Exploiting the post-attendee URL feature in Zoom webinar to distribute malware

The post-attendee Uniform Resource Locator (URL) feature within the video conferencing application known as Zoom is often overlooked by digital forensic experts as a potential risk for malware transmission. However, with the ability to redirect webinar participants to any URL set by the host for the webinar, the post-attendee URL can be abused by bad actors to expose webinar participants to malicious websites or, in the worst-case scenario, force participants to download a file through the use of a direct download link URL. This study aims to showcase how this exploit can be replicated by creating an experimental environment involving four Windows 10 desktops running Zoom version 5.7.5 and creating a webinar with four user accounts acting as webinar participants and setting the post-attendee URL value to the URL of a website that contained a keylogger. In another trial, the same experimental environment was utilized, with the only difference being the post-attendee URL that was set to redirect webinar participants to a download link for a .jpg file. In both instances, every user account that joined the webinar via clicking on the invitation link that was emailed to each user account after registering for the webinar was redirected to the post-attendee URL regardless of their user account role. These results not only prove that the post-attendee URL can be exploited, but also provide insight as to how this type of attack can be prevented.     

网络视野下的恐怖主义及应对

凭借现代通信技术的发展,恐怖主义以网络化的组织形式将其极端活动秘密推向世界各地。本研究旨在针对国际恐怖主义的发展特点,以网络的视角观察和分析恐怖组织结构的变化,描述国际恐怖主义网络化特点,评估网络化恐怖主义带来的威胁及挑战,并从中探讨反恐的新思路和打击策略。     

The nexus between vulnerabilities and violence in the Caribbean*

Abstract

This article analyses the nexus between the Caribbean’s manifold vulnerabilities and the direct and structural violence evident throughout the region’s history. It argues that Caribbean states are threatened not only by direct violence but also by the structural violence permeating in impoverished and marginalised sectors of the state–society complex. Both forms of violence are attributable to the historical legacy of colonisation, to US paternalism and hegemonic dominance in the post-colonial era, and to the persistence of the coloniality of power, even after Caribbean states won their independence from European imperial powers. Today, the region is, per capita, one of the most violent areas on the globe. Evidence of concatenated violence is growing across this region, demonstrating the difficulty small underdeveloped states have in addressing threats to their security, independence, economic viability, and continued existence in the intermestic environment within which they operate.     

黑网吧治安隐患及其治理

黑网吧久治不绝，已成为影响城乡社会治安的重要问题。黑网吧普遍存在火灾隐患、毒害青少年、滋生黑恶势力等较为严重的治安问题。治理黑网吧是当前及今后相当长时期内维护社会稳定的重要举措，而治理黑网吧需要从提高全社会思想认识、加强政策导向、政府各部门通力协作等方面入手。     

利用平台漏洞实施侵财行为的刑法定性

利用网络平台漏洞取财的行为存在盗窃罪与诈骗罪定性上的争议,问题在于平台的行为能否体现财产权利人的意志,使平台背后的自然人发生“认识错误”。可根据行为人所利用平台漏洞的性质进行盗窃罪与诈骗罪的区分:将平台漏洞分为系统机械漏洞和业务逻辑漏洞。如果行为人单纯利用了平台的机械漏洞时,成立盗窃罪;如果行为人利用了系统预设的业务逻辑漏洞,成立诈骗罪。