Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple has pushed a silent Mac update to remove hidden Zoom web server

techcrunch.com

Post reply on HN
Print view View original

521–530 of 552 posts

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#521

Post by bluecmd »

Someone wrote: post #497
bluecmd wrote: post #480

Earlier quoted context omitted.

What do the chmod do there? Removing files count as writes to the directory at least in Linux, so chmodding the dummy file wouldn't do much I'm thinking.

Idea is to prevent the Zoom Software from ‘repairing’ the ‘damaged’ app by overwriting it with the malware. I would also set the ‘user immutable’ flag. If you want even better, set the ‘system immutable’ flag (see ‘man chflags’)

Yes sure, but I question if these permissions would do anything to prevent that. It would reject an open() call on the file, but these are expected to be directories so that would never happen, and it doesn't stop an unlink()

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#522

Post by root_axis »

greenshackle2 wrote: post #513
root_axis wrote: post #221

Earlier quoted context omitted.

It's not spyware, this was not something that was intended to be abused, it's insecure software and its very common, you're running plenty of it right now.

It's not spyware but it's user-hostile, insecure, undocumented, uninstallable-by-the-usual-process software. Most of the insecure software that I run has enough grace to not silently leave behind a web server to automatically re-install itself after I dumped it in the trash can.

You have no idea what "most insecure" software does, if you did you wouldn't be running it. Lots of insecure software fails in spectacularly unexpected ways.

https://www.macworld.co.uk/news/iphone/facetime-bug-hack-369...

This is a horrifying bug. Is Facetime malware? Or do developers with earnest intentions sometimes write buggy code?

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#523

Post by fauigerzigerk »

pvg wrote: post #486
fauigerzigerk wrote: post #439

Earlier quoted context omitted.

I care far more about the facts than about what's in the article. Zoom is clearly not malware. It just has a bug. Is updating regular third party software documented behaviour of macOS? If so then I agree that it is not abuse. Otherwise Apple has some explaining to do.

Sure, facts are important. You started here: The problem is that Apple appears to have made an exception to its own rules in this particular case. If I understand correctly, they used a first party system update mechanism to change third party software. I don't think any of these are established facts and I don't understand how you, a fellow fact-fancier, haven't acknowledged that before breezily moving on to a discu…

If you read the quote carefully, you will see that I did use rather cautious language, and I did that exactly because I wasn't sure that I knew all the facts.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#524

Post by greenshackle2 »

root_axis wrote: post #522
greenshackle2 wrote: post #513

Earlier quoted context omitted.

It's not spyware but it's user-hostile, insecure, undocumented, uninstallable-by-the-usual-process software. Most of the insecure software that I run has enough grace to not silently leave behind a web server to automatically re-install itself after I dumped it in the trash can.

You have no idea what "most insecure" software does, if you did you wouldn't be running it. Lots of insecure software fails in spectacularly unexpected ways. https://www.macworld.co.uk/news/iphone/facetime-bug-hack-369... This is a horrifying bug. Is Facetime malware? Or do developers with earnest intentions sometimes write buggy code?

Buggy code is common, silently installing and running a web server is not.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#525

Post by fauigerzigerk »

pvg wrote: post #520
fauigerzigerk wrote: post #516

Earlier quoted context omitted.

Malicious intent is the only thing that separates malware from a regular security issue. So if we disagree on intent we have to keep disagreeing on whether or not it's malware. But I will admit that I'm starting to see the question of Zoom's intent a bit differently after thinking about what you have said.

Lying to users about the uninstallation is pretty icky intent. It's weird to make this about the sanctity of user choice and just repeatedly ignore that bit on top of coming up with a throughly inaccurate narrative about the nature of Apple's response.

I didn't ignore that bit. You didn't bring it up in your responses to me.

Instead you defended Apple fixing security issues in third party software (as I understood it without user consent) and you compared any concerns about that with concerns about buses intentionally running over pedestrians.

So apparently our debate took wrong turn and that wasn't entirely my fault although I will take some of the blame.

I agree that Zoom's intent (and even more so their methods) is icky. So perhaps we should have focused on that, because I can understand the reasoning that this makes Apple's actions look far more justified than I initially thought.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#526

Post by tinus_hn »

efaref wrote: post #479
tinus_hn wrote: post #467

Earlier quoted context omitted.

I’m sure you also love to complain about the problems at the Foxconn ‘Apple factory’. Which in reality builds products for all manufacturers.

So "everyone else does it" is a valid defense? Apple charges $1k for their monitor stands. I think they can afford to build their stuff at a factory that doesn't use modern slavery.

So “selling your items for cheap” is a valid defense?

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#528

Post by root_axis »

greenshackle2 wrote: post #524
root_axis wrote: post #522

Earlier quoted context omitted.

You have no idea what "most insecure" software does, if you did you wouldn't be running it. Lots of insecure software fails in spectacularly unexpected ways. https://www.macworld.co.uk/news/iphone/facetime-bug-hack-369... This is a horrifying bug. Is Facetime malware? Or do developers with earnest intentions sometimes write buggy code?

Buggy code is common, silently installing and running a web server is not.

The webserver is an implementation detail. It's not uncommon for desktop application software to use native code to provide UX enhancements that are not possible within the browser alone. If the server had been designed securely it would not be an issue, it would just be left-over cruft, which is also pretty common.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#529

Post by userbinator »

pwython wrote: post #463
userbinator wrote: post #110

It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating…

I'll never understand this argument: > Apple's wielding of power in this way... the idea of the OS/platform vendor meddling with third-party software... This is THEIR app store for THEIR operating system. Why in the world would they not be allowed to control their software's features or third party integrations? It reminds me of the ridiculous argument over Windows setting IE as its default browser (and I've been a w…

This isn't about the App Store, I thought I made that clear in my original comment. While I disagree with the decisions it makes, I think Apple certainly has the right to control its App Store.

It reminds me of the ridiculous argument over Windows setting IE as its default browser

What do you mean by that? Instead you reminded me that saying "$our_competitor's product is not secure, so we've helpfully removed it and recommend you use $our_equivalent instead" is likely to run afoul of antitrust laws.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#530

Post by eridius »

tonymet wrote: post #492
eridius wrote: post #50

Earlier quoted context omitted.

What OS analytics? Apple gathers various anonymous metrics, yes, but I don't think they collect information on arbitrary web servers running on Macs.

Crash reports include running processes. What do you think the anonymous metrics are if the process list and open sockets are excluded?

Crash reports do not include information from processes other than the one that crashed. They also don't include open sockets. If the web server crashed and produced a crash log, maybe that'll get sent, but I don't know if Apple even collects crash logs from non-MAS apps anyway (what would they do with them? They collect crash logs from MAS apps in order to provide them to the developer).
Post reply on HN