Zoom - turning on someone's camera using SQL injection vulnerability - Bug Bounty Reports Explained

[@BugBountyReportsExplained]

Welcome to the comment section! First, thanks for watching! Make sure you are subscribed if you liked the video! kzbin.info Follow me on twitter: twitter.com/gregxsunday ✉️ Sign up for the mailing list ✉️ mailing.bugbountyexplained.com/ ☕️ Support my channel ☕️ www.buymeacoffee.com/bountyexplained 🖥 Get $100 in credits for Digital Ocean 🖥 m.do.co/c/cc700f81d215

[@techchannel3107]

hey bro are you from us? because your speaking is not same with us

[@BugBountyReportsExplained]

@@techchannel3107 nope, Im from Poland

[@techchannel3107]

@@BugBountyReportsExplained ok my guess is right

[@iplaynone1870]

thanks for welcoming me🤣

[@MrREALball]

Imagine having SQL INJECTION vulnerability in 2020 in your app

[@BugBountyReportsExplained]

There are many of those, but somehow undetected yet

[@user-fd4pv2rb8u]

The two main attacks on how things get hacked is SQL & XSS

[@femmeNikita27]

@@asanokatana Well, Zoom can wait for its corporate clients to watch this video after using Zoom for internal meetings on sensitive corporate financial issues or partents and school directors who use it for education and the public outcry coming from this might be the end of Zoom. But yes, safety-wise it is interesting content. Although if this issue doesn't not get resolved asap and if such corner cutting wil become a common place within any provider of on-line conferencing platform it can bring entire companies down. In more than one way.

[@teknastyk]

now imagine half a country using it professionally and semi professionally like schools, and the gov openly brags about it how they opnely support this... :D 2020 is just epic - never thought i'd live to see all this

[@user-fd4pv2rb8u]

@@teknastyk yeah that sucks and probably many more exploits out there just waiting to be found

[@NeseComedy]

"Why do you cover up your camera? Are you paranoid?" yes

[@BenREDCZ]

better to watch my ugly face than my expensive files :)))))

[@satansatan9993]

@@BenREDCZ if they can turn ur camera on, trust me they are doing way more than just watching u lol

[@abofhad4378]

Thanks a lot Mister

[@soham2106]

Me who doesn't even plug in the usb that connects the webcam: interesting

[@channelbtech6497]

Same here 😆

[@StunXPlayz]

Same XD

[@NStripleseven]

Lol same

[@fitmotheyap]

when i don't use webcam i always unplug it.

[@soham2106]

@@fitmotheyap same here. I just plug in for a few minutes when I am required to switch on the video

[@yashithabanu7173]

Hats off for the Researcher who found this !!!! Totally out of the box 🔥🔥

[@BugBountyReportsExplained]

yeah, this is very cool indeed

[@dargy]

these type of encoding mangling problems are p common when it comes to web app stuff, p cool to see it translating well in an actual desktop app

[@narasimhaswamy5464]

Never expected this type of vulnerability.

[@BugBountyReportsExplained]

yeah, that's a definitely a nice one

[@kruemmelbande5078]

*laughs in virtual machine*

[@BugBountyReportsExplained]

😂

[@teknastyk]

i hope you run thru a decen hypervisor and not leave your ram exposed just like that. its 2020. vms are so 2009 xD

[@kruemmelbande5078]

@@teknastyk Well, i dont think zoom is gonna jump a vm

[@TheJinx64]

@@teknastyk ok ms i love gen z lol ok boomer

[@jofx4051]

Wait wat

[@viczav]

That accent makes it x1000 better

[@BugBountyReportsExplained]

As a non-native speaker Im very glad to hear that😎

[@void8370]

@@BugBountyReportsExplained wiedziałem odrazu :d

[@void8370]

@@user-yv6ed3io4d sprawdziłem w informacjach o kanale

[@Michtar]

@@void8370 w tym debuggerze bylo napisane gNIEDZIELA + akcent to się domyśliłem :D

[@InfiniteLogins]

This is the first video I've watched on your channel, you do an amazing job at breaking this down and making it easy to understand. I've read blog post that explain these type of write-ups, but the way you explain them make it so much easier to follow

[@BugBountyReportsExplained]

Awesome mate! I believe that using videos it's possible to explain vulns better and quicker.

[@mr.kn0w1t4ll2]

Your channel is so educative and amazing!! You should definitely upload more!

[@BugBountyReportsExplained]

thanks mate, but I put a lot of work into each video and uploading them more often would be hard

[@RatherPleasent]

Lol I used to think the SQL injection portion of OWASP was irrelevant. Good to see Zoom is keeping it alive.

[@naimas8120]

Lmao this comment 😭

[@GalacticTG]

all the proffesors on my school will now use this xD

[@BugBountyReportsExplained]

keep your zoom updated and they will not 😏

[@MrREALball]

@@BugBountyReportsExplained who cares, chineese ai will still see and hear everything

[@rizkyadiyanto7922]

@@MrREALball american ai can read your mind

[@willinton06]

5:50 beautiful, simply beautiful

[@BugBountyReportsExplained]

oh yes it is!

[@xii1]

these are the kinds of clever exploits that i live for

[@greatguy8029]

U saying this reminds me of people looking at a painting 🖼 in a museum and discussing it for hours, and I come shouting “Wtf it’s a tree”?

[@NogCube]

$2000 is not much. Honestly, I would not report this problem for such a small amount of money. I'm sorry Zoom. 😅

[@BugBountyReportsExplained]

well, if the researcher just wanted to make sure that his zoom calls are secure, then $2000 is a good bonus

[@FireWyvern870]

@@BugBountyReportsExplained looking at all the past vulnerabilities, I wouldn't use zoom at all

[@kamilo1175]

@@FireWyvern870 Hahah well guess what. My college and my parents' firm both use Zoom as their main medium for video conferences. I love this country.

[@SamehMustafa007]

@@BugBountyReportsExplained really it is should more than 2000$ 😠 them are stingy

[@hariesch_8015]

You might spend time learning and do efforts that worth more than $2000 dollars, I agree.

[@khire5433]

Hacker : I can see you. Le me : I don't even have a cam.😏

[@andreymx]

Wow. Thank you for the video! I thought UTF-8 does protect you in case of this kind of mistreatment of multibyte-encoded strings, exactly because all the bytes in extended characters MUST have top bit set, so it makes it impossible to hide an ASCII character in an extended UTF-8 character. Some other older multibyte encodings (like GBK) actually allow ASCII to be part of extended character set. But what do you know, turns out some extremely popular databases do help attackers in this regard...

[@BugBountyReportsExplained]

Yeah, it seems that UTF-8 was well-designed with that in mind, but the same can't be said about UTF8 implementation in Sqlite.

[@wellsilver3972]

UTF-8 is literally just a version of text for example, unicode, or acci

[@jmsanchez5631]

$2000 is not enough for this bug. Very well done

[@relaehtube1225]

Finally I found something intresting in attending zoom classes (opening others camera😁)

[@mrdavidrees]

Great video. Makes me a little concerned about my code bases.

[@BugBountyReportsExplained]

yeah mate, check if you use prepared statements

[@epicindiancomments9438]

This is great, please create a full course, on KZbin or Udemy.

[@BugBountyReportsExplained]

maybe one day

[@joshuabudiarto5036]

zoom employee: Write that down, Write that down!!!

[@HK-sw3vi]

I'm glad my laptop came with an inbuilt physical shutter for the cam.

[@k42p3r]

Great walk through. That is worth testing for when writing integration tests. Thanks for sharing.

[@BugBountyReportsExplained]

Good idea, but I think SQLi is easiest to detect using SAST tool or even a linter, because it's very easy spottable in the source code. The tool just looks at how did you execute the sql query.

[@penguin2251]

Thank you for your video, it was very informative and well done! Seems like Zoom developer team has made some bad decisions while on development. I assume they've tried to make their own SQL string escape function. That problem has been solved before many times, not sure why they didn't use a library.

[@BugBountyReportsExplained]

Yes, writing your own security instead of using well-tested frameworks proves being a bad idea over and over again.

[@hammer2302]

Just studied sql injection in my last semester. Never thought it was used nowadays.

[@kahirankarasinghe7930]

dude, u no longer need to imagine a russian hacker, the legend is already here

[@diegogomes7179]

first time here and yet to learn bb in depth... but you did an amazing job explaining!

[@user15121lIlIIll]

jokes on you, i dont have a webcam on my monitor

[@BugBountyReportsExplained]

BULLETPROOF

[@Nerwesta]

Me reading that video while my professor introduced me to Zoom and taught me about SQL vulnerabilities on my app years ago : I see why you're telling me that now 🤔

[@user-kc2eb1ib7e]

Mr author, that's very cool!!! How long and what type of programming an ordinary person need to study to do such things? I will be very grateful for the answer.

[@Zawadmunshi]

C, ASM

[@dominicgraham6101]

Understanding the basics of hacking/cybersecurity is a good start, and from there I'd just try and learn as many vulnerabilities as you can, or learn about the systems you use, like Windows, iOS, etc.

[@BugBountyReportsExplained]

There are a lot of areas in cybersecurity: web security, mobile security (iOS, Android), desktop client security (Windows, Mac, Linux). You need to choose one and then you can ask about languages. I reckon after about 1000 hours of learning you can get a job if have no experience right now.

[@SulavParajuli]

Good presentation 😊 Subscribed

[@BugBountyReportsExplained]

awesome!

[@t3xtm0d3]

Single quote bypass is superb!

[@RAZREXE]

This is a great video! Loved it man❤️

[@BugBountyReportsExplained]

Glad you enjoyed it!!

[@vikaskumar-pc1xd]

Thanks this video is so knowledgeable. Waiting more videos like this.

[@BugBountyReportsExplained]

😊

[@jq10]

me who never actually been away from the keyboard waiting for the attacker to spy on me: *interesting*

[@aakarshanraj1176]

you explained it great, i am shocked they don't have any function to filter the sql query

[@BugBountyReportsExplained]

they relied on doubling quotes as a protection against SQLi

[@MrDjluis95]

Dope info thanks Bre

[@BugBountyReportsExplained]

thanks for watching bre

[@MrDjluis95]

🔥

[@ludologian]

Only 2K .. I know it needs offline exploit but he deserves more

[@BugBountyReportsExplained]

it does

[@AurelianoTorquatoBrandao]

Much complexity and receive only 2,000 is very insane

[@vinceontheweb]

What size needle do you use for an SQL injection?

[@L_a_p_s_k_y]

2000$ is a joke for such a big vulnerability

[@jonathanhoyos8191]

Very nice explanation, keep up buddy !!!! 👨🏻‍💻

[@BugBountyReportsExplained]

thanks mate!

[@SrRunsis]

Definitely subscribed and Adblock disabled for your channel man! Keep up the great work 😁😁

[@SrRunsis]

Also, maybe you should add more ads to your videos, like perhaps one at the beginning, one in the middle depending on the length and content of the video and the last ad at the end!

[@BugBountyReportsExplained]

Thanks a lot mate, but so far Im not even eligible to join YT's partner progam. But I appreciate your attitude 😉

[@dennismunyaka6537]

well articulated man you going to be a million dollarhacker soon haha

[@puppalaanusha1333]

Loved the video ,Loved to hear in your accent bro

[@connected.]

There is a LED next to my camera which lights on with the camera.....Such a cool security feature

[@MARTIN-101]

it can be turned off 🤣🤣

[@connected.]

@@MARTIN-101 no it cant be turned off

[@andrewm4835]

Me who always unplugs my camera after using it: Ah yes, very interesting

[@demb0096]

Dobrze byczku!

[@BugBountyReportsExplained]

dzięki byniu!

[@NOoBGamer-yq1yk]

Me Chilling with my Pop up Camera :)

[@DeltaTony]

*laughs in cover camera with tape*

[@inevitablecatto8090]

So, earlier last month my science computer class teach me pretty much what SQL does, that is to create or manage or some stuff with database. But they never told me that SQL could be used to hack?! Btw I just understand like 20% of the video but I actually enjoyed it. Thx.

[@BugBountyReportsExplained]

On my university, they taught me doing SQL queries from Java by just string concatenation, so it was vulnerable to SQL injection. When I talked about it with the teacher, he told me it's not security class🙃 The security class never came in my syllabus😂

[@daniulchowdhury7110]

BROOOOO Thank you for illuminating videos!

[@vexxafk]

I have tape stuck on my webcam....so goodluck spying one me 😂

[@RYANTHORNTONCALL]

This is just another reason why you don't need SQL for storing data. Why isn't this stored in json?

[@AjayKumar-xl4jc]

Great work bro 😉

[@BugBountyReportsExplained]

thanks bro

[@rainonedavid3564]

My camera doesn't show video until I type sudo killall VDCAssistant in terminal. Kind of glad that exists now.

[@markjimenez6354]

can understand some of it but not all of it.. what are the resources that i can see and study to understand this? lol ty

[@BugBountyReportsExplained]

First of all, Id like to tell you that I really think that you have a great attitude to learning, based on how did you ask the question. About resources, rather than "what's X". For basics of SQL injection, go to: portswigger.net/web-security/sql-injection For the things about binaries, it's not advanced knowledge, just general stuff. I find it hard to find and give you one link.

[@shubhamshah8415]

please add captions too . It would make understanding more better

[@BugBountyReportsExplained]

I thing there are english automatically generated subtitles

[@BugBountyReportsExplained]

Ive added subtitles, so you can now translate them into whatever language you want.

[@timothybelton9604]

Wow that's awesome! Great video bru

[@BugBountyReportsExplained]

thanks bru

[@ariad7452]

*So that physical shutter that I stick on my camera wasn't such a waste of money after all*

[@yareyaredaze9450]

Just found your channel. Notifications immediately on! I am trying to learn sql and php through w3schools website. I think you explain things very well and with the important details, the vulnerability becomes easy to understand. Thank you!

[@BugBountyReportsExplained]

Best of luck!

[@saimkhalifa]

I don't know why but I need to subscribe this channel.

[@BugBountyReportsExplained]

Everyone needs to😏

[@mat_name_whatever]

Why not do \' straight away to escape the first quote, using the added second quote to close the string?

[@BugBountyReportsExplained]

quote from the article: Common sanitization bypasses, like including a backslash character, also fail.

[@mat_name_whatever]

@@BugBountyReportsExplained ah I see, guess that was to be expected if they handle quotes like that. Thanks! :)

[@faruky9197]

lucky my country is using the old version of zoom :))))))))))

[@BugBountyReportsExplained]

what does it mean? they block the updates?

[@GuRuGeorge03]

Basically all webapps have SQLi (and other) invulnerabilities. But of course people only go to the length of detecting them when it is a big company like zoom.

[@KokoroKatsura]

zoom is directly developed by chinese military (PLA)

[@TheDiscusserOriginal]

At the end of the day, a few simple rules to follow by solves these issues. Firstly, never click a link unless trusted (and not just trusted as in from a trusted person cause they could be hacked) Secondly, never give your information to people who ask, regardless if they say their employees for the company of the software. Thirdly, always have your laptop/computer camera away, or with tape, over it unless you're using it.

[@BugBountyReportsExplained]

I fully agree, but also remember, that clicking does not always mean that the hacker sends you it via chat or an email. Clicking link might also mean that you visit a malicious website (eg. cause it popped up in Google search) and this website opens a link using JavaScript.

[@seyedalihashemi2330]

Thanks, dude. keep up!

[@BugBountyReportsExplained]

👌

[@adityagupta7881]

You got a new subscriber bro... Congo......

[@BugBountyReportsExplained]

welcome!

[@myth__un]

Hi , In the Next video , Can you explain how we can report a bug bounty in a correct way ? Thanks in Advance

[@BugBountyReportsExplained]

not really, as I focus more on the technical aspect, but there are a few of my videos where I show how well the report is written. See this for example: kzbin.info/www/bejne/n3OymXxjjZufeas

[@ahmetsaric5364]

Hello, thank You for Your work.

[@pastel_dreams8172]

The teacher is proud

[@princepatwari365]

Great explanation and POC.

[@BugBountyReportsExplained]

thanks, the credit for POC goes to Keegan

[@ManpreetRiar]

Hello Bug Bounty Hunters !

[@BugBountyReportsExplained]

Hello!

[@xE92vD]

Zooms ceo comes and kills this man after he posted this video

[@BugBountyReportsExplained]

zoom security team must have agreed to disclose the writeup in a blogpost

[@xE92vD]

@@BugBountyReportsExplained Do you even get this is a joke no need to explain it bro.

Awesome! 👏👏

[@rbt-0007]

I expected such vulnerability

[@BugBountyReportsExplained]

nice!

[@sipinthatbub]

This is why I cover my camera with electrical tape.

[@ripplerxeon]

lol stop spreading my idea ... i was about to get Nobel prize for it

[@rikkasatrio2285]

Ok don't let my teacher see this

[@Stone_624]

I'll never understand how/why Zoom became the pandemic's go to software over Skype, A 15+ year old, professional and legitimate software maintained by Microsoft (That I grew up with) . All of the sudden Zoom comes along and "Hey everyone, Lets use this brand new untested software riddled with cybersecurity issues instead." What's wrong with people?

[@BugBountyReportsExplained]

Unfortunately, people in general don't give a shit about security, they just want the nicest software. But I think Zoom was banned in US at the beginning of the pandemic, so someone made a good decision there

[@abofhad4378]

Thank you

[@fredhair]

When people ask me why I wont use Zoom. I ask them why they don't use a secure matrix client.

[@BugBountyReportsExplained]

I hope Zoom is better now

[@awekeningbro1207]

This. This is why i put duct tapes on my laptops cam.

[@BugBountyReportsExplained]

I once had a Lenovo or Dell laptop that had built-in, swippable camera cover

[@Kitulous]

lol i have an Asus Rog Strix G which does not have a webcam at all😂

[@baadrqaaba9529]

Oh , my chat-app that i have developed is vulnerable then .

[@BugBountyReportsExplained]

fix it soon!

[@xasmaniusvolk8416]

That's why every piece of sh*t program I don't trust is inside a vm - no way I'd let such pieces of sh* run on my main sys

[@renganathanofficial]

what if the victim turned off his camera in the application ?

[@BugBountyReportsExplained]

this setting would change the setting just after joining a new meeting. You could turn it off after you realised it's on

[@renganathanofficial]

@@BugBountyReportsExplained oh okay got it 😀

[@HowToEverything1]

Is it still possible to exploit this vulnerability or has it been patched?

[@BugBountyReportsExplained]

it's been patched

[@HowToEverything1]

@@BugBountyReportsExplained oh :(

[@bluestonecreepr]

looks at my none existent webcam. Huh.

[@goodboy8833]

Good Explaiation

[@BugBountyReportsExplained]

😎

[@videocommenter]

Have you tried this on Google Meet, Microsoft Teams and others that allow you to join via a link?

[@BugBountyReportsExplained]

nope

[@priyangshunath2910]

Me before watching the video:- huh, this must be fake. *Listened Russian accent* Me:- This is real shit

[@subtoitskiblu7684]

Laughs in google meets

[@advaymayank1410]

FBI AGENT INTENSIFIES

[@stanleyguo7164]

Laughs in virtual camera that’s turned off by default

[@BugBountyReportsExplained]

👌

[@99bits46]

damn professors ya'll dirty

[@ujjwaldeep5175]

I don't understand what is all this! How to learn this thing 'sqli'?

[@BugBountyReportsExplained]

just google it

[@thekatyperrymemechannel2122]

Didn't know John Cena was into computers

[@BugBountyReportsExplained]

haha you are not the first person in the comment section to tell me that😂

[@krimmy8459]

I don't understand anything but I have a feeling this is some kind of joke for people who do.

[@BugBountyReportsExplained]

no, it's not

[@AhmedAymanM]

Okay Now please, As a programmer ,Someone tell me how to find out and do what that "researcher" did ?

[@user-so3eg1rw8l]

Cool channel, just found it, thanks for the interesting vid

[@BugBountyReportsExplained]

welcome!