Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple has pushed a silent Mac update to remove hidden Zoom web server

techcrunch.com

Post reply on HN
Print view View original

281–290 of 552 posts

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#281

Post by DickSmith »

m0dest wrote: post #42

This means there might have been another side to this story: Zoom's change of heart might have been forced by Apple, not the public backlash. Apple: Hey, your app poses a threat to macOS security. We're going to remove your server app with the built-in macOS anti-virus. Zoom: Oh crap. Okay, give us 2 sprints to release a new version that removes it. Apple: We're killing it in 48 hours. ... Zoom, after an all-nighter:…

I've been on the Catalina Beta since the week of WWDC, and Zoom hasnt worked for me until the update today.

The loading modal would come up, but the app window would never open and I would have to force kill the app entirely, since I couldn't close the modal.

I suspect that Apple had already closed the possibility of the loophole on Catalina, which is why it wasn't working.

So I suspect they had probably noticed it weeks ago.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#282

Post by Izkata »

smittywerben wrote: post #272
root_axis wrote: post #221

Earlier quoted context omitted.

It's not spyware, this was not something that was intended to be abused, it's insecure software and its very common, you're running plenty of it right now.

> It's not spyware, this was not something that was intended to be abused Do you have a source for that. It doesn’t peek around my computer a little and/or send back any telemetry? I’m being serious, I’d like to know. I had to install Zoom in school in 2014, I ended up uninstalling it the next week and reformatted after the quarter. I’m with Apple here. It’s shit insecure non-consenting software that wastes battery 9…

IIRC, part of the functionality included silent background updates from a domain that nearly expired, and was only renewed when pointed out to them during the discovery of this.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#283

Post by pstch »

hunter2_ wrote: post #141
krferriter wrote: post #94

Earlier quoted context omitted.

Snapd, flatpak, appimage all can do this on Linux. Even docker/singularity can sort of do the same for some, if you pass through all the necessary devices and sockets from the host. When you remove the app (or container) all the files it brought with it or created during runtime are now gone. Even the regular Linux package managers like apt, dnf, pacman track which files were installed by which packages, so they can…

> all the files it brought with it or created during runtime are now gone. How would this work with apps that create things that a user would expect to persist, like downloads (kept after uninstalling a browser) or office documents (kept after uninstalling the office suite), or media production apps, IDEs, etc.? It could have some rule like "let it be if it's in the user home directory" or "only remove stuff in these…

> How would this work with apps that create things that a user would expect to persist, like downloads (kept after uninstalling a browser) or office documents (kept after uninstalling the office suite), or media production apps, IDEs, etc.?

I can't see how it would. Making the uninstall remove all the files created at runtime is the wrong solution to a real problem, which is better solved by forcing all packages to be self-contained and making their installation an idempotent operation. If we're able to do this, there's not much to clean up afterwards, and we ensure there's no privileged malware left (such as Zoom's one) as both the package install scripts and runtime would be able to run unprivileged.

I use NixOS, an OS built on Nix, a functional package manager that does this, and being able to set my system to a known state without going through the steps of formatting and reinstalling is really nice.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#284

Post by kccqzy »

vinay_ys wrote: post #268

Huh? Why is it ok for Apple or anyone to do silent installs on my computer? As a customer, why am I getting this information from YC/Techcrunch and not Apple? What else have they pushed like this? Is there a transparent log? Can we verify if their track record is clean? How many times have they silently broken and fixed their own things? How do we know they won't abuse this? Isn't this the same dark pattern that we c…

> What else have they pushed like this? Is there a transparent log?

Yes.

    sh-3.2# softwareupdate --history
    Display Name                                       Version    Date
    ------------                                       -------    ----
    Safari Technology Preview                          87         07/10/2019, 21:40:18
    Gatekeeper Configuration Data                      171        07/03/2019, 14:00:23
    Safari Technology Preview                          86         07/02/2019, 01:27:12
    MRTConfigData                                      1.42       06/29/2019, 11:52:13
    Gatekeeper Configuration Data                      170        06/29/2019, 11:50:33
    Safari Technology Preview                          85         06/13/2019, 14:48:10
    Safari Technology Preview                          84         06/10/2019, 00:51:57
    TCC Configuration Data                             17.0       06/05/2019, 07:04:21
    Gatekeeper Configuration Data                      167        06/04/2019, 04:17:26
    Safari Technology Preview                          83         05/30/2019, 19:48:10
    iTunes Device Support Update                                  05/15/2019, 16:27:15
    Safari Technology Preview                          82         05/15/2019, 16:27:15
    macOS 10.14.5 Update                                          05/15/2019, 16:27:15
    Gatekeeper Configuration Data                      166        05/14/2019, 02:36:07
    Safari Technology Preview                          81         05/03/2019, 00:47:53
    MRTConfigData                                      1.41       05/02/2019, 06:36:59
    XProtectPlistConfigData                            2103       05/02/2019, 06:36:37
And the list goes all the way back to when I bought my Mac. Among the list above, only the Safari Technology Preview updates and the macOS 10.14.5 update are initiated manually, as far as I can remember.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#286

Post by pishpash »

hunter2_ wrote: post #141
krferriter wrote: post #94

Earlier quoted context omitted.

Snapd, flatpak, appimage all can do this on Linux. Even docker/singularity can sort of do the same for some, if you pass through all the necessary devices and sockets from the host. When you remove the app (or container) all the files it brought with it or created during runtime are now gone. Even the regular Linux package managers like apt, dnf, pacman track which files were installed by which packages, so they can…

> all the files it brought with it or created during runtime are now gone. How would this work with apps that create things that a user would expect to persist, like downloads (kept after uninstalling a browser) or office documents (kept after uninstalling the office suite), or media production apps, IDEs, etc.? It could have some rule like "let it be if it's in the user home directory" or "only remove stuff in these…

Such a system would not allow the application to write to any place outside of its sandbox or a designated user document volume. The system can't be touched. If you want to create a system config file, you are responsible to break the glass and move it and then all bets are off.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#287

Post by [deleted] »

johnhart wrote: post #212
hunter2_ wrote: post #184

Earlier quoted context omitted.

Would you happen to have any examples outside of this particular update where an OS security update goes and changes something that the OS didn't itself create? Genuinely curious if this is a thing. The word "system" can be scoped any which way (see system of systems) but typically means "part of the OS" in this context.

Microsoft does this monthly with the Malicious Software Removal Tool which comes down as part of Windows Update.

[deleted]

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#289

Post by pishpash »

RussianCow wrote: post #101
javagram wrote: post #96

Earlier quoted context omitted.

> And Windows does? Control Panel “add and remove programs” usually works? There’s no equivalent on Mac. Yes, dragging the app to the trash is a thing but that leaves behind content in ~/Library/caches, ~/Library/Application Support, and ~/Library/Preferences . It’s been somewhat of an issue with Mac ever since they first put a hard drive on the original ones back in the 80s... Edit: I literally cleared several GB of…

The point is, all of those files are generally still left behind on Windows as well. Uninstalling a program in Windows is roughly equivalent to dragging it into the trash in macOS.

No, dragging an app from "Applications/" into Trash is equivalent to dragging a program folder from "Program Files\" into Recycle Bin. Actually that's exactly what it is.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#290

Post by [deleted] »

nemothekid wrote: post #154
krferriter wrote: post #99

Earlier quoted context omitted.

Why in the world would a keyboard driver need to run a webserver? Client software should just be able to call driver functions directly in order to configure the keyboard. It sounds like they hired a web developer to write their driver configuration tool and didn't give any architectural constraints or have someone managing the project who knows best practices or security principles.

I don’t have the keyboard, but it’s my understanding that application developers can customize the lights on the keyboard. For example if you die in the game your keyboard turns red. To do that you need IPC, and a JSON endpoint is the most popular form of RPC. If the server listens on localhost, I don’t see any issue with it - any issue you would have with IPC, you would have with this style of of RPC. Now they could…

[deleted]
Post reply on HN