421–430 of 473 posts
Is anyone noticing that port `19421` no longer has anything listening on it? We are noticing some machines suddenly stop listening on this port but they have not downloaded any update. In zoom patching the running web server without user interaction?
They reversed course a couple of hours ago: https://www.theverge.com/2019/7/9/20688113/zoom-apple-mac-pa...
In response to all of the well-deserved criticism, Zoom just made two updates to their blog post[1] to announce that they will be completely removing the webserver for all macOS users in a new release tonight , and also adding an option prompt going forward: JULY 9 PATCH: The patch planned for tonight (July 9) at or before 12:00 AM PT will do the following: 1. Remove the local web server entirely, once the Zoom clien…
Including the local web server that definitely doesn't exist anymore anyway after this patch?
In response to all of the well-deserved criticism, Zoom just made two updates to their blog post[1] to announce that they will be completely removing the webserver for all macOS users in a new release tonight , and also adding an option prompt going forward: JULY 9 PATCH: The patch planned for tonight (July 9) at or before 12:00 AM PT will do the following: 1. Remove the local web server entirely, once the Zoom clien…
> Remove the local web server entirely Thank goodness. Sanity has prevailed. You know you've blown it when the following appears in a buzzfeed article about your software: > open the application called, “Terminal.” Copy and paste this text: lsof -i :19421. Press enter. You’ll get a string of mumbo jumbo. Underneath the text “PID,” copy the string of numbers underneath. Then type “kill -9” (without the quotes), add a…
What I'd really like to see now is them addressing the fact that their initial response to this was terrible, as if whoever was making the decision had no idea how bad this design was from a security standpoint.
Hi I'm the author, AMA Or come hang out in the party chat! Use the exploit to join: https://jlleitschuh.org/zoom_vulnerability_poc/zoompwn_ifram...
This seems to confirm that there is no functionality to create a seamless experience for the user that actually requires the presence of the web server. If you don't have the client installed the page can prompt you to download it the same as it would the very first time you download and install it. You can ask your browser to remember the link association and not be prompted for which app the link should open going forward. These are minor steps, even for a regular user, and ones with which most users are likely already familiar.
To me this further illustrates that the web server is truly just a ploy on Zoom's part to keep their hooks in users' systems, and have a way in that the user isn't privy to. Any other excuse they are giving about "enhanced experience" is dubious at best and deceitful at worst.
Earlier quoted context omitted.
bluejeans video installs a nasty daemon that runs at boot too. I'll never attend a bluejeans meeting again
Anyone know what port the Bluejeans server is running on and/or how to kill it in a manner similar to the Zoom workaround?
launchctl list
Then you need to find where the plist files are (i.e. com.bluejeans.app.detector.plist).
You can disable an entry from launchctl list:
launchctl disable uid//com.bluejeans.app.detector
You can also unload if you find the actual file
launchctl unload ~/Library/LaunchAgents/com.bluejeans.app.detector.plist
There were a couple differently named bluejeans agents.
Hi I'm the author, AMA Or come hang out in the party chat! Use the exploit to join: https://jlleitschuh.org/zoom_vulnerability_poc/zoompwn_ifram...
Interestingly, I implemented every mitigation listed in the article: kill the web server process, remove and add an empty directory at `~/.zoomus` to prevent it being re-added, remove Firefox's content type action for Zoom, and disable video turning on when Zoom launches. When I visit a Zoom join link or the POC link above, Firefox prompts me to open the Zoom client to join the meeting, and when I click "Open Link" t…
> You can ask your browser to remember the link association
If that's true in Safari, then a web server is using dynamite to kill a fly.
In response to all of the well-deserved criticism, Zoom just made two updates to their blog post[1] to announce that they will be completely removing the webserver for all macOS users in a new release tonight , and also adding an option prompt going forward: JULY 9 PATCH: The patch planned for tonight (July 9) at or before 12:00 AM PT will do the following: 1. Remove the local web server entirely, once the Zoom clien…
Release notes of 4.4.53932.0709:
Remove local web server
-We are discontinuing the use of a local web server on Mac devices. Following the update, the local web server will be completely removed from the Zoom installation Option to uninstall Zoom
-Zoom users can now uninstall the Zoom desktop application and all of its components through the settings menu
Here is how I fixed the problem for myself temporarily: 1. Quit Zoom. 2. Kill the ZoomOpener process. 3. cd ~; mv .zoomus/ .zoomus.off/ 4. mkdir .zoomus && sudo chown root .zoomus; sudo chmod 600 .zoomus Now, the Safari permission prompt will show up every time you click on a Zoom link.
Or if you want something drastic, run
chflags simmutable ~/.zoomus