<story><title>Zoom has a signed binary that runs any unsigned script</title><url>https://twitter.com/DanAmodio/status/1245329512889487361</url></story><parent_chain><item><author>Puts</author><text>Some more shadiness from this company. The Zoom.us-website is explicitly allowing the browser with its content security policy-headers to load scripts from these domains:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;*.50million.club&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;*.50million.club&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;apiurl.org&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;apiurl.org&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;secure.myshopcouponmac.com&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;secure.myshopcouponmac.com&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;serve2.cheqzone.com&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;serve2.cheqzone.com&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;ad.lkqd.net&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;ad.lkqd.net&lt;/a&gt;&lt;p&gt;Doing a fast google for these domains shows they are mostly known for being associated with malware...</text></item></parent_chain><comment><author>cricalix</author><text>I saw somewhere on Twitter, possibly as a reply to Scott Helme, that they possibly added these URLs to their CSP because they were getting errors in their CSP logs from machines that had adware&amp;#x2F;malware loaded. Can&amp;#x27;t find the tweet though, so maybe it wasn&amp;#x27;t him (but I&amp;#x27;m reasonably sure it was a discussion of CSP, ReportURI, and the fact the CSP changes depending on logged in&amp;#x2F;out of zoom&amp;#x27;s site).&lt;p&gt;Pretty bad solution if that was indeed the case.</text></comment>
<story><title>Zoom has a signed binary that runs any unsigned script</title><url>https://twitter.com/DanAmodio/status/1245329512889487361</url></story><parent_chain><item><author>Puts</author><text>Some more shadiness from this company. The Zoom.us-website is explicitly allowing the browser with its content security policy-headers to load scripts from these domains:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;*.50million.club&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;*.50million.club&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;apiurl.org&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;apiurl.org&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;secure.myshopcouponmac.com&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;secure.myshopcouponmac.com&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;serve2.cheqzone.com&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;serve2.cheqzone.com&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;ad.lkqd.net&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;ad.lkqd.net&lt;/a&gt;&lt;p&gt;Doing a fast google for these domains shows they are mostly known for being associated with malware...</text></item></parent_chain><comment><author>badrabbit</author><text>Yeah...about that: ad sites are contacted by malware a lot so google results will show as such. Adware is technically malware.</text></comment>