Apple has pushed a silent Mac update to remove hidden Zoom web server • Hacker News Board

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#161

Post by userbinator » Thu, Jul 11, 2019, 1:24 AM UTC

castis wrote: post #113

userbinator wrote: post #110

It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating…

How do you feel about Windows Defender?

The same way I feel about antivirus in general: they have tons of false positives that turn them into an effective form of censorware (cracks, keygens, demoscene stuff, Hello World programs[1][2], etc.) and are very unlikely to actually protect you from a 0-day. If I happen to have a file I want to run but feel suspicious and can't be bothered analysing it myself, which is a very rare case indeed, I upload it to one of the services that scans it with a dozen or more AVs to see what they think. Even then I will not use my main OS to try it first.

That said, in the context of my original comment, AVs are a bit of a special case because their sole and expected purpose is to detect and remove software they don't like.

[1] https://www.csoonline.com/article/3216765/security/heres-why...

[2] https://stackoverflow.com/questions/22926360/malwarebytes-gi...

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#162

Post by chance_state » Thu, Jul 11, 2019, 1:24 AM UTC

mukundmr wrote: post #15

There is an undisclosed RCE that prompted Apple to act. https://twitter.com/riskybusiness/status/1148819622558236673...

Someone mentioned this above, too: https://news.ycombinator.com/item?id=20407699

Makes the story MUCH worse in my opinion. An unpatched RCE that they left open until someone else got 90% of the way there and went public with it.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#163

Post by sn0v » Thu, Jul 11, 2019, 1:26 AM UTC

lighthazard wrote: post #73

Please, Apple, give me a way to disconnect my microphone and webcam on an OS level so apps can't randomly access it.

Doesn’t that already exist under Preferences > Security & Privacy?

Afk rn so i might be misremembering the name of the setting.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#164

Post by [deleted] » Thu, Jul 11, 2019, 1:27 AM UTC

Operyl wrote: post #107

londons_explore wrote: post #102

Earlier quoted context omitted.

Because macos has no decent concept of package management or containerization.

I mean. The issue at hand was that they purposely left the webserver behind to auto reinstall if a zoom link was clicked. This was an intended feature, and the same could have been done on Linux or Windows. Package management or containers are irrelevant to this conversation.

[deleted]

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#165

Post by fastball » Thu, Jul 11, 2019, 1:27 AM UTC

dev_tty01 wrote: post #138

fastball wrote: post #82

Earlier quoted context omitted.

What apple should do though is provide an API that developers can hook into, where in when the user drags the app to the trash, it can also uninstall anything else the app placed elsewhere on the system.

They do! The app developers didn't follow the guidelines.

Oh really? Cool!

I've been out of the MacOS app dev scene for too long, it seems.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#166

Post by mychael » Thu, Jul 11, 2019, 1:27 AM UTC

tonymet wrote: post #44

The bigger question -- what other desktop apps have similar, latent daemons hanging around? I'm always wary of installing stuff like this (e.g. zoom, go2meeting, teamviewer). Anyone know of other sneaky apps to avoid?

Dropbox

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#167

Post by oil25 » Thu, Jul 11, 2019, 1:28 AM UTC

userbinator wrote: post #110

It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating…

Well said. Apple loves to flex muscle as a show of force - virtue signaling - when there is some great drama going on. It is terrifying to know they have covert remote root code execution on Macs and iPhones at all times, which they may use without your consent of even knowledge. To me, that is a greater security risk and the reason I will not use their products in favor of open source operating systems only. It saddens me to see how soon people forget Apple participates in PRISM surveillance and has been literally criticized for human rights violations in China, yet invite them to control their computers. I expect people will down-vote this comment, but expressing my disgust for such an authoritarian world view is more important to me, and should be recognized as such by the hacker community. Unfortunately it seems too many of us will sacrifice autonomy and control for the promise of centrally-administered, ominous "security" working in the shadows.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#168

Post by xoa » Thu, Jul 11, 2019, 1:29 AM UTC

sjwright wrote: post #122

rrix2 wrote: post #103

Earlier quoted context omitted.

It bothers me that people weren't more upset about this part.

I’m sure Apple is as upset as anyone else. It effectively breaks their sandbox model so they’ll probably be working hard on a way to plug that hole gracefully.

>It effectively breaks their sandbox model

The sandbox only applies to software devs that want to use it or those that wish to sell through the Mac App Store. I don't think Zoom is in the MAS at all (I don't see it in a quick search anyway), and a standalone installer is free to do whatever it wants and can convince users to go along with (up to and including, in principle, bypassing SIP though since that significantly raises the effort bar I've only ever seen niche stuff request it). And it's completely legitimate to want to run a server on your system too, there is no hole. Zoom simply acted as malware, taking actions without user permission.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#169

Post by moduspol » Thu, Jul 11, 2019, 1:29 AM UTC

taftster wrote: post #126

xeeeeeeeeeeenu wrote: post #72

They are basically solving a self-inflicted problem. The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app.

Which is completely frustrating, because Mac is totally in the position of using its built-in capabilities to deal with this. The Mac Bundle (.app) format could solve this entirely. All application specific data should be written inside of the bundle folder, so that when you delete the app, you delete the thing entirely. I mean, maybe you need a "user data" bundle of sorts tied to the specific application. If you del…

As a Mac app developer, you mostly have to go out of your way to install things[1] outside of the app bundle, and you typically don't want to because that's only extra maintenance you have to do to update / version those files. Most apps don't, and that's why most apps actually are effectively removed when you drag the bundle into the trash.

There is already a concept of a "user data" directory for the app, which is determined just like on iOS. There are also other directories for things like caches that the system can clear if it's low on disk space.

Of course they could sandbox Mac apps just like on iOS, and Mac App Store apps essentially already work that way.

I can assure you, though, that any barrier they put in the way of letting non-App Store apps run however they always have will be met by strong resistance. It's easy to point to this occurrence with Zoom and call it unreasonable, but prompts like what you're describing will undoubtedly disrupt what other people see as totally valid use cases and ruining of the UX.

[1] By "things", I mean things like a separate web server process. Apps do store files in app-specific folders like "Application Support" by convention, but not for separate processes.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#170

Post by vbezhenar » Thu, Jul 11, 2019, 1:30 AM UTC

scarface74 wrote: post #91

vbezhenar wrote: post #71

Earlier quoted context omitted.

Malware is a software written to harm user. Their purpose was not to harm user, they wanted to make their service more convenient for users. Bugs are bugs, every product have bugs and many products have security bugs. That does not make them malware.

Intent doesn’t matter only results. The result is that unless you like for random websites to be able to activate your camera without your permission, it did harm users. It wasn’t a “bug”. They purposefully hacked around a security feature. Do you really think it was a “bug” that it reinstalled itself?

> Intent doesn’t matter only results.

Then you should call Chrome a malware because there were vulnerabilities with remote code execution (and there will be similar vulnerabilities), so every website could install anything. But that is absurd.

> The result is that unless you like for random websites to be able to activate your camera without your permission, it did harm users.

First of all, you need a hard data that this vulnerability was exploited in the wild. Otherwise it did not harm users, it only opened a way for malicious websites to harm users. And, again, every vulnerability could be counted as a malware by that definition which makes malware term meaningless.

> Do you really think it was a “bug” that it reinstalled itself?

It is intended behaviour. And I don't see anything drastically bad with it. If you're opening their website with corresponding link, you want to use that service. In order to use that service, you have to run additional software and they are making it easier for you to run it. Only a few years ago every browser supported Java Applets and with Java Applets every website could run arbitrary code on your machine. And that feature was actually used a lot. Does it make all services which used that feature to overcome browser weaknesses malware? I don't think so.

They probably should have communicated better about that aspect and provide proper uninstaller software for security-concerned users. And not making those vulnerabilities in the first place, of course. But world is not perfect.