Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This is funny, but I don't think the issue should be so quickly dismissed.

The machine must already be compromised for this vulnerability to be useful, but doesn't necessarily mean it isn't a problem. A good security model uses layers to reduce the impact of successful attacks. This vulnerability potentially enables an attacker to escalate their privileges, bypassing some of those layers and compromising the machine further.

This article probably overstates the problem (maybe don't use "doom" in the headline next time, even though it rhymes) and there are plenty of examples of worse vulnerabilities, but that doesn't excuse this one.



For another case like this, look up "steam privilege escalation"

https://amonitoring.ru/article/steamclient-0day

Valve tried to downplay this too. Privilege escalation is an attack vector that's easy to downplay


I agree. My cynicism is directed more on the confluence of Apple security issues + Zoom + NSA reference attention grabbing. :)


Multi user security model is real!


The vulnerability here is surely in Mac OS X though?


No it's not. Mac OS X is allowing a program that was given root permissions to execute code with root permissions.


No, it’s Zoom.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: