Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How the Zoom macOS installer does its job without you clicking ‘install’

twitter.com

Post reply on HN
Print view View original

21–30 of 334 posts

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#21

Post by tantalor »

Wowfunhappy wrote: post #14
lultimouomo wrote: post #3

I think this also shows how macOS has been training users to enter their password in random dialogs that have absolutely nothing that identifies them as being legit OS dialogs. The dialog that Zoom uses could very well be sending the credentials to a remote server, and the user would be none the wiser.

Note that in this case, it's still a legit OS dialog. Preflight scripts are very much built into the macOS pkg format, they're just not intended to be used like this.

It doesn't look legit, it looks like the installer script is faking a system dialog in this screenshot:

https://twitter.com/c1truz_/status/1244737675191619584/photo...

This message is a lie; it not coming from system but from the installer script.

Just because the OS is used to show the dialog doesn't mean it should be trusted. As other commenter noted this could be used to steal passwords; that is effectively what it does.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#22

Post by realityking »

I really wish they'd make the client available in the Mac App Store. Not only is the installation experience better than this, things also stay nicely up-to-date. If your company runs an MDM for your Macs, it's easy to deploy apps en-mass to everyone.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#23

Post by macleginn »

pottertheotter wrote: post #17

I installed Zoom on macOS yesterday and I thought that the install was crashing because this is not the expected behavior. I would double click the download, try to install, and then the installation program would "crash", so I'd try it again. Did that a few times before I realized it was installed. Until now I thought it had somehow gotten far enough in the installation process before crashing that I could at least…

Same here. I thought the process didn't finish until I tried launching the app (which I was supposed to do by clicking a link in the browser, which is also rather unintuitive).

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#24

Post by why_only_15 »

paulgpetty wrote: post #18

Two questions this raises, for me at least: How do I know I’ve completely uninstalled all the things Zoom installed? And, if Zoom provided a separate uninstaller (like many apps do) and it was verified to purge all of the stuff they installed (along with the uninstaller); would that appease people's concerns? For now I’m sticking with the iOS app for video & their web-based experience for desktop sharing...

Part of the benefit of macOS apps is that you can just put them in the trash and they're gone. Breaking that contract isn't like awful but it is frustrating.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#25

Post by krageon »

Fiahil wrote: post #7
capableweb wrote: post #4

Earlier quoted context omitted.

Unfortunately, the current system and people in power seems to not give a damn about security and shady behavior, as long as the thing they are using is working and working well. Zoom is an example of very useful and performant software with shady company behind it, that's why people will continue using it. Same with Uber, Google and bunch of other companies. It doesn't matter what they do, as their product is helpin…

Enterprise customer DO give a damn about security. They can be slow to react, but rules are also there for a very long time. If Zoom doesn't want to loose most of their marketshare in favor of WebEx, they should probably address these issues.

> Enterprise customer DO give a damn about security

You are wrong. Even without extensive experience in the space, you can very easily see how even large companies don't secure themselves at all. The US has had equifax recently, and it's not like that was an isolated example either. There just isn't a security culture at the eye-watering heights of corporate upper management and while everyone's as busy making money as they are, there never will be. It doesn't fit into the system, and anyone who tries to change it gets muscled out by people who don't want it to change - because that is simply what's most efficient.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#26

Post by aequitas »

t0mas88 wrote: post #10
aequitas wrote: post #6

Not that I'm in favor of this practice, but the one key feature that conference software must have is: it just works™. Nothing turns you off more from a conferencing solution than: any problem getting it working right now. When there is just the slightest issue, one person not being able to join, one person not getting voice to work, bad audio, your entire team is blocked/distracted. Which results in a collective dis…

I'm still curious why everyone thinks Zoom "just works" while others don't. Because in an enterprise context it is often hard to download an executable and run it with sufficient permissions. While Google and Microsoft both offer a product that "just works" with only a browser. What makes Zoom more "just works" than that?

We just had a corporate presentation with around 250 people. Normally we use Teams or Slack for internal communication, this was also stated by management, that Zoom should only be used for 'big' meetings like this. I think they know the other solutions will not work as well for bigger groups. I've not had issues with using either solution for small group meetings.

Actually I have to go out of my way to run Zoom in the browser instead of using the installer. I have to use Chrome instead of Firefox, download but not install the app and wait for the "or run in browser" link to appear after that.

I really don't like macOS installers anyways and passionately hate them as "installing" and App on macOS should be nothing more than moving the .app from a zip or disk image into your /Applications folder. I just don't trust them in not placing additional crap like auto updaters or kext's when I don't need them.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#27

Post by microtonal »

Wowfunhappy wrote: post #14
lultimouomo wrote: post #3

I think this also shows how macOS has been training users to enter their password in random dialogs that have absolutely nothing that identifies them as being legit OS dialogs. The dialog that Zoom uses could very well be sending the credentials to a remote server, and the user would be none the wiser.

Note that in this case, it's still a legit OS dialog. Preflight scripts are very much built into the macOS pkg format, they're just not intended to be used like this.

I never understood why Apple still supports the pkg format. It seems a half-baked leftover from the 2000s and even then I was already surprised that there is no way to uninstall things through the macOS GUI. I am not sure if this has changed (I try to avoid pkg files and use Homebrew cask to uninstall such packages), but IIRC you had to list the files with pkgutil on the command-line, remove stuff by hand and then --forget the package.

They should just kill the format. Everything should just be drag to install, drag to trash to remove.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#28

Post by xenophonf »

I missed the part where Zoom is holding people's computers for ransom, or formatting the drive, or exfiltrating sensitive information to criminals or state intelligence officers, or mining bitcoin, or other similarly malicious behaviors.

An admin can write to /Applications without privilege escalation? That's a macOS bug. If the operating system didn't rely on an 80s-style put-all-the-executables-in-one-place app launch paradigm, maybe there'd be less incentive for app developers to ignore the per-user Applications folder that macOS supports.

An app can spoof or abuse privilege escalation dialogs? That's because macOS doesn't implement an Orange Book-style Trusted Path. It's why Windows and similar operating systems have secure attention keys in the first place.

So yeah, Zoom is (ab)using flaws in macOS to get itself installed with minimum fuss, but it isn't doing it with evil intent. They fixed past issues; they'll probably fix this. Meanwhile, these long-standing macOS security flaws won't be addressed by Apple, who has a terrible track record about these things except when it lets people bypass their App Store.

P.S. As an enterprise customer, I'm much more worried about end-to-end encryption in Zoom, and the apparent lack thereof. I'm also not sure how that compares with other video conferencing services.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#29

Post by taylortrusty »

Fiahil wrote: post #7
capableweb wrote: post #4

Earlier quoted context omitted.

Unfortunately, the current system and people in power seems to not give a damn about security and shady behavior, as long as the thing they are using is working and working well. Zoom is an example of very useful and performant software with shady company behind it, that's why people will continue using it. Same with Uber, Google and bunch of other companies. It doesn't matter what they do, as their product is helpin…

Enterprise customer DO give a damn about security. They can be slow to react, but rules are also there for a very long time. If Zoom doesn't want to loose most of their marketshare in favor of WebEx, they should probably address these issues.

They're much more likely to lose it to Microsoft Teams, which has been doing great the last several weeks.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#30

Post by scumbert »

factorialboy wrote: post #19

Why isn't this categorized a major Mac OS vulnerability? If Zoom abuses preinstall scripts, what's to say others aren't.

Underrated take. They shouldn't be able to do this. This should flag Zoom as PUP for malware removal, if it weren't the new go-to.
Post reply on HN