A problem worse than Zoom?
I posted about another macOS app called “Dropshare.app” a few days ago [1].I didn’t bother to write a blog post about it because my English is not good enough.Basically, anyone who uses this app is vulnerable to cross-infection and data leaks. Assume that user John installed this app, then hacker Alice tricked John to visit their malicious website. In this website, they added code that sends requests to “http://localhost:34344/upload” to upload malicious files to any of the services that John’s computer is connected to via Dropshare, this includes private servers via SSH, Amazon S3, Rackspace Cloud Files, Google Drive, Backblaze B2 Cloud Storage, Microsoft Azure Blob Storage, Dropbox, WeTransfer, and custom Mac network connections. The port number is also static, saving the hacker the need to run a port scanner.I already contacted Dropshare’s developers to fix the issue, but got not response.[1] https://news.ycombinator.com/item?id=20399551