Live data from Hacker News

Tell HN: Zoom runs application from Time Machine backup when uninstalled on Mac

news.ycombinator.com

31–40 of 51 posts

Re: Tell HN: Zoom runs application from Time Machine backup when uninstalled on Mac

#31
post #14

Earlier quoted context omitted.

There's at least one app for figuring out why every hourly backup takes half a gigabyte. It might require root privileges, but I doubt that.

Wait, is that not normal?

... unless you are writing a half-gig every hour, why would that be remotely expected?

Re: Tell HN: Zoom runs application from Time Machine backup when uninstalled on Mac

#32
post #23

It's doubtful that this is Zoom doing anything in particular. Rather it's likely the OS doing the best it can to handle the URL for you. The OS has a mapping between the URL and the bundle identifier of the app, and apparently looked for the bundle on a disk that happened to be attached, after it didn't find it on your main disk. Which is perfectly reasonable in itself.

This is unexpected to me. If I remove an application I do not expect it to run. If the OS is willing to reach into the Time Machine backups will it also modify them? What if I delete an app, run it then install an update? Will it install to the backup? That would be very unexpected. Looking at multiple application directories is one thing but executing things from the backup directory is another.

I checked before, and if I recall correctly, Time Machine backups are protected at the kernel level -- you cannot modify them, even with sudo. You can delete the whole backup, but you cannot modify part of it.

> but executing things from the backup directory is another.

Time Machine backups are structured in a very non-proprietary way. Each backup is just a folder, protected from modifications, with hard links used to save space. If anything, I'd say good on Apple for supporting a backup format that works exactly like making a copy of a folder.

Re: Tell HN: Zoom runs application from Time Machine backup when uninstalled on Mac

#33
post #32
post #23

Earlier quoted context omitted.

This is unexpected to me. If I remove an application I do not expect it to run. If the OS is willing to reach into the Time Machine backups will it also modify them? What if I delete an app, run it then install an update? Will it install to the backup? That would be very unexpected. Looking at multiple application directories is one thing but executing things from the backup directory is another.

I checked before, and if I recall correctly, Time Machine backups are protected at the kernel level -- you cannot modify them, even with sudo. You can delete the whole backup, but you cannot modify part of it. > but executing things from the backup directory is another. Time Machine backups are structured in a very non-proprietary way. Each backup is just a folder, protected from modifications, with hard links used t…

Sure nothing wrong with the format of the backups, that makes total sense. What doesn't make sense is executing things in those directories.

Re: Tell HN: Zoom runs application from Time Machine backup when uninstalled on Mac

#34
post #10

It'll do that with any application on the Mac, this is not peculiar to Zoom. The Time Machine backup is, as far as the Finder is concerned, just another volume. It'll prefer applications on the root volume, but it'll launch them from other volumes as well.

So as long as the victim has time machine enabled and had an attack tool on their computer within the TM timeframe… the attacker could at any time re-initiate that tool from the grave? That's a huge security logic hole…

Re: Tell HN: Zoom runs application from Time Machine backup when uninstalled on Mac

#36

Earlier quoted context omitted.

Wait, is that not normal?

... unless you are writing a half-gig every hour, why would that be remotely expected?

I would think that it's touching a bunch of log files slightly or something…

Re: Tell HN: Zoom runs application from Time Machine backup when uninstalled on Mac

#37
post #9

Sort of sidetracking, but: afaik applications open from a browser via a custom protocol in a link, and for that the application has to be already installed—unless MacOS offers to search the app store (if it does, not sure). So, this suggests to me that either MacOS leaves protocol associations in place after uninstalling an app, and has the machinery to resurrect such an app from the backups, or Zoom leaves around a…

As with file types, the URL protocols an app can handle are configured in the app's Info.plist. An app doesn't have to be "installed" in any special way, the app just has to be somewhere on a disk mounted where the OS can see it in order for the OS to find it.

In OPs case, Zoom.app was still hanging out in his backup, ready to be launched (Time Machine backups are just a standard disk image)

Re: Tell HN: Zoom runs application from Time Machine backup when uninstalled on Mac

#39
post #4
post #2

I guess in some sense it is the price one pays for "it just works". The main problem I have is this seems like going to very far extremes in order to run the app no matter what and the tradeoffs were never discussed or put in front of people, which I find to be pretty unethical. Sort of like the privacy debate - the tradeoffs of everyone sharing their personal data were never really up for debate.

This is a bit of a charitable explanation. How can any project manager say, with a straight face, "we need to make sure the application is still available, even if the user deletes it." How can you accidentally delete an application? It is not like you press a button by accident and it is suddenly gone. Deleting an application requires the user to express intent and go through a process (go to the Applications folder…

> How can any project manager say, with a straight face, "we need to make sure the application is still available, even if the user deletes it."

Someone absolutely did, though. Remember last summer when it came out that uninstalling Zoom would leave a local webserver running that would automatically reinstall it if you accessed a Zoom link?

https://www.macworld.com/article/3407764/zoom-mac-app-flaw-c...

Re: Tell HN: Zoom runs application from Time Machine backup when uninstalled on Mac

#40
post #4
post #2

I guess in some sense it is the price one pays for "it just works". The main problem I have is this seems like going to very far extremes in order to run the app no matter what and the tradeoffs were never discussed or put in front of people, which I find to be pretty unethical. Sort of like the privacy debate - the tradeoffs of everyone sharing their personal data were never really up for debate.

This is a bit of a charitable explanation. How can any project manager say, with a straight face, "we need to make sure the application is still available, even if the user deletes it." How can you accidentally delete an application? It is not like you press a button by accident and it is suddenly gone. Deleting an application requires the user to express intent and go through a process (go to the Applications folder…

It’s what happens when you optimize for one thing only. Just like “engagement at all costs” that the entire internet ad economy is based around.
Post reply on HN