Has anyone checked that it doesn’t have the same uninstalled bugs? Namely the remote code exec rce that dropped a few months back..
Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom
61–70 of 181 posts
Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom
#62I still don’t understand the issue with this: it’s not using this feature as intended, but they’re not exploiting any vulnerabilities or attempting to exploit a privilege escalation bug in macOS. Apple’s installers allow these scripts to do anything (and I believe there’s a prompt along the lines of “this installer will run a script to determine if the package can be installed”).
It isn’t a _security_ issue, because the script doesn’t circumvent any security restrictions, but it is a _trust_ issue, because the script abuses pre-install functionality to install the program without explicit user agreement: A Mac user expects a confirmation prompt, but never receives one.
Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom
#63Why do these apps require installers at all? What are they installing—presumably any of their proprietary tech can run in userspace unprivileged. Personally, my best guess is because that’s the flow the product manager expected.
Do these apps request accessibility permissions for screen sharing and the like during install?
I believe the privileged process requests this on use; I am not sure how you’d trigger it during install
Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom
#64Earlier quoted context omitted.
I would love to see a lawsuit about stolen malware IP.
Is it officially considered malware by apple? If so... feds don’t screw about. Those guys could be in serious trouble.
Well then they’re lucky that law enforcement has a slightly more involved process to determine criminality than checking Apple’s malware filter list.
Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom
#65Earlier quoted context omitted.
The standard way to install an application on the Mac is to simply drag it into the Applications folder. That’s what is expected by users. For the vast majority of applications this should be enough. Whenever I see a Windows-style “installer” the first thing I think is... what kind of shenanigans are going on?
This standard way doesn't work in corp environments (which WebEx and Zoom are targeting primarily), where machines are remotely provisioned. For decent macOS remote installs and updates you need the PKG format scripts.
What is so hard about remotely provisioning app bundles in a standard place? I ask because I have been tangentially involved in both image and script based provisioning and interacting with PKGs would seem to complicate, not simplify, both processes.
Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom
#66Why do these apps require installers at all? What are they installing—presumably any of their proprietary tech can run in userspace unprivileged. Personally, my best guess is because that’s the flow the product manager expected.
Another reason could be to ensure that you have at most one copy of the application ever, since you can force it to install stuff always at the same location.
On an unrelated product we learned that users ended up with many different copies of the app scattered throughout the system, if they were allowed to use the traditional bundle + DMG distribution method. Spotlight would then helpfully pick one random copy, with obvious consequences wrt. project file versioning. That is despite the DMG having the usual symlink to /Applications for a drag-and-drop installation.
Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom
#67Earlier quoted context omitted.
It seems unnecessary for core functionality at least -- I installed Zoom by unpacking the .app from the .pkg by hand (without running any installer scripts) and it works fine.
Mind throwing me the name of or link to the program you used to unpack the .app? I'd like to do that myself, and remember stumbling on a program that did that, but can't recall the name.
Been using 'Suspicious Package' lately: https://www.mothersruin.com/software/SuspiciousPackage/
Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom
#68Earlier quoted context omitted.
The standard way to install an application on the Mac is to simply drag it into the Applications folder. That’s what is expected by users. For the vast majority of applications this should be enough. Whenever I see a Windows-style “installer” the first thing I think is... what kind of shenanigans are going on?
This standard way doesn't work in corp environments (which WebEx and Zoom are targeting primarily), where machines are remotely provisioned. For decent macOS remote installs and updates you need the PKG format scripts.
And the wacky PKG files used by Zoom (until recently) and WebEx are likely to be incompatible with those provisioning methods, because they don't unpack their contents and finish installing normally.
Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom
#69No wonder their uninstallation instructions[1] are hilariously complicated. They somewhat-helpfully point to an actual separate uninstaller package to download, but it doesn't even remove all the things mentioned on this page. 1. https://help.webex.com/en-us/WBX38280/How-Do-I-Uninstall-Web...
Having to download a separate uninstaller or having complicated uninstallation instructions does not in any way, shape, or form indicate there’s anything funny going on with the pkg installer. Any pkg installer (or any app bundle, if you want to completely remove all traces of it) would require a separate uninstaller to install, and any pkg installing to multiple directories will be complicated to uninstall, not even considering user data. lsbom | xargs rm is about as close as a native uninstallation method, but you will have user data and possibly things like launch agents left behind.
The uninstallation page basically describes how to completely uninstall any nontrivial Mac application.
Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom
#70Everyone who's spent 3 hours talking a parent through downloading and installing a Zoom client understands exactly why they're doing this. Mine are unable to (1) reliably download a zip file; (2) navigate to that file using Finder; (3) run something inside it. By the time we were done -- I use copilot (basically VNC with NAT punching built in) -- and I got control of the laptop to just do it myself, there were 7 down…
This highlights a problem we should have addressed long ago - engineer a method to reliably educate old people about using modern computers so they could develop the same kind of intuitive understanding we have.