Is anyone noticing that port `19421` no longer has anything listening on it? We are noticing some machines suddenly stop listening on this port but they have not downloaded any update. In zoom patching the running web server without user interaction?
Vulnerability in the Mac Zoom client allows malicious websites to enable camera
411–420 of 473 posts
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#412Is anyone noticing that port `19421` no longer has anything listening on it? We are noticing some machines suddenly stop listening on this port but they have not downloaded any update. In zoom patching the running web server without user interaction?
They reversed course a couple of hours ago: https://www.theverge.com/2019/7/9/20688113/zoom-apple-mac-pa...
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#413Zoom’s response to this[1] is a wonderful example of how not to respond to security issues. It includes the classic tropes: * Our users don’t care about security. > Our video-first platform is a key benefit to our users around the world, and our customers have told us that they choose Zoom for our frictionless video communications experience. * We have no way of knowing if this has been exploited in the wild, so it’s…
It's exactly how you want to respond if you plan on sharing it publicly on Twitter in the hopes of fooling those not in tech. If my mom stumbled into that article, she would likely think they perfectly explained everything (well... she would likely contact me but, still). Given this news is already not sticking near the top of hacker news and barely reported elsewhere, it feels like they are already getting away with…
Problem is, your mom is not in their market; their paying customers have paid IT people who do pay attention.
And hence Zoom just caved: https://www.theverge.com/2019/7/9/20688113/zoom-apple-mac-pa...
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#414In response to all of the well-deserved criticism, Zoom just made two updates to their blog post[1] to announce that they will be completely removing the webserver for all macOS users in a new release tonight, and also adding an option prompt going forward:
JULY 9 PATCH: The patch planned for tonight (July 9) at or before 12:00 AM PT will do the following: 1. Remove the local web server entirely, once the Zoom client has been updated – We are stopping the use of a local web server on Mac devices. Once the patch is deployed, Mac users will be prompted in the Zoom user interface (UI) to update their client. Once the update is complete, the local web server will be completely removed on that device. 2. Allow users to manually uninstall Zoom – We’re adding a new option to the Zoom menu bar that will allow users to manually and completely uninstall the Zoom client, including the local web server. Once the patch is deployed, a new menu option will appear that says, “Uninstall Zoom.” By clicking that button, Zoom will be completely removed from the user’s device along with the user’s saved settings.
PLANNED JULY RELEASE: Additionally, we have a planned release this weekend (July 12) that will address another security concern: video on by default. With this release: 1. First-time users who select the “Always turn off my video” box will automatically have their video preference saved. The selection will automatically be applied to the user’s Zoom client settings and their video will be OFF by default for all future meetings. 2. Returning users can update their video preferences and make video OFF by default at any time through the Zoom client settings.
Edit: the new version is now released at https://zoom.us/download
[1]: https://blog.zoom.us/wordpress/2019/07/08/response-to-video-...
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#415Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#416Earlier quoted context omitted.
Doing it that way results in a nuisance prompt from Zoom every time you launch it complaining that it can't launch the opener. Here's a modified version that deletes the app, removes the LoginItem if it exists, and makes the ~/.zoomus directory unwritable, which achieves the same thing but avoids the nag: killall ZoomOpener osascript -e 'tell application "System Events" to delete login item "ZoomOpener"' rm -rf ~/.zo…
Thank you for sharing this. One small typo or formatting error: The last line is missing a ~/ and should be: `sudo chown -R nobody:nobody ~/.zoomus`
Ah, yes - thank you for that.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#417I'd be really happy to see:
a) Apple removing Zoom from the App Store (at least for a fixed amount of time before they patch* this nightmare up), b) releasing an update to MacOS that breaks Zoom's server completely (I know, I'm asking for too much here).
*talking about patching is a bit exaggeration here because this is not a bug this is a fucking trojan disguised as conferencing app, I'd truly truly block them from App Store for that, as a fellow developer I'm writing this with heavy heart but the incompetency of Zooms developers is enormous here, CEO can say anything he want but I'm pretty much sure it's impossible he was not aware of the fact how the core of his product works. It's not even unethical, you really have to have no imagination to do something like this.
Also - there's a different issue - Macs seem to be pretty solid when it comes to security but looks like ANY installer can just spin up web severs on our machines and we won't even know? I'm just a simple developer, not a devops, how can I prevent this in happening in the future? If they did it once they will do it again. And if not them then someone else. Any hints? Should I scan my ports every morning and see what can go through every single one of them?
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#418In response to all of the well-deserved criticism, Zoom just made two updates to their blog post[1] to announce that they will be completely removing the webserver for all macOS users in a new release tonight , and also adding an option prompt going forward: JULY 9 PATCH: The patch planned for tonight (July 9) at or before 12:00 AM PT will do the following: 1. Remove the local web server entirely, once the Zoom clien…
> Remove the local web server entirely
Thank goodness. Sanity has prevailed.
You know you've blown it when the following appears in a buzzfeed article about your software:
> open the application called, “Terminal.” Copy and paste this text: lsof -i :19421. Press enter. You’ll get a string of mumbo jumbo. Underneath the text “PID,” copy the string of numbers underneath. Then type “kill -9” (without the quotes), add a space after -9 and paste the PID string of numbers. Press enter. The server has been killed.
:D
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#419Most of the affected users won’t be able to uninstall the Zoom client in a clean way: https://apple.stackexchange.com/questions/358651/unable-to-c... I could not get rid of the client in my process list for weeks and regretted installing it. I will try the fix mentioned at the end of the article now (first killing the webserver). They will have a hard time regaining users trust.
The bash script shown in Edit 2 and in the gist linked in the comment are guaranteed to wipe out unrelated files.
Re: Vulnerability in the Mac Zoom client allows malicious websites to enable camera
#420I'd be really happy to see: a) Apple removing Zoom from the App Store (at least for a fixed amount of time before they patch* this nightmare up), b) releasing an update to MacOS that breaks Zoom's server completely (I know, I'm asking for too much here). *talking about patching is a bit exaggeration here because this is not a bug this is a fucking trojan disguised as conferencing app, I'd truly truly block them from…
It's been a while since I've been a Mac user but I used to use an app called 'Little Snitch' which would notify you about outbound traffic, perhaps it has a mode that can do something similar.