Apple has pushed a silent Mac update to remove hidden Zoom web server • Hacker News Board

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#41

Post by sneak » Wed, Jul 10, 2019, 11:36 PM UTC

mukundmr wrote: post #15

There is an undisclosed RCE that prompted Apple to act. https://twitter.com/riskybusiness/status/1148819622558236673...

It sounds like silent updates from Apple without automatic updates turned on is also an undisclosed RCE - or an Apple backdoor, depending on how fine a point you wish to put on it.

Being my OS or hardware vendor does not entitle you to permanent RCE on the machine that now belongs to me.

Unless of course this is just a XProtect rules update or a Gatekeeper CRL update, then ignore what I said.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#42

Post by m0dest » Wed, Jul 10, 2019, 11:37 PM UTC

This means there might have been another side to this story: Zoom's change of heart might have been forced by Apple, not the public backlash.

Apple: Hey, your app poses a threat to macOS security. We're going to remove your server app with the built-in macOS anti-virus.

Zoom: Oh crap. Okay, give us 2 sprints to release a new version that removes it.

Apple: We're killing it in 48 hours.

...

Zoom, after an all-nighter: HEyyy users, we have a patch for youu

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#43

Post by chipperyman573 » Wed, Jul 10, 2019, 11:39 PM UTC

Twirrim wrote: post #18

Disturbs me somewhat that Apple has a way to silently push changes to laptops without user interaction.

Windows update does the same, no?

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#44

Post by tonymet » Wed, Jul 10, 2019, 11:40 PM UTC

The bigger question -- what other desktop apps have similar, latent daemons hanging around? I'm always wary of installing stuff like this (e.g. zoom, go2meeting, teamviewer).

Anyone know of other sneaky apps to avoid?

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#45

Post by heisenbergs » Wed, Jul 10, 2019, 11:43 PM UTC

I always wondered why the zoom app required root permissions, which is why I never installed it in the first place. What would a video conferencing app ever need root permissions for?! Now we know: a backdoor.

Thank god for Apple putting down the law. This is why I happily pay premium prices...

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#46

Post by tonymet » Wed, Jul 10, 2019, 11:44 PM UTC

Twirrim wrote: post #18

Disturbs me somewhat that Apple has a way to silently push changes to laptops without user interaction.

Think of it as a malware scanner, like Windows Defender

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#47

Post by tonymet » Wed, Jul 10, 2019, 11:45 PM UTC

I imagine Apple has known about this daemon for a long time from it's OS analytics.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#48

Post by saagarjha » Wed, Jul 10, 2019, 11:45 PM UTC

sneak wrote: post #41

mukundmr wrote: post #15

There is an undisclosed RCE that prompted Apple to act. https://twitter.com/riskybusiness/status/1148819622558236673...

It sounds like silent updates from Apple without automatic updates turned on is also an undisclosed RCE - or an Apple backdoor, depending on how fine a point you wish to put on it. Being my OS or hardware vendor does not entitle you to permanent RCE on the machine that now belongs to me. Unless of course this is just a XProtect rules update or a Gatekeeper CRL update, then ignore what I said.

It is.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#49

Post by lilyball » Wed, Jul 10, 2019, 11:45 PM UTC

heisenbergs wrote: post #45

I always wondered why the zoom app required root permissions, which is why I never installed it in the first place. What would a video conferencing app ever need root permissions for?! Now we know: a backdoor. Thank god for Apple putting down the law. This is why I happily pay premium prices...

I can't verify since I don't have it installed but I see no reason why this webserver would need root permissions. If it's asking for root it must be for something else.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#50

Post by eridius » Wed, Jul 10, 2019, 11:46 PM UTC

tonymet wrote: post #47

I imagine Apple has known about this daemon for a long time from it's OS analytics.

What OS analytics?

Apple gathers various anonymous metrics, yes, but I don't think they collect information on arbitrary web servers running on Macs.