Live data from Hacker News

Ask HN: Why does Zoom Desktop examine all processes and arguments?

news.ycombinator.com

231–240 of 277 posts

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#231

Earlier quoted context omitted.

This is an unlikely stretch, but it looks like they're also attempting to read `/proc/PID/exe` -- they could be doing something (extremely) cursed like attempting to parse the program linkages and filtering by programs that link to `libX11`. But that's me straining to explain this in the context of the GP's hypothesis.

Why would you implement such a overly complex and unreliable thing when: 1. The windows manager can provide you with a list of open windows. 2. Screensharing including only sharing specific windows is a feature provided by the windows manager over standardized protocols. 3. Even knowing the processes which do have a GUI doesn't allow you to share that GUI, at least not without going through roughly the same mechanism…

The windows manager can provide you with a list of open windows.

But that needs a unified way for this across window managers, does that exist?

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#232
post #231

Earlier quoted context omitted.

Why would you implement such a overly complex and unreliable thing when: 1. The windows manager can provide you with a list of open windows. 2. Screensharing including only sharing specific windows is a feature provided by the windows manager over standardized protocols. 3. Even knowing the processes which do have a GUI doesn't allow you to share that GUI, at least not without going through roughly the same mechanism…

The windows manager can provide you with a list of open windows. But that needs a unified way for this across window managers, does that exist?

I don’t know but xkill works across WM

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#233
post #92

Earlier quoted context omitted.

I run Zoom from flatpak, which runs it in a container, and sandboxes it to some extent [1] This probably explains why, when i try to screenshare a single application window, not every application shows up! I can share my browser, file manager, and various other things, but not windows for games started by Steam. [1] I followed these instructions https://www.mayrhofer.eu.org/post/zoom-flatpak-sandboxing/

Are you using Wayland? That might be an artifact of Steam and games running via XWayland.

As far as i know, no, it's all still pure X11. I would like to try Wayland, but i'm using Cinnamon as a desktop, and i'm not sure they work together.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#234
post #133

Earlier quoted context omitted.

>The audio and video quality, ... is much better in the desktop app But is the quality actually better, or is it post-processing tricks to make it seem better on commodity hardware/audio setups? If it is actually better, surely this should be measurable and there should exist evidence to support such a claim.

> is the quality actually better, or is it post-processing tricks to make it seem better Serious question - if the experience is the same, why does this distinction matter?

Usually postprocessing requires significant computing power. This is something that might matter for people maximizing battery usage. But another person in the same thread says in the case of Zoom it's the opposite - the web app seems more CPU-intensive.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#235

Earlier quoted context omitted.

Never attribute to malice what is adequately explained by laziness. I can easily believe somebody just wrote a chunk of naive code that grabbed all the running processes, and it worked, and they moved on.

Hanlon's razor is a great principle to apply to personal relationships, but it falls apart in these situations. You can explain away any deliberate malice or negligence using it, even when there are clear incentives to enage is such behavior, unless there's absolute evidence of malice. By then it's too late because you've already been swindled, and the principle ignores the lengths organizations will go to cover that…

If you're dealing with bigger threats, you need a more powerful weapon. Sheathe the Hanlon's razor, and unholster the Hanlon's handgun: "Never attribute to stupidity that which can be adequately explained by systemic incentives promoting malice."

https://news.ycombinator.com/item?id=21691282

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#236
post #231

Earlier quoted context omitted.

Why would you implement such a overly complex and unreliable thing when: 1. The windows manager can provide you with a list of open windows. 2. Screensharing including only sharing specific windows is a feature provided by the windows manager over standardized protocols. 3. Even knowing the processes which do have a GUI doesn't allow you to share that GUI, at least not without going through roughly the same mechanism…

The windows manager can provide you with a list of open windows. But that needs a unified way for this across window managers, does that exist?

[deleted]

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#237

Earlier quoted context omitted.

I can't believe I'm saying this, but I'm not sure that last one is zoom's fault. It sounds like Zoom is just calling ShellExecute("open", link), and is getting blamed for the fact that Windows will then connect to random server on public internet and can be convinced to send a hash of the password that can be used to forge a different connection from a different host/client pair with the same credentials.

I mean it is their fault, for a naïve implementation and trusting Windows.

It's the mechanism meant for untrusted links, and it's the prescribed way for instance to open a link in the user's default browser. If Chrome took that link and started sending the user's password hash, that'd clearly be Chrome's fault. Same with, say, an ftp client that listened for ftp paths and would send replayable hashes as the first step. It's clearly SMB's terrible protocol. Yes they removed UNC paths to hack around this... but they shouldn't have to. Nope should they be expected to have known about this particular Windows footgun, IMO.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#238
post #152

Earlier quoted context omitted.

^ This is the correct answer. I installed the Zoom client just to have a look for myself. The syscalls in question emanate from freshly forked processes that immediately execvp() the command `pidof` (on my system it finds it under /usr/bin, so it's the system command, not anything fishy shipped by Zoom). Actually, the command-line argument to the command is, in succession: gnome-session gnome-panel gnome-shell gnome-…

> This hints at a very crude way to determine the desktop environment! That is a good discovery. It's probably one of the better ways to detect the running desktop environment as the user might have multiple environments installed and just uses one of them currently, as such looking for installed things doesn't work reliable. And looking for env variables can be unreliable. And scanning the dbug might not be that use…

[deleted]

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#239

Earlier quoted context omitted.

or it’s spyware, maybe not as bad as a keylogger, but it can be mining your active usage behavior

This could be verified by inspecting their analytics requests. If I have time I may take a peek at those later.

I wasn't able to find much of interest from their desktop client, as all of the data is encrypted and I'm not sure how to grab an SSL key from a desktop app for use in Wireshark decryption. If somebody clever wants to help, please let me know.

I did take at their privacy policy and didn't see anything that explicitly states they are collecting info about running applications. "and other" leaves room for interpretation... Regardless, my main concern after viewing this isn't that they are snooping my running processes and sending that back to home base. Its that they are openly keylogging and tracking everything under the sun, and can view every aspect of the meeting's content (audio, video, text, etc) and share it with 3rd parties like law enforcement and others.

Source: https://zoom.us/privacy#_qhklx843v2zq

> Device Information: Information about the computers, phones, and other devices people use when interacting with Zoom Products, which may include information about the speakers, microphone, camera, OS version, hard disk ID, PC name, MAC address, IP address (which may be used to infer general location at a city or country level), device attributes (like operating system version and battery level), WiFi information, and other device information (like Bluetooth signals).

> Meeting, Webinar, and Messaging Content and Context: Content generated in meetings, webinars, or messages that are hosted on Zoom Products, which may include audio, video, in-meeting messages, chat messaging content, transcriptions, written feedback, responses to polls and Q&A, and files, as well as related context, such as invitation details, meeting or chat name, or meeting agenda. Content may contain your voice and image, depending on the account owner’s settings, what you choose to share, your settings, and what you do on Zoom Products.

> Product and Website Usage: Information about how people and their devices interact with Zoom Products, such as: when participants join and leave a meeting; whether participants sent messages and who they message with; performance data; mouse movements, clicks, keystrokes or actions (such as mute/unmute or video on/off), and other user inputs that help Zoom to understand feature usage, improve product design, and suggest features; which third-party apps users add to a meeting or other Product and what information and actions the app is authorized to access and perform; features used (such as screen sharing, emojis, or filters); and other usage information and metrics. This also includes information about when and how people visit and interact with Zoom’s websites, including what pages they accessed, their interaction with the website features, and whether or not they signed up for a Zoom Product.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#240

Earlier quoted context omitted.

The issue is that this model heralds from the 60s when such problems weren't even considered.

That is a way to see it. I see it differently, for me the main issue is the fact that people run random software that were not even vetted. If you dnf/apt install everything from the official repos of your distro, you wont have any misbehaving apps. And that model still holds. And as I explained, other security models don't work either. People will just whitelist the app, or click "Accept" anyway, because they want t…

If you dnf/apt install everything from the official repos of your distro, you wont have any misbehaving apps. And that model still holds.

How do you know this?

I hear this a lot, I've built packages myself, only because I needed them in a hurry. I never really went through the source code to make sure it's safe. Maybe others did, but I didn't, people installed the package, maybe they were hacked, who knows?

Just saying...

Post reply on HN