Mac OS's Apple's built in the bugger. 826 00:36:12,360 --> 00:36:13,193 Yep. 827 00:36:17,160 --> 00:36:17,993 The question was, 828 00:36:17,993 --> 00:36:20,220 have I tried this exploit on any other apps? 829 00:36:20,220 --> 00:36:22,020 I have not also, 830 00:36:22,020 --> 00:36:24,810 this one is obviously specific to Mac OS, 831 00:36:24,810 --> 00:36:26,160 that having been said, 832 00:36:26,160 --> 00:36:29,788 the downgrade attack also impacted windows. 833 00:36:29,788 --> 00:36:31,590 This again is something of a little bit 834 00:36:31,590 --> 00:36:33,270 of a critique of Zoom as well. 835 00:36:33,270 --> 00:36:34,650 I didn't even think to check windows. 836 00:36:34,650 --> 00:36:35,483 I just reported, Hey, 837 00:36:35,483 --> 00:36:38,010 your Mac client is vulnerable to a downgrade attack. 838 00:36:38,010 --> 00:36:39,450 And then four months later, 839 00:36:39,450 --> 00:36:41,400 someone from Google project zero was like, 840 00:36:41,400 --> 00:36:43,650 the windows version is vulnerable to a downgrade attack. 841 00:36:43,650 --> 00:36:45,810 And I was like, can I get that money? 842 00:36:45,810 --> 00:36:48,930 Not really, but the thought was, 843 00:36:48,930 --> 00:36:51,390 if I reported this bug to Zoom, you know, 844 00:36:51,390 --> 00:36:52,740 would've thought it would be like, okay, 845 00:36:52,740 --> 00:36:54,690 downgrade attack on the Mac client. 846 00:36:54,690 --> 00:36:57,030 Maybe the other OSS are vulnerable as well. 847 00:36:57,030 --> 00:36:59,370 And so that was really my biggest disappointment 848 00:36:59,370 --> 00:37:00,510 was that they themselves, 849 00:37:00,510 --> 00:37:02,391 didn't take the initiative to say, Hey, 850 00:37:02,391 --> 00:37:03,807 maybe we should check this. 851 00:37:03,807 --> 00:37:07,080 And so nothing against Google project zero, I mean, kudos. 852 00:37:07,080 --> 00:37:08,910 And I didn't even look, 853 00:37:08,910 --> 00:37:10,800 the bug might have been totally different, but again, 854 00:37:10,800 --> 00:37:14,640 from a conceptual point of view, since it impacted Mac OS, 855 00:37:14,640 --> 00:37:17,010 it also impacted their other operating systems 856 00:37:17,010 --> 00:37:18,180 and they didn't again, 857 00:37:18,180 --> 00:37:20,460 kind of take the initiative to figure that out 858 00:37:20,460 --> 00:37:22,160 once the initial bug was reported. 859 00:37:23,040 --> 00:37:23,873 Yes. 860 00:37:34,083 --> 00:37:36,166 (laughs) 861 00:37:38,040 --> 00:37:41,040 And here's Patrick dropping Zoom zero days. 862 00:37:41,040 --> 00:37:41,873 Wow. 863 00:37:41,873 --> 00:37:43,950 Great question, so the question was, 864 00:37:43,950 --> 00:37:45,570 what can Zoom do to improve this? 865 00:37:45,570 --> 00:37:46,530 So first and foremost, 866 00:37:46,530 --> 00:37:48,180 I have actually a lot of really good friends 867 00:37:48,180 --> 00:37:50,430 that work at Zoom and I have a ton of respect for them. 868 00:37:50,430 --> 00:37:51,930 They are brilliant researchers 869 00:37:51,930 --> 00:37:53,220 and I do feel a little bit bad 870 00:37:53,220 --> 00:37:54,930 for dropping zero days at the, but come on. 871 00:37:54,930 --> 00:37:58,710 This is DEFCON also, as I mentioned, 872 00:37:58,710 --> 00:38:00,390 a lot of the other bugs I reported to Zoom 873 00:38:00,390 --> 00:38:03,630 really took a very long time to get fixed. 874 00:38:03,630 --> 00:38:04,890 And in the meantime, 875 00:38:04,890 --> 00:38:08,100 users were vulnerable or exposed. 876 00:38:08,100 --> 00:38:09,540 I'd be very naive to assume that 877 00:38:09,540 --> 00:38:10,740 just 'cause I can find these bugs. 878 00:38:10,740 --> 00:38:11,580 Nobody else could. 879 00:38:11,580 --> 00:38:12,840 That's very arrogant. Yes. 880 00:38:12,840 --> 00:38:14,730 I have a propensity for finding them. 881 00:38:14,730 --> 00:38:18,060 But any other security researcher who's looking at this code 882 00:38:18,060 --> 00:38:19,950 would likely find these bugs as well, 883 00:38:19,950 --> 00:38:23,430 especially nation states, hacker groups, et cetera, 884 00:38:23,430 --> 00:38:24,540 et cetera. 885 00:38:24,540 --> 00:38:28,050 So I think one of the issues is that we, 886 00:38:28,050 --> 00:38:30,960 as users are not demanding this, I mean, 887 00:38:30,960 --> 00:38:33,420 Zoom has a huge market share. 888 00:38:33,420 --> 00:38:35,790 It's really popular. 889 00:38:35,790 --> 00:38:36,623 If everyone was like, 890 00:38:36,623 --> 00:38:37,830 we're gonna stop using Zoom until 891 00:38:37,830 --> 00:38:40,780 they get their security act together, that would change it. 892 00:38:51,229 --> 00:38:52,384 (laughs) 893 00:38:52,384 --> 00:38:54,330 So maybe the government can jump in. 894 00:38:54,330 --> 00:38:55,980 I mean, this is a great question. 895 00:38:55,980 --> 00:38:57,960 And I think it applies to any company. 896 00:38:57,960 --> 00:39:02,960 Traditionally usability is I think prioritized, 897 00:39:03,480 --> 00:39:04,680 especially by startups. 898 00:39:04,680 --> 00:39:07,050 I mean, you can't blame Zoom. 899 00:39:07,050 --> 00:39:10,560 They made a gazillion dollars and their shareholders are 900 00:39:10,560 --> 00:39:13,440 demanding that they make money and security, 901 00:39:13,440 --> 00:39:15,750 unfortunately isn't necessarily incentivized. 902 00:39:15,750 --> 00:39:18,720 So until that changes and again, not picking on Zoom, 903 00:39:18,720 --> 00:39:21,120 this is what most companies do. 904 00:39:21,120 --> 00:39:23,010 It's kind of following the money. 905 00:39:23,010 --> 00:39:25,260 So I think if there's more regulations 906 00:39:25,260 --> 00:39:27,990 or I remember when Mr. Musk was like, 907 00:39:27,990 --> 00:39:32,400 no Zoom at Tesla or whatever it was when some of these bugs 908 00:39:32,400 --> 00:39:33,233 were coming out. 909 00:39:33,233 --> 00:39:34,770 I think those are the things that changed that. 910 00:39:34,770 --> 00:39:36,090 So I think Zoom is definitely taking steps 911 00:39:36,090 --> 00:39:36,930 in the right direction, 912 00:39:36,930 --> 00:39:38,910 but I think there's some responsibility from us 913 00:39:38,910 --> 00:39:40,410 to also demand more. 914 00:39:40,410 --> 00:39:44,370 And so maybe us pushing for regulations or saying, 915 00:39:44,370 --> 00:39:46,170 talking about these problems at DEFCON, 916 00:39:46,170 --> 00:39:48,720 bringing more awareness is ultimately how we kind of change 917 00:39:48,720 --> 00:39:50,610 the priorities because until 918 00:39:50,610 --> 00:39:52,800 the priorities change companies, 919 00:39:52,800 --> 00:39:55,080 including Zoom are probably not super motivated 920 00:39:55,080 --> 00:39:56,310 to go after security. 921 00:39:56,310 --> 00:39:57,243 It's not sexy. 922 00:39:58,140 --> 00:39:59,730 Doesn't really cost them a lot of money 923 00:39:59,730 --> 00:40:00,570 at least traditionally. 924 00:40:00,570 --> 00:40:01,983 So why would they? 925 00:40:03,180 --> 00:40:04,013 Maybe I'm jaded? 926 00:40:05,520 --> 00:40:06,543 Any other questions? 927 00:40:11,700 --> 00:40:12,533 Yes. 928 00:40:15,450 --> 00:40:18,930 Yeah. The question was, do I have copies of my book here? 929 00:40:18,930 --> 00:40:22,080 No Starch Press has a table in the vendor area, 930 00:40:22,080 --> 00:40:22,920 so you can swing by there. 931 00:40:22,920 --> 00:40:23,760 They have a discount. 932 00:40:23,760 --> 00:40:25,950 I also will be doing a book signing tomorrow, 933 00:40:25,950 --> 00:40:27,930 which is a big exciting event for me. 934 00:40:27,930 --> 00:40:31,573 So feel free to swing by, I'll sign a book 935 00:40:31,573 --> 00:40:34,023 and we'll talk nerdy and that would be awesome. 936 00:40:37,800 --> 00:40:39,319 All right. Thank you again so much. 937 00:40:39,319 --> 00:40:41,908 (audience applauds)