Apple has pushed a silent Mac update to remove hidden Zoom web server • Hacker News Board

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#221

Post by root_axis » Thu, Jul 11, 2019, 2:15 AM UTC

zaptheimpaler wrote: post #121

userbinator wrote: post #110

It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating…

lol they removed what would be called horrific spyware if it wasn’t made by Zoom and you’re over here on some lofty criticism about possible implications years into the future any OS (and many other apps) that update have the power to do what you’re afraid of, and much more. plus i don’t really see a bright line between system level software and an app when apps can access your video cam, mic, all your files - basica…

It's not spyware, this was not something that was intended to be abused, it's insecure software and its very common, you're running plenty of it right now.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#222

Post by donarb » Thu, Jul 11, 2019, 2:15 AM UTC

taftster wrote: post #211

moduspol wrote: post #169

Earlier quoted context omitted.

As a Mac app developer, you mostly have to go out of your way to install things[1] outside of the app bundle, and you typically don't want to because that's only extra maintenance you have to do to update / version those files. Most apps don't, and that's why most apps actually are effectively removed when you drag the bundle into the trash. There is already a concept of a "user data" directory for the app, which is…

Thanks for the reply, really good stuff. But what I don't get, why even have an "Application Support" directory at all. There is absolutely nothing of value added to me (as a user) to have files stored there. It's just one more place I have to look to clean up after an application is deleted. So dumb and adds zero value. I'll put my files into Documents (or whatever). And you (as an application developer) put your fi…

Mac OS is a multi-user operating system. Most applications that are installed are global to the system although each user also has their own Applications folder. The Application Support folder resides in the user's Library folder and contains information that the app needs when running for that particular user. Storing information in the .app bundle would affect every user on that computer.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#223

Post by e40 » Thu, Jul 11, 2019, 2:16 AM UTC

userbinator wrote: post #110

It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating…

Given that it exposed Apple's users to possible privacy violations and Apple's actions didn't remove any function from Zoom (it operated fine, if installed when this action took place), I'd say I'm happier as an Apple customer.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#224

Post by jxcl » Thu, Jul 11, 2019, 2:17 AM UTC

tomjakubowski wrote: post #123

krferriter wrote: post #94

Earlier quoted context omitted.

Snapd, flatpak, appimage all can do this on Linux. Even docker/singularity can sort of do the same for some, if you pass through all the necessary devices and sockets from the host. When you remove the app (or container) all the files it brought with it or created during runtime are now gone. Even the regular Linux package managers like apt, dnf, pacman track which files were installed by which packages, so they can…

A sandboxed macOS app would offer similar protections as what snapd, flatpak, etc provide on Linux. > Even the regular Linux package managers like apt, dnf, pacman track which files were installed by which packages, so they can be removed when the package is uninstalled. Technically speaking, Zoom could have abused dpkg post-install scripts, or pulled similar tricks, to install their malware server and leave it behin…

> Technically speaking, Zoom could have abused dpkg post-install scripts, or pulled similar tricks, to install their malware server and leave it behind after the package was removed. Linux distributions aren't invincible to these shenanigans.

This is correct, but such a package should not make it into the distribution's package repositories.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#225

Post by jonfw » Thu, Jul 11, 2019, 2:19 AM UTC

Deimorz wrote: post #69

rawrmaan wrote: post #35

That's pretty epic. Apple continues to make big, brave moral gestures (like when they yanked Facebook and Google's enterprise certs earlier this year, or killed long-term tracking cookies in Safari overnight). Makes me happy to be a customer. Hope they keep enforcing their own rules and protecting their users' privacy and security in this fearless manner.

I don't think disabling the enterprise certs was particularly moral, Facebook and Google were flagrantly violating the terms of the enterprise program. Apple also apparently didn't even notice (or didn't care) until articles about it started getting a lot of attention. Apple definitely does make some commendable decisions, but I think it's also important to distinguish between bravery and what Ben Thompson calls "Str…

I'm not convinced that morality and self-interest are mutually exclusive. Very often the best decision for a given entity to make is a moral one.

We should still reward/praise companies who make decisions that are morally superior to their competitors, regardless of whether the morality itself was a primary motivation.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#226

Post by wyattpeak » Thu, Jul 11, 2019, 2:20 AM UTC

walrus01 wrote: post #196

scarface74 wrote: post #191

Earlier quoted context omitted.

If Apple removed a piece of ransomware that you installed would you have a problem with that? Do you think anyone would have installed Zoom if they knew that it would allow any random website to activate your camera?

No, and I'm 100% in agreement with the need for it to be removed, it was clearly malware. The question I see is really that Apple doesn't inform its users of the existence of this feature, unless you really search for it. Having something as simple as a functional-equivalent to Windows Defender with its own icon in Control Panel, which is fully enabled in the default operating system installation, should be sufficien…

While I agree with you that I wouldn't want any such thing operating silently on my own machine, I increasingly wonder if it's not the sensible default for a lot of people.

For a bunch of my family members, even simple errors mean almost nothing to them. They'll stop what they're doing and wait for help even on an error that (it seems to me) they could have simply read and addressed themselves. They've never examined the system tray, and dismiss any popups that come from it. Making them aware of systems like this only serves to confuse, because they don't really understand the problem it's addressing in the first place.

Machines for power users aren't going away. There are more operating systems than you can shake a stick at, and the number keeps growing. But for a lot of users information can be paralysing, and I wonder if having a strongly managed and simplified system akin to a phone isn't a better idea.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#227

Post by jbigelow76 » Thu, Jul 11, 2019, 2:21 AM UTC

lilyball wrote: post #49

heisenbergs wrote: post #45

I always wondered why the zoom app required root permissions, which is why I never installed it in the first place. What would a video conferencing app ever need root permissions for?! Now we know: a backdoor. Thank god for Apple putting down the law. This is why I happily pay premium prices...

I can't verify since I don't have it installed but I see no reason why this webserver would need root permissions. If it's asking for root it must be for something else.

If it's asking for root it must be for something else.

Occam's Razor, asking for root was probably just the path of least resistance for the Zoom developers.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#228

Post by taftster » Thu, Jul 11, 2019, 2:22 AM UTC

moduspol wrote: post #218

taftster wrote: post #211

Earlier quoted context omitted.

Thanks for the reply, really good stuff. But what I don't get, why even have an "Application Support" directory at all. There is absolutely nothing of value added to me (as a user) to have files stored there. It's just one more place I have to look to clean up after an application is deleted. So dumb and adds zero value. I'll put my files into Documents (or whatever). And you (as an application developer) put your fi…

> But what I don't get, why even have an "Application Support" directory at all. The bundle isn't normally writeable by the app itself. It's generally good security practice to not have your app capable of rewriting what itself can do, and iOS is the same way. You can't write into your app bundle, so anything at all that you want to persist needs to go somewhere else (typically in "Application Support"). That would i…

Again, good reply thank you. Just to continue a little more...

> The bundle isn't normally writeable by the app itself. It's generally good security practice to not have your app capable of rewriting what itself can do, and iOS is the same way. You can't write into your app bundle, so anything at all that you want to persist needs to go somewhere else (typically in "Application Support").

I don't buy this. If you are writing "anything at all" into Application Support, this is no different than writing to the bundle. An executable binary written into Application Support is just as effectively the same thing as an executable binary written into the bundle itself. I don't see a difference between a program rewriting its own code vs. writing an executable into another location.

There's no added security and no added user value to writing into Application Support vs. the App Bundle itself.

Not arguing with you, I appreciate you explaining the current state and conventions. Thanks for the discussion.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#229

Post by oil25 » Thu, Jul 11, 2019, 2:24 AM UTC

scarface74 wrote: post #62

vbezhenar wrote: post #27

Earlier quoted context omitted.

That's Apple's closed garden, even when they allow you to sideload application, they still have the ultimate decision. Of course it's not malware, but probably enough users have vulnerable software which could be remotely exploited, that they decided to blacklist it.

A program that surreptitiously reinstalls software when you uninstall it is by definition malware. A piece of software that lets any website activate your camera without your permission is a security vulnerability.

> A program that surreptitiously reinstalls software when you uninstall it is by definition malware.

Not quite. Malware is short for "malicious software" and malice has a specific legal definition: the intent to harm. By your standard, removing a Mac system daemon only to have it re-installed by a software update would classify the entire OS as "malware" - which is an unfair, emotionally-driven characterization.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#230

Post by amarshall » Thu, Jul 11, 2019, 2:25 AM UTC

Jedi72 wrote: post #16

My coworker owes me lunch, I said they would yank the Zoom app for breaking the app stores TOS (close enough hahaha). Apple cant be very happy with public companies breaking their platform, especially in the name of "UX", which is supposed to be (and is) their differentiator.

Except Zoom isn’t available via the Mac App Store, so there’s no ToS for them to have broken.