The script asks for root which subsequently pops up an OS password prompt. Zoom never sees your password. How is this different from the way e.g. Virtualbox gets root?
Because it lies about its identity, calling itself "System" not Zoom. This is also a MacOS vuln that lets apps lie about their identity in sudo prompts, much like a browser showing an https site with no certificate checking.
macOS allows apps to write arbitrary lines of text above password prompts, which is what Zoom is doing. I don't see how that's different from a shell script echo'ing something before a sudo prompt.
I'm still curious why everyone thinks Zoom "just works" while others don't. Because in an enterprise context it is often hard to download an executable and run it with sufficient permissions. While Google and Microsoft both offer a product that "just works" with only a browser. What makes Zoom more "just works" than that?
Zoom has a web client that "just works" but they only show it as an option after they detect that their native client didn't "just work".
That's weird, when I open a meeting link (which would open the native client) at the bottom of the page it says "If you cannot download or run the application, join from your browser.".
I have the native client and it still shows me this option.
One wonders why Apple didn't just treat DMGs like Application Folders in the first place. If they had an icon and you could run them directly then there wouldn't be any confusion. AppImage works like that and I think it was a wise decision.
Developers can distribute .app's inside of .zip files, and many do, but this can result in users just running the .app inside of their downloads folder. And then this causes problems if they ever decide to clean out their Downloads folder. The DMGs are a clever way to (A) make sure the app gets to the proper location while simultaneously (B) teaching the user about what's actually happening on their computer. As I sa…
Developers can distribute .app's inside of .zip files, and many do, but this can result in users just running the .app inside of their downloads folder. And then this causes problems if they ever decide to clean out their Downloads folder.
Some applications offer to move themselves to the /Applications folder when started the first time outside /Applications or ~/Applications. Though in general, it would be better if Apple made it more attractive to publish in the App Store, since it brings other advantages (e.g. mandatory sandboxing).
Why not use Teams Live for this? We have been using zoom and Teams alternately and Teams performance and ease of use has been much better in my experience, but we have yet to do a 200+ all hands so I was curious if there were some footguns with teams live that you may know about. Teams live works on a lot of platforms and also has a web version.
Why not use Teams Live for this? My wife was on a Teams videoconference last week. 125 people in four locations from New York to Southern California. An hour into it, half of the people were simultaneously dropped, and not from any particular geography. It was random. And nobody could reconnect for a very long time. It took 45 minutes to restart the meeting. The company is no longer using Teams.
have only recently started using teams with one client. small group (max 6 folks I think) and... we've had issues with it - someone's video freezing, audio garbled/dropping, etc - twice in 2 days. but... I'm sort of chalking it up to potentially overloaded/bad net connections in the wake of all the WFH and remote meeting stuff being used. We had issues with connecting to zoom (and their phone numbers) last week as well, so I'm not ready to pull the plug on teams entirely until we have more experience under our belts.
Note that in this case, it's still a legit OS dialog. Preflight scripts are very much built into the macOS pkg format, they're just not intended to be used like this.
Incorrect. Look at the second tweet in the thread. It's a phishing popup that misidentifies itself in order to steal priveleges intended for System, not Zoom. https://mobile.twitter.com/c1truz_/status/124473767519161958...
That's still an OS prompt, they just put their own message at the top, as you're allowed to do.
1) If Zoom can do this then it's a MacOS security bug. 2) UX matters. Users don't care about the technical details, they want a smooth experience and that can be the difference between a billion-dollar business or a failed startup. And yes the desktop version is more stable than the web-based UI. 3) Malware is defined by what it does, not how it's installed.
is botnet agent not malware? it's not doing anything until the operator sends the payload.
> Everything should just be drag to install, drag to trash to remove. I wish it were that easy, most apps leave files in other places on your computer like ~/Library that will never get cleaned up if you just move the app to trash.
As much as this bothers me because of who I am, I don't think it's a real problem. Those files shouldn't take up significant space unless the developer is doing something stupid. It might be nice if macOS had some sort of automatic cleanup routine when an app is trashed, but that would either require showing the user an extra dialog (a la AppCleaner's) or introducing an opaque system which could potentially lead to d…
Indeed, data outside the application folder usually consists of a preferences plist and saved application state. Of course, there could be caches as well, which could take up a fair amount of disk space.
But I think the primary argumentation in favor of what macOS does now on drag-to-trash is that the users preferences are preserved, for when they install an application again.
As someone who's never used or seen Zoom in action, what's pulling people into Zoom that's not already available in other tools (Hangouts Meet, MS Teams) and even works without installing anything (such as Jitsi)? Based on what I've seen, there's just so much hostile behaviour by the company (including lying about meeting HIPAA e2e requirements!) and the fact that their _official client_ had parts removed by the macO…
I use Zoom, Hangouts, Slack and WebEx. Out of those Zoom has the best call quality, and it is the only solution out of the 4 on which huge meetings (50+ persons) are workable.
If I had to guess, it’s an attempt to optimize install conversions. Every multi-step process you ask a user to perform is effectively a (marketing/sales) funnel. Some percentage of people drop off at every step. Maybe Zoom they thought that if they moved the actual installation closer to Step 1, then more people would accomplish it. It’s awfully sneaky though, especially that password dialog.
> it’s an attempt to optimize install conversions
I love creative uses of language like this!
Be right back, I just have to optimize install conversions of my botnet client.
It doesn't look legit, it looks like the installer script is faking a system dialog in this screenshot: https://twitter.com/c1truz_/status/1244737675191619584/photo... This message is a lie; it not coming from system but from the installer script. Just because the OS is used to show the dialog doesn't mean it should be trusted. As other commenter noted this could be used to steal passwords; that is effectively what i…
The script asks for root which subsequently pops up an OS password prompt. Zoom never sees your password. How is this different from the way e.g. Virtualbox gets root?
It's not making the proper privilege escalation call, it's faking the box entirely. There's even a typo in the dialog box.