> 0patch became aware of the flaw thanks to a “private researcher” who wants to remain anonymous—that person said no disclosure was made to Zoom
No disclosure was made to Zoom. Why? What's the point of doing that?
No disclosure was made to Zoom. Why? What's the point of doing that?
> Vice has reported that someone is claiming to have a zero-day exploit affecting the Zoom app for Windows, and they’re asking $500,000 for it. The remote code execution exploit allegedly requires the hacker to be in a call with the targeted user. Zoom says it has launched an investigation, but so far it has “not found any evidence substantiating these claims.”[1]
[1]: https://www.securityweek.com/zoom-teams-katie-moussouris-rev...
I couldn't find their current bug bounty payout schedule anywhere online, so I can only assume it's unimpressive.
I can think of a few other reasons, although it probably would have been better to disclose to Zoom /alongside/ whoever else they thought should get it.
Have they?
Their disclosure policy [1] sounds reasonable and their public response [2] to the recent accusations has been text book, if you ask me. They even hired top industry experts (Alex Stamos, Matthew Green, etc.) and acquired keybase to strengthen their security.
To me it looks like Zoom got lots of attention at once, and thus had lots of security issues at once, that would not be out of the ordinary if they had been more spread out. However, them lying to their customers about E2EE is hard to forgive.
Before covid, all i knew about Zoom was "That video chat with all the exploits"