The Hacker who could turn on ANYONE'S Zoom Camera [Zero-Day]

[@DanielBoctor]

JOIN THE COMMUNITY ➤ discord.gg/WYqqp7DXbm ♥ thank you for all of the support ♥

[@chriss3404]

Classic SQL injection and a nice explanation to go with it! Text encoding was def not the first thing on my mind when thinking about possible escapes, and I guess it wasn't on the mind of the person that tried to manually sanitize SQL input either!

[@mudi2000a]

They just should use parameters. Then you don’t need to sanitize anything because you can’t inject anything. Not using parameters is a classic beginners mistake. Also I think this should be caught by static code analysis tools which maybe they should have used at Zoom.

[@eyephpmyadmin6988]

"Cant read the source code" Ghidra has entered the chat

[@DanielBoctor]

yep, that's actually what the researcher used to locate the SQLite functions 🤯

[@MaxCE]

ghidra still can't tell you the function names

[@king_james_official]

that's not source code

[@amaankhan8436]

Criminally underrated channel. Keep up the good work man you'll make it big

[@DanielBoctor]

That's the dream 🚀 Thanks for the support

[@capability-snob]

We tend not to ship debug symbols by default with open source programs either - they tend to be much larger than the compiled program itself.

[@0xgordo350]

Great video! That explanation of unicode was perfect.

[@DanielBoctor]

Thanks for the support! Glad you liked it 😊

[@BillAnt]

​@@DanielBoctor- Loved it with the great explanation. :)

[@DanielBoctor]

@@BillAnt Thank you!

[@nournote]

Very well explained. Lots of small things to learn, not only a story telling content. Just keep up. Subscribed.

[@DanielBoctor]

Thanks! Glad you have you aboard :)

[@gh0stm0nst3r6]

Oh my goodness. This is such fantastic knowledge. You explain things phenomenally. Thanks so much.

[@DanielBoctor]

LOOOOOL I'm glad it was helpful! Glad you have you here! Thanks for the support ❤️

[@junosoft]

Seems very well explained. Still didn't finish the video, but so far so good. Keep it up

[@DanielBoctor]

Will do! More is on the way 🚀. Thank you for the support

[@m4rt_]

4:33 and if you want it be more of a hell for people who want to reverse engineer your stuff, you can tell the compiler to generate a stripped binary. On Linux you can do this using the "strip" command. You could use it like this "strip binary -o stripped_binary" or you can do it with the "-s" flag if you are using GCC.

[@mudi2000a]

Stripped binary is also much smaller and thus always a good thing.

[@davikad-quirkies]

yup I love using Linux

[@restoreleader]

So whats the catch? Why is it not used by default by everyone?

[@ByronShingo]

Another eloquent description of a fascinating piece of software security history, brilliant as always.

[@DanielBoctor]

glad you liked it!

[@Isaac-se6ye]

great explanation and editing!

[@DanielBoctor]

Thanks for the support, I appreciate it 😊

[@b33thr33kay]

Wow! Very well explained, thank you! EDIT: my only complaint is the title. It's makes it look like a recent exploit, which is clickbaity and not very nice. I don't think you need to resort to that. 🙂

[@cooldestroyer1]

A channel can only upload about this type of stuff when it gets patched.

[@aurilly_]

@@cooldestroyer1yea and it was patched in june 2020

[@SlitheringDemon]

​@@cooldestroyer1but still makes it look like it's recent

[@B1ADE99]

Obviously worked on you

[@cooldestroyer1]

@@B1ADE99 I stopped watching very early:/

[@whoman0385]

I honestly thought I was watching from a big channel, your so underrated, keep it going!

[@DanielBoctor]

THANK YOU! I appreciate the support! More is on the way 🚀🚀🚀

[@mbhv-ll9lq]

How do you not have more than million subscribers? What. you deserve more. keep up the great work!

[@DanielBoctor]

Thank you! You are a highly awesome fella keep on spreading that positivity

[@cancerino666]

Why a new company like Zoom decided to use SQL with all of it's string-based vulnerabilities baffles me.

[@mattm7378]

It wasn't a mistake. Zoom has been caught out working with gov agencies to essentially steal info from both individuals and organizations. Essentially is a gov tool for blackmail and info stealing (source twitter files)

[@accountaccount3840]

Great explanation. Thanks for these videos 😊😊😊

[@DanielBoctor]

Glad you liked it! Thanks for watching 😊

[@dcquence]

Very interesting. I cannot get over the upward inflection on every sentence though

[@DanielBoctor]

Ughhhhhhh I know, I do it while I'm filming without realizing it . I'm trying to fix it though.

[@qps9380]

@@DanielBoctor Honestly man, wasn't an issue for me at all. Super interesting video!

[@vanzylv]

Very interesting and technically informative. You have a elegant way of explaining things. Thanks!

[@DanielBoctor]

Glad you found it helpful! Thanks for the support I appreciate it 😊

[@SteveProjectX]

Great content man. Thank you.

[@vnc.t]

isn't it a sqlite bug as the utf-8 encoder assumes the 10xxxxxx instead of checking for it and raising an error if the first 2 bits weren't 1 and 0? why was it reported to zoom?

[@DanielBoctor]

Yeah, that definitely shouldn't have happened, but it's technically up to SQLite how they want to treat their encodings ¯\_(ツ)_/¯ The deeper source of the vulnerability was the discrepancy in the way that Zoom and SQLite handled encodings. Zoom treated input as plaintext, while SQLite treated the backslash (\) as an escape, indicating that the following hexadecimal sequence was Unicode. Regardless how how SQLite handled those encodings, it was the discrepancy at the end of the day that enabled any of this to be possible, and the onus is on Zoom to deal with that.

[@joseville]

Another great video!!!

[@AlexandreGTavares]

Happy this was on my recommended, nice one

[@DanielBoctor]

Glad you enjoyed!

[@altaccount648]

jokes on you i don't have a camera

[@Jango1989]

Brilliant video

[@DanielBoctor]

❤️❤️

[@VG-or1nu]

I typically find myself frustrated, or have little patience for videos that fail to delve deeply… (as in all the over-hyped/dumbed-down clickbait that plagues this site)… Luckily this video was a pleasant surprise with its depth and steady quality. 👍

[@DanielBoctor]

Glad you liked it! Thanks for the support

[@kodzisko-gd7fc]

great video

[@DanielBoctor]

Thanks!!

[@RoterFruchtZwerg]

Nice 👍 I thought the whole reason why utf-8 subsequent bytes have to start with 1 is to prevent exactly this - a utf-8 start byte eating away ASCII characters. So the utf-8 decoder is also at fault here? It should have stopped decoding...

[@thisismygascan4730]

is there any reason zoom would have decided to manually implement the input sanitization

[@williamdrum9899]

Skill issue

[@flipflopsn]

Great video, directly subscribed to your channel. Keep on doing great videos like these! ---- EDIT: Maybe mention tools like IDA or BinaryNinja for reverse engineering. It's not about giving the "bad guys" more information (because we assume they already have them), it's about spreading knowledge across the good guys (White-Hats) to expand their knowledge and being faster/quicker in finding new vulns than the opposition. ---- Nevertheless you did a great job related to the reversing procedure (e.g. the short analysis of the sqlite lib)!

[@happyjohn1656]

This was a great vid

[@Jiyoon02]

Wow... Vulnerabilities like this one convince just how important it is to implement a web-cam cover and a physical mic on/off togle, just for a percussion. A simple step like that goes quite a long way, it seems.

[@Impracticallypractical]

Great video! Well explained! Only correction is that SQL doesn’t use `//` for comments. It uses `--`.

[@przemeu1353]

Great job you getting my sub.

[@pabloenriquegorga4222]

Outstanding ! cool video !

[@DanielBoctor]

Thank you! Glad you have you here

[@Anthonyfromtheuk-g3j]

Internation man is Hereeer? 🎉

[@Grinwa]

Absolutely wonderful ❤ And that was super genius method to trick sql once again

[@DanielBoctor]

Glad you liked it ❤

[@larry1851]

Such a great video. Glad i found you! Keep going and you shall succeed.

[@DanielBoctor]

Thank you for the support! Glad you have you apart of the community

[@larry1851]

@@DanielBoctor somehow evertime I ask myself something while you explain something somehow you clear it up right the next second. It’s a pleasure to watch and I learned a lot.

[@DanielBoctor]

That's awesome LOL. I appreciate all of the support, and I'm glad you're able to learn from them! It's the reason why I make these videos

[@ntrq]

nice man

[@HydratedBeans]

I love your channel, but also hate realizing that there’s no real way to defend against these things proactively.

[@spinniboi]

this is basically a Kevin Fang video

[@DanielBoctor]

Never heard of him before, but you're definitely right - we even both use LEMMiNO's music LOL

[@John-ix6iw]

kind of like that one darkweb movie when the charons joined the call 💀

[@bigbilly29]

Great breakdown, thanks for the video!

[@DanielBoctor]

Thanks! Glad you liked it 😊

[@CheckmateRubik]

Great Explanation!

[@m4rt_]

Damn that UTF-8 trick is clever.

[@DanielBoctor]

ikr 🤯

[@eyephpmyadmin6988]

I have a self sqli on a android app for a bug bounty. Im not sure how to make it viable. It is using sqlite too. Trying to find any other vuln to chain with it. Been sitting on it for a month

[@TheTankiPlayer]

Cool video, just wanted to add that debug symbols are not necessary for debugging

[@ahndeux]

That is why I put electrical tape over all cameras on laptops. That will never be hacked.

[@Hauketal]

Sometimes the camera is actually wanted. There are laptops providing a mechanical slider, or one can 3D-print a clamp to put over the lens. Easy to reverse and doesn't leave gooey residue.

[@mudi2000a]

You can buy a Lenovo they have a built in mechanical cover for the webcam so you can easily cover it when not in use.

[@everyhandletaken]

You had better do the same for the microphone then too 😂

[@hgbugalou]

I now understand unicode encoding.

[@bigyoshi4555]

i do not know what most of the things are or mean but i still watch it anyway cuz it sounds interesting

[@TheControlMastr]

Make a reverse engineering video tutorial, geniuenly interested!!!!

[@jerichaux9219]

I'd thought I'd recognized Lemmino's music there

[@chengong388]

I don’t program but I know you can debug binary because I know how to do some basic binary editing with cheat engine.

[@rebelape4257]

I like the part the funny man mention computer words

[@RonaldTrumpOfficial]

Well, to this hackers dismay I’m too poor to afford a webcam!

[@NahImPro]

Find some verifiable sources to link on the next one

[@Tavern_Talk]

Fr

[@DanielBoctor]

frfr

[@gorg212]

You sound exactly like code with lewis lol

[@DanielBoctor]

LOOOOOOOOOL I NEVER HEARD OF HIM BEFORE BUT I ACTUALLY DO

[@WackoMcGoose]

_taps forehead_ Can't turn on my camera if I never have it plugged in...

[@s0kulite]

I can’t help to say that you’re pronouncing SQLite with an extra L, it’s “Ess-Queue-Lite”, without that extra L.

[@DanielBoctor]

I didn't even think of it that way LOL

[@ankk98]

Good explanation

[@sekiro_19]

Lost to sql injection 😂

[@BanglaBitTheAi]

Well explained

[@novelhawk]

This is full of inaccuracies

[@dogedev12]

bro April 7th is my birthday lol

[@parthsahni8952]

Very nice vid

[@VVVutov]

Shit. I watch it but suddenly i figured thats the guy with the "girl with a attitude voice" Dude, find somebody to do a voiceover for you

[@DanielBoctor]

this was actually my last video with this issue, if you check out my subsequent ones, they should be fine

[@bigbilly29]

If you get a nebula account ill drop a sub to it

[@DanielBoctor]

It's an honour to be considered nebula worthy LOL

[@1st_ProCactus]

This is not easy to listen too.. are you drunnnnnk ?

[@matthewkeen6281]

nice

[@mikee.]

Great video, horrible clickbait.

[@iseverynametakenwtf1]

the way you are changing the way you talk is bad, just go with your natural tone, it will come off easier to listen to. I had to stop

[@DanielBoctor]

I think I finally fixed my intonation in my most recent video

[@iseverynametakenwtf1]

will be checking it out, you are interesting @@DanielBoctor

[@DanielBoctor]

thank you LOL you are one awesome fella

[@aoe4_kachow]

Nice topic but boring because you explain too many noob details

[@metalwellington]

upspeak. come on.