How the Zoom macOS installer does its job without you clicking ‘install’

Post by snowwrestler » Tue, Mar 31, 2020, 8:54 PM UTC

lukevp wrote: post #32

aequitas wrote: post #26

Earlier quoted context omitted.

We just had a corporate presentation with around 250 people. Normally we use Teams or Slack for internal communication, this was also stated by management, that Zoom should only be used for 'big' meetings like this. I think they know the other solutions will not work as well for bigger groups. I've not had issues with using either solution for small group meetings. Actually I have to go out of my way to run Zoom in t…

Why not use Teams Live for this? We have been using zoom and Teams alternately and Teams performance and ease of use has been much better in my experience, but we have yet to do a 200+ all hands so I was curious if there were some footguns with teams live that you may know about. Teams live works on a lot of platforms and also has a web version.

Post by etaioinshrdlu » Tue, Mar 31, 2020, 8:59 PM UTC

Gaelan wrote: post #114

manigandham wrote: post #85

1) If Zoom can do this then it's a MacOS security bug. 2) UX matters. Users don't care about the technical details, they want a smooth experience and that can be the difference between a billion-dollar business or a failed startup. And yes the desktop version is more stable than the web-based UI. 3) Malware is defined by what it does, not how it's installed.

I mean, it's not really a security bug. Installer.app displays a dialog box that says "Hey, this package wants to run arbitrary code to check if it's compatible with your system. Is that OK?" The user is explicitly opting into the code execution. Zoom's "compatibility check" installs the app and kills the installer window. That's certainly unexpected behavior, but I don't think it's an exploit in any real sense. Whil…

Post by vijaybritto » Tue, Mar 31, 2020, 9:04 PM UTC

munk-a wrote: post #228

manigandham wrote: post #139

Earlier quoted context omitted.

A botnet agent is designed to take control and run a bot, so yes it's malware. It doesn't have to be actively doing it at that moment to be considered such.

Zoom does report usage to Facebook whether you have an account or not - and that data is used to stitch together a web profile of the user that is of no benefit to the user. Zoom is bordering on malware, just... malware that comes with a useful app that allows video conferencing.

Post by saagarjha » Tue, Mar 31, 2020, 9:06 PM UTC

auiya wrote: post #110

Wowfunhappy wrote: post #64

Earlier quoted context omitted.

The script asks for root which subsequently pops up an OS password prompt. Zoom never sees your password. How is this different from the way e.g. Virtualbox gets root?

It's not making the proper privilege escalation call, it's faking the box entirely. There's even a typo in the dialog box.

Post by saagarjha » Tue, Mar 31, 2020, 9:11 PM UTC

whatever_dude wrote: post #167

t0mas88 wrote: post #10

Earlier quoted context omitted.

I'm still curious why everyone thinks Zoom "just works" while others don't. Because in an enterprise context it is often hard to download an executable and run it with sufficient permissions. While Google and Microsoft both offer a product that "just works" with only a browser. What makes Zoom more "just works" than that?

Zoom has a browser version as a fallback. Most people use the standalone app because indeed it "just works". That's why you don't hear much about its browser client.