Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple has pushed a silent Mac update to remove hidden Zoom web server

techcrunch.com

Post reply on HN
Print view View original

91–100 of 552 posts

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#91

Post by scarface74 »

vbezhenar wrote: post #71
scarface74 wrote: post #62

Earlier quoted context omitted.

A program that surreptitiously reinstalls software when you uninstall it is by definition malware. A piece of software that lets any website activate your camera without your permission is a security vulnerability.

Malware is a software written to harm user. Their purpose was not to harm user, they wanted to make their service more convenient for users. Bugs are bugs, every product have bugs and many products have security bugs. That does not make them malware.

Intent doesn’t matter only results. The result is that unless you like for random websites to be able to activate your camera without your permission, it did harm users. It wasn’t a “bug”. They purposefully hacked around a security feature. Do you really think it was a “bug” that it reinstalled itself?

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#92

Post by 0xADEADBEE »

rawrmaan wrote: post #35

That's pretty epic. Apple continues to make big, brave moral gestures (like when they yanked Facebook and Google's enterprise certs earlier this year, or killed long-term tracking cookies in Safari overnight). Makes me happy to be a customer. Hope they keep enforcing their own rules and protecting their users' privacy and security in this fearless manner.

I would be reticent to praise them quite so effusively, though I do think they're the best of of the big tech companies currently. I'll be watching the development of this suit with great interest: https://time.com/5596033/lawsuit-apple-selling-itunes-listen...

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#93

Post by duxup »

eddieplan9 wrote: post #58
gruez wrote: post #53

And why did Apple shut down the app regardless? Was it not properly patched? Did Apple not care?

Because zoom’s patch will only help users still using and updating zoom while those who have uninstalled zoom are still vulnerable (because the uninstalled leaves the web server behind)

"(because the uninstalled leaves the web server behind)"

For cripes sake...

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#94

Post by krferriter »

wwright wrote: post #77
xeeeeeeeeeeenu wrote: post #72

They are basically solving a self-inflicted problem. The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app.

It does provide a standard way to uninstall an app : drag it to the trash can. I would say that what Zoom did was have their app intentionally install malware that bypassed this normal uninstall. I do think that it would be great to have a more thoroughly sandboxed idea of what an “app” is on the desktop, though.

Snapd, flatpak, appimage all can do this on Linux. Even docker/singularity can sort of do the same for some, if you pass through all the necessary devices and sockets from the host. When you remove the app (or container) all the files it brought with it or created during runtime are now gone.

Even the regular Linux package managers like apt, dnf, pacman track which files were installed by which packages, so they can be removed when the package is uninstalled. The downside to these is they don't track files created at runtime so a lot of the config or cache files created can be left over if the package itself doesn't remove them.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#95

Post by cpncrunch »

Ambroos wrote: post #59
cpncrunch wrote: post #3

My Macbook pro froze this morning...the mouse moved, but I couldn't interact with anything. After a few mins, I hard rebooted it, and it worked fine after that. I'm not sure if it was related to this update, but it's the first time that this has ever happened, so it's a little bit of a coincidence.

This has been widespread for the last week and a half, but nobody knows why. Unrelated to zoom.

Looking at my logs, I see a gpu reset at the time the problem occurred:

Event: GPU Reset RCS Ring is: - busy - in the ring I suspect the automated GPU reset didn't quite work, as nothing wasn't redrawing properly.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#96

Post by javagram »

aphextron wrote: post #78
xeeeeeeeeeeenu wrote: post #72

They are basically solving a self-inflicted problem. The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app.

>The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app. reply And Windows does? Uninstallers are completely at the behest of application developers. No consumer OS but iOS actually provides any sort of true app level sandboxing.

> And Windows does?

Control Panel “add and remove programs” usually works?

There’s no equivalent on Mac. Yes, dragging the app to the trash is a thing but that leaves behind content in ~/Library/caches, ~/Library/Application Support, and ~/Library/Preferences . It’s been somewhat of an issue with Mac ever since they first put a hard drive on the original ones back in the 80s...

Edit: I literally cleared several GB of junk out of my application support folder left behind by just one app today, so it’s fresh on my mind. OmniDiskSweeper is great for finding this stuff.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#97

Post by awinder »

evv wrote: post #83
xeeeeeeeeeeenu wrote: post #72

They are basically solving a self-inflicted problem. The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app.

Funny, it is also self-inflicted because Safari inspired Zoom to do this hack by breaking the correct behavior of protocol links. > This is a workaround to a change introduced in Safari 12 that requires a user to confirm that they want to start the Zoom client prior to joining every meeting. The local web server enables users to avoid this extra click before joining every meeting. https://blog.zoom.us/wordpress/2019/…

I don’t understand how a “you’re about to jump out of the app” confirm panel is breaking protocol links. I actually want this behavior for zoom and any other app...

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#98

Post by javagram »

fastball wrote: post #88
javagram wrote: post #64

Earlier quoted context omitted.

> The server was intentionally left behind, and running, by the "uninstaller FWIW, I don’t think there was a uninstaller? What I’ve seen people describe is that dragging the .App file to the trash wouldn’t remove the server, since it was installed in a different folder. There was no uninstaller until the Zoom update this week added an uninstall option to the menu.

I think that is the point. MacOS users expect an app that does not come bundled with an uninstaller to be "uninstalled" by dragging the .app bundle to the trash. This generally leaves behind metadata, but that is not a big deal as it is just data - not code. Leaving behind code that continues to execute after the user has removed the application without an option to uninstall it is obviously something that never shou…

FWIW I am not sure how dragging the .app to the trash would uninstall other things installed by the app.

If I drag photoshop to my trash instead of using Adobe’s uninstaller, I’m pretty sure that leaves Creative Cloud junk running on my machine.

Now, zoom did mess up by not having a proper uninstaller shipped with their app, I think a lot of other Mac apps do fail at this too though.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#99

Post by krferriter »

gaogao wrote: post #66
tonymet wrote: post #44

The bigger question -- what other desktop apps have similar, latent daemons hanging around? I'm always wary of installing stuff like this (e.g. zoom, go2meeting, teamviewer). Anyone know of other sneaky apps to avoid?

Razer gaming keyboard drivers spin up a webserver for controlling the chroma, which I've always found scary. (Using the much more reasonable community open source drivers that don't do that.)

Why in the world would a keyboard driver need to run a webserver? Client software should just be able to call driver functions directly in order to configure the keyboard. It sounds like they hired a web developer to write their driver configuration tool and didn't give any architectural constraints or have someone managing the project who knows best practices or security principles.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#100

Post by filoleg »

shakna wrote: post #84
tjohns wrote: post #24

Earlier quoted context omitted.

This has been in place since 10.6 Snow Leopard. It's part of their built-in anti-malware system (MRT + XProtect + Gatekeeper). It's no different than a virus scanner auto-updating its signatures.

Except that if you auto-update disabled, you'd be somewhat surprised if the virus scanner could update it's signatures.

As one of the posters already mentioned, it can be easily disabled through the OSX GUI by changing the setting in Preferences -> Software Update -> Advanced -> Install system data files and security updates
Post reply on HN