27 ms·

Apple has pushed a silent Mac update to remove hidden Zoom web server

1358 points by coloneltcb 7y ago

sparky_ 7y ago
From the article, this sounds like it was a GateKeeper change, de-whitelisting the signature, rather than an update, per se.
- saidajigumi 7y ago
  Of note, Apple has had its own malware detection and removal system in place since the Mountain Lion - Snow Leopard timeframe. Since this article speaks to removal, it's sounding like the Zoom local server may have had its signature added to that system.
  - bredren 7y ago
    So the local server is not a regular price of software with a vulnerability, it is now considered malware?
    - sieabahlpark 7y ago
      Yes because even if you purposely uninstalled the application it would reinstall if you went to a link even by accident without really notifying you that it did so. So yes, malware.
    - olliej 7y ago
      The server was intentionally left behind, and running, by the "uninstaller". The server would respond to requests by reinstalling the intentionally uninstalled software. That's malware. The server itself was deliberately added to work around a Safari security feature, that was designed specifically to prevent what they wanted: allowing arbitrary web content to open an app without user consent. They literally added an always on, persistent server, to avoid a security dialog
      - javagram 7y ago
        > The server was intentionally left behind, and running, by the "uninstaller FWIW, I don’t think there was a uninstaller? What I’ve seen people describe is that dragging the .App file to the trash wouldn’t remove the server, since it was installed in a different folder. There was no uninstaller until the Zoom update this week added an uninstall option to the menu.
        fastball 7y ago
        I think that is the point. MacOS users expect an app that does not come bundled with an uninstaller to be "uninstalled" by dragging the .app bundle to the trash. This generally leaves behind metadata, but that is not a big deal as it is just data - not code. Leaving behind code that continues to execute after the user has removed the application without an option to uninstall it is obviously something that never should have shipped in the first place from a customer trust perspective.
        javagram 7y ago
        FWIW I am not sure how dragging the .app to the trash would uninstall other things installed by the app. If I drag photoshop to my trash instead of using Adobe’s uninstaller, I’m pretty sure that leaves Creative Cloud junk running on my machine. Now, zoom did mess up by not having a proper uninstaller shipped with their app, I think a lot of other Mac apps do fail at this too though.
        fastball 7y ago
        Yes, as is, dragging apps to the trash cannot do that. Apple should probably implement an API that allows developers to tell the OS what other stuff should be removed if the app is dragged to the trash. To prevent devs from removing other people's stuff, you could require that the subcomponents need to be cryptographically signed with the same key as the main app bundle. edit: or, even simpler solution (potentially) - have a fairly basic API via which devs can install subprograms elsewhere on the system. When you use this API to install something, it adds the thing installed to an OS-level registry. When the user drags the app to the trash, the OS checks the registry and removes anything that was added by the application.
    - vbezhenar 7y ago
      That's Apple's closed garden, even when they allow you to sideload application, they still have the ultimate decision. Of course it's not malware, but probably enough users have vulnerable software which could be remotely exploited, that they decided to blacklist it.
      - scarface74 7y ago
        A program that surreptitiously reinstalls software when you uninstall it is by definition malware. A piece of software that lets any website activate your camera without your permission is a security vulnerability.
        vbezhenar 7y ago
        Malware is a software written to harm user. Their purpose was not to harm user, they wanted to make their service more convenient for users. Bugs are bugs, every product have bugs and many products have security bugs. That does not make them malware.
        scarface74 7y ago
        Intent doesn’t matter only results. The result is that unless you like for random websites to be able to activate your camera without your permission, it did harm users. It wasn’t a “bug”. They purposefully hacked around a security feature. Do you really think it was a “bug” that it reinstalled itself?
        vbezhenar 7y ago
        > Intent doesn’t matter only results. Then you should call Chrome a malware because there were vulnerabilities with remote code execution (and there will be similar vulnerabilities), so every website could install anything. But that is absurd. > The result is that unless you like for random websites to be able to activate your camera without your permission, it did harm users. First of all, you need a hard data that this vulnerability was exploited in the wild. Otherwise it did not harm users, it only opened a way for malicious websites to harm users. And, again, every vulnerability could be counted as a malware by that definition which makes malware term meaningless. > Do you really think it was a “bug” that it reinstalled itself? It is intended behaviour. And I don't see anything drastically bad with it. If you're opening their website with corresponding link, you want to use that service. In order to use that service, you have to run additional software and they are making it easier for you to run it. Only a few years ago every browser supported Java Applets and with Java Applets every website could run arbitrary code on your machine. And that feature was actually used a lot. Does it make all services which used that feature to overcome browser weaknesses malware? I don't think so. They probably should have communicated better about that aspect and provide proper uninstaller software for security-concerned users. And not making those vulnerabilities in the first place, of course. But world is not perfect.
    - saidajigumi 7y ago
      Beyond the unsolicited reinstallation (== malware) behavior other commenters rightly mentioned, the entire existence of the vulnerable server was a hack to work around a Safari security feature. Zoom wanted to eliminate an extra user click, required by Safari to confirm that it was OK to invoke a local application based on the public zoom link. This server was an implementation of that security "workaround". That makes this server at least doubly malware. And "vulnerability" understates the case: a negligent implementation that utterly disregarded any security concerns should be considered beyond the pale. That times 1000 for a major software vendor like Zoom.
- msbarnett 7y ago
  More likely this was done via a signature update to xprotect, which is essentially a background antivirus process in macOS.
  - snuxoll 7y ago
    Doesn't appear so, current XProtect version remains at 2103 which was released a couple months ago now.
    - saagarjha 7y ago
      The update from today updates the MRT configuration data.
    - msbarnett 7y ago
      I haven’t checked, but are you looking at the version of the binary itself, or the MRT signature files it uses
      - snuxoll 7y ago
        Checked XProtect.meta.plist inside the app bundle, forcing an update check with softwareupdate has no impact either. Perhaps it’s a staged rollout, but at least on my iMac there’s no sign of updated signatures.
        msbarnett 7y ago
        Yeah you’re just looking at the version of the xprotect binary, not the malware signature data files, which don’t live in the bundle and get updated more regularly. They also ship silently via system_installd, you’re not going to see anything in the software update GUI
        snuxoll 7y ago
        The signature files also live inside the XProtect.app bundle, unless in true Apple fashion they’ve got other stuff that’s lurking elsewhere in /System that I can’t locate.
- ddeville 7y ago
  Looks like the ZoomOpener app is still present on my machine but it’s not running anymore and it shows as unticked in the Login Items preferences.
cpncrunch 7y ago
My Macbook pro froze this morning...the mouse moved, but I couldn't interact with anything. After a few mins, I hard rebooted it, and it worked fine after that. I'm not sure if it was related to this update, but it's the first time that this has ever happened, so it's a little bit of a coincidence.
- ketralnis 7y ago
  I had the exact same symptom, also for the first time it'd ever happened.
- eridius 7y ago
  It's a coincidence.
- Ambroos 7y ago
  This has been widespread for the last week and a half, but nobody knows why. Unrelated to zoom.
  - cpncrunch 7y ago
    Looking at my logs, I see a gpu reset at the time the problem occurred: Event: GPU Reset RCS Ring is: - busy - in the ring <-- Appears hung I suspect the automated GPU reset didn't quite work, as nothing wasn't redrawing properly.
Deimorz 7y ago
It's been really interesting to see how quickly the original Zoom response of "there's nothing wrong with this, everybody does it" ended up being reversed. I wonder if there's a known exploit for the Zoom server specifically, or if Apple discovered one while looking into it. It seems strange for them to go to these lengths in this case when it sounds like other software has been using a similar technique too. Maybe it's just the reinstallation aspect that makes Zoom's case exceptional?
- threeseed 7y ago
  It was the combination of the vulnerability in the Zoom client combined with this behaviour in the web server: "Additionally, if you’ve ever installed the Zoom client and then uninstalled it, you still have a localhost web server on your machine that will happily re-install the Zoom client for you, without requiring any user interaction on your behalf besides visiting a webpage. This re-install ‘feature’ continues to work to this day."
- cjbprime 7y ago
  Yeah, exactly. Software you've uninstalled gives away permission to use your camera to a remote web page? That's malware, and would get most apps banned permanently.
- ultrarunner 7y ago
  After that PR spin in response to threat disclosure in the original article, I am very skeptical of Zoom's PR machine. > Zoom spokesperson Priscilla McCarthy told TechCrunch: “We’re happy to have worked with Apple on testing this update. We expect the web server issue to be resolved today. We appreciate our users’ patience as we continue to work through addressing their concerns.” Yeah, I bet.
  - Deimorz 7y ago
    Yeah, I'm quite curious now if Zoom's reversal and decision to remove the server was because Apple informed them they were going to forcibly remove it like this. It looked like they decided to remove the server themselves (or at least, as a response to pressure), but maybe they didn't actually have a choice at all.
vondur 7y ago
If you would like to force this update you can do so via the terminal: softwareupdate -ia --include-config-data It will show up as MRTConfigData if you look under Apple Menu->About This Mac->System Report->Software->Installations. The latest version is 1.45 and was updated today which includes the Zoom mitigations.
- czbond 7y ago
  Thank you!
- _rs 7y ago
  Any details about --include-config-data? Doesn't seem to be documented in the help message.
  - sickmate 7y ago
    This blog post[1] has a good explanation of ConfigData updates. The flag would appear to force the install of new Gatekeeper configuration updates. >To help distinguish Gatekeeper and XProtect updates from other updates in the software update feed, Apple marks them as being ConfigData updates. >Marking these updates as ConfigData cues the App Store to not display these as available software updates in the App Store’s list of software updates. These updates are meant to be under Apple’s control and to be as invisible as possible. [1] https://derflounder.wordpress.com/2014/12/27/managing-automatic-installation-of-configdata-and-security-software-updates-on-yosemite/ https://derflounder.wordpress.com/2014/12/27/managing-automa...
- lelf 7y ago
  To check it with fewer mouse clicks: system_profiler SPInstallHistoryDataType |grep -A5 MRTConfigData
  - rabboRubble 7y ago
    Helpful! Thanks...
- rafwarn 7y ago
stefan_ 7y ago
So they installed without further confirmation a silent update that removes a silent installer? No irony?
- eridius 7y ago
  Not really, no. Apple's update is just a configuration change to XProtect, which is the anti-malware system. It's not an OS patch, it's just like any third-party malware system auto-updating signatures.
mukundmr 7y ago
There is an undisclosed RCE that prompted Apple to act. https://twitter.com/riskybusiness/status/1148819622558236673?s=21 https://twitter.com/riskybusiness/status/1148819622558236673...
- sneak 7y ago
  It sounds like silent updates from Apple without automatic updates turned on is also an undisclosed RCE - or an Apple backdoor, depending on how fine a point you wish to put on it. Being my OS or hardware vendor does not entitle you to permanent RCE on the machine that now belongs to me. Unless of course this is just a XProtect rules update or a Gatekeeper CRL update, then ignore what I said.
  - saagarjha 7y ago
    It is.
- chance_state 7y ago
  Someone mentioned this above, too: https://news.ycombinator.com/item?id=20407699 https://news.ycombinator.com/item?id=20407699 Makes the story MUCH worse in my opinion. An unpatched RCE that they left open until someone else got 90% of the way there and went public with it.
Jedi72 7y ago
My coworker owes me lunch, I said they would yank the Zoom app for breaking the app stores TOS (close enough hahaha). Apple cant be very happy with public companies breaking their platform, especially in the name of "UX", which is supposed to be (and is) their differentiator.
- amarshall 7y ago
  Except Zoom isn’t available via the Mac App Store, so there’s no ToS for them to have broken.
Twirrim 7y ago
Disturbs me somewhat that Apple has a way to silently push changes to laptops without user interaction.
- tjohns 7y ago
  This has been in place since 10.6 Snow Leopard. It's part of their built-in anti-malware system (MRT + XProtect + Gatekeeper). It's no different than a virus scanner auto-updating its signatures.
  - shakna 7y ago
    Except that if you auto-update disabled, you'd be somewhat surprised if the virus scanner could update it's signatures.
    - filoleg 7y ago
      As one of the posters already mentioned, it can be easily disabled through the OSX GUI by changing the setting in Preferences -> Software Update -> Advanced -> Install system data files and security updates
- filchermcurr 7y ago
  You can disable it in Preferences -> Software Update -> Advanced -> Install system data files and security updates From there you can manage the updates manually from the command line with the `softwareupdate` command. e.g. `softwareupdate --list --include-config-data` will show available updates, `softwareupdate -ia --include-config-data` will install them, etc.
- deleted 7y ago
  [deleted]
- chipperyman573 7y ago
  Windows update does the same, no?
  - 7y ago
bcheung 7y ago
> Apple said the update does not require any user interaction and is deployed automatically. I think this scares me just as much. #singlePointOfFailure #rootKit
- saagarjha 7y ago
  This isn't an "update" in the traditional sense and you can turn this off from System Preferences.
davidhariri 7y ago
How do these kinds of silent updates work?
- saagarjha 7y ago
  This is an update to Apple's Malware Removal Tool (MRT) blacklist.
AlexCoventry 7y ago
Has anyone checked that `dpkg --purge zoom` does the right thing, on debian/ubuntu?
- ars 7y ago
  Keep in mind dpkg never removes user data. So that said, I checked, and it removes everything zoom installs that isn't in a user directory, plus (there is an extra script that does this): remove_folder "/opt/zoom" remove_folder "$HOME/.zoom/logs" remove_folder "$HOME/.cache/zoom" Which is stupid since it's removing this from root, who probably never ran zoom. Note it removes logs from .zoom, but not the directory itself. Which is good, since there might be user data in there (chat logs, and recordings). Unlike Macs, there is no hidden webserver. There is also (yes, it's commented out): #logged_in_users=$(who -q | head -n 1) #sorted_users=$(echo "$logged_in_users"|tr " " "\n"|sort|uniq|tr "\n" " ") #for user in $sorted_users;do # echo "removing $(grep -w ^$user /etc/passwd | cut -d ":" -f6)""/.zoom..." # remove_folder "$(grep -w ^$user /etc/passwd | cut -d ":" -f6)""/.zoom" # echo "removing $(grep -w ^$user /etc/passwd | cut -d ":" -f6)""/.config/zoomus.conf..." # remove_file "$(grep -w ^$user /etc/passwd | cut -d ":" -f6)""/.config/zoomus.conf"
  - AlexCoventry 7y ago
    Thanks.
drevil-v2 7y ago
I wonder what happens now to the Product Owner who decided it was OK to install hidden web server on user machines?
- rawrmaan 7y ago
  Probably nothing, and mutual lamentation from product and marketing people about the loss of their easiest customer retention strategy.
- mdellavo 7y ago
  eng has responsibility here for going forward with this
  - ummonk 7y ago
    This was likely a product manager decision, implemented by some hapless kid fresh out of college.
jiveturkey 7y ago
ertecheck found this for me maybe 2 months ago. coincidentally right in the disclosure window! i tried etrecheck on a lark. at the time i found it unremarkable. oh, i have this leftover dingle here, thanks etrecheck, i'll just remove it then. but otherwise i wasn't screaming etrecheck from on high. now i am!!
- jhayward 7y ago
  Everything about the etrecheck website screams "system optimizer scam!" and this comment does nothing but reinforce that feeling.
  - jiveturkey 7y ago
    it's a very simple tool, to be sure. but come on, it's not like it's steve gibson wares ... the free version is perfectly adequate. it's simply an information gathering and reporting tool. anyone could write this tool themselves -- the mechanics of it are beyond simple. but like all sysadmin tasks, gathering the requirements is the hard part.
    - etresoft 7y ago
      Alas, EtreCheck is far from simple. Early versions were little more than a wrapper around system_profiler. But the current version is very sophisticated (~40K lines of ObjC, C, XSL, XML, HTML, and JS) and has some one-of-a-kind features. (see above)
  - etresoft 7y ago
    If you try EtreCheck, you’ll find that it has nothing in common with system optimization scams. EtreCheck has no (or very few) magic “fix it” buttons. It only finds issues that appear to be problematic and (optionally) gives the user instructions on how to fix those issues. EtreCheck is definitely an end-user tool. It is designed for people who don’t know what software they have installed. It will even provide people with anti-scam tips if it detects that they might have installed scam apps in the past. For other users, it could still be helpful in listing partially uninstalled software like what is being discussed with the Zoom issue. The latest version of EtreCheckPro 6.0.2 has more features that might appeal to very tech-savvy users. It has a storage analysis feature to help find how your disk is being used since Apple’s own tools are notoriously bad at this. It also has a graphical view of the analytics data that macOS automatically collects. You won’t find this analytics display in any other tool.
rawrmaan 7y ago
That's pretty epic. Apple continues to make big, brave moral gestures (like when they yanked Facebook and Google's enterprise certs earlier this year, or killed long-term tracking cookies in Safari overnight). Makes me happy to be a customer. Hope they keep enforcing their own rules and protecting their users' privacy and security in this fearless manner.
- ma2rten 7y ago
  I don't think killing those enterprise cert was a moral gesture. They were just enforcing their walled garden.
  - deleted 7y ago
    [deleted]
- Deimorz 7y ago
  I don't think disabling the enterprise certs was particularly moral, Facebook and Google were flagrantly violating the terms of the enterprise program. Apple also apparently didn't even notice (or didn't care) until articles about it started getting a lot of attention. Apple definitely does make some commendable decisions, but I think it's also important to distinguish between bravery and what Ben Thompson calls "Strategy Credits" (https://stratechery.com/2013/strategy-credit/ https://stratechery.com/2013/strategy-credit/): > Strategy Credit: An uncomplicated decision that makes a company look good relative to other companies who face much more significant trade-offs.
  - curt15 7y ago
    Indeed a company's "morals" are better exposed when it has to make inconvenient choices.
    - wwright 7y ago
      I would say true morals lead to structuring your company in such a way that you don’t have to rely on business people making ethical decisions moment to moment, because they won’t.
m0dest 7y ago
This means there might have been another side to this story: Zoom's change of heart might have been forced by Apple, not the public backlash. Apple: Hey, your app poses a threat to macOS security. We're going to remove your server app with the built-in macOS anti-virus. Zoom: Oh crap. Okay, give us 2 sprints to release a new version that removes it. Apple: We're killing it in 48 hours. ... Zoom, after an all-nighter: HEyyy users, we have a patch for youu
- deleted 7y ago
  [deleted]
- devin 7y ago
  Wild speculation.
  - dboreham 7y ago
    But highly plausible.
  - vojta_letal 7y ago
    More like a good joke
  - lhoff 7y ago
    Wouldn't say so. The who found the Vulnerability where at least talking to the people at chrome and firefox: Quote from there Blogpost (https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5 https://medium.com/bugbountywriteup/zoom-zero-day-4-million-...) "Apr 10, 2019 — Vulnerability disclosed to Chromium security team. Apr 19, 2019 — Vulnerability disclosed to Mozilla FireFox security team." So, not entirely unrealistic that the other Browser manufacturer also got a notice.
- deleted 7y ago
  [deleted]
- DickSmith 7y ago
  I've been on the Catalina Beta since the week of WWDC, and Zoom hasnt worked for me until the update today. The loading modal would come up, but the app window would never open and I would have to force kill the app entirely, since I couldn't close the modal. I suspect that Apple had already closed the possibility of the loophole on Catalina, which is why it wasn't working. So I suspect they had probably noticed it weeks ago.
tonymet 7y ago
The bigger question -- what other desktop apps have similar, latent daemons hanging around? I'm always wary of installing stuff like this (e.g. zoom, go2meeting, teamviewer). Anyone know of other sneaky apps to avoid?
- gaogao 7y ago
  Razer gaming keyboard drivers spin up a webserver for controlling the chroma, which I've always found scary. (Using the much more reasonable community open source drivers that don't do that.)
  - krferriter 7y ago
    Why in the world would a keyboard driver need to run a webserver? Client software should just be able to call driver functions directly in order to configure the keyboard. It sounds like they hired a web developer to write their driver configuration tool and didn't give any architectural constraints or have someone managing the project who knows best practices or security principles.
    - nemothekid 7y ago
      I don’t have the keyboard, but it’s my understanding that application developers can customize the lights on the keyboard. For example if you die in the game your keyboard turns red. To do that you need IPC, and a JSON endpoint is the most popular form of RPC. If the server listens on localhost, I don’t see any issue with it - any issue you would have with IPC, you would have with this style of of RPC. Now they could have provided a library to communicate directly with the keyboard - but I think the drawback was games developers didn’t want to integrate it into their games.
      - deleted 7y ago
        [deleted]
      - Slartie 7y ago
        > Now they could have provided a library to communicate directly with the keyboard They could have also opened a named pipe. Much cleaner, faster, less overhead than a web server, and way more secure (last time I checked, a website could not simply perform a request on a named pipe via JavaScript. With a local web server however...).
heisenbergs 7y ago
I always wondered why the zoom app required root permissions, which is why I never installed it in the first place. What would a video conferencing app ever need root permissions for?! Now we know: a backdoor. Thank god for Apple putting down the law. This is why I happily pay premium prices...
- eridius 7y ago
  I can't verify since I don't have it installed but I see no reason why this webserver would need root permissions. If it's asking for root it must be for something else.
  - fouc 7y ago
    Quite a few apps ask for root during installation. But now you have me wondering which apps ask for root and which don't. Would be neat if there was a huge app registry website that could show this. Name and shame the ones that ask for root..
    - universenz 7y ago
      Let me introduce you to the nice folks over at Objective See.. https://objective-see.com/products.html https://objective-see.com/products.html They have a bunch of cool little apps (that are free) like BlockBlock that let you know when things are happening you wouldn't have otherwise allowed. For example, BlockBlock warned me randomly about 30 minutes ago about an app that was being silently installed in the background.. something I hadn't seen before called MRT.app. Turns out - that was Apple silently updating the OS to protect against Zoom. Wouldn't have known if it weren't for these apps.
      - hunter2_ 7y ago
        Wow, neat stuff. Several machines ago, I used to run Little Snitch, but never got past the trial. At some point I searched for free alternatives but didn't find anything. LuLu seems to be very similar, so I'm giving it a try! Funny how both companies have "objective" in their names.
tonymet 7y ago
I imagine Apple has known about this daemon for a long time from it's OS analytics.
- eridius 7y ago
  What OS analytics? Apple gathers various anonymous metrics, yes, but I don't think they collect information on arbitrary web servers running on Macs.
  - tonymet 7y ago
    Crash reports include running processes. What do you think the anonymous metrics are if the process list and open sockets are excluded?
    - eridius 7y ago
      Crash reports do not include information from processes other than the one that crashed. They also don't include open sockets. If the web server crashed and produced a crash log, maybe that'll get sent, but I don't know if Apple even collects crash logs from non-MAS apps anyway (what would they do with them? They collect crash logs from MAS apps in order to provide them to the developer).
kaiwen1 7y ago
Wasn't there once a company with the motto "Don't be evil."? If that motto is abandoned, Apple should claim it since they genuinely try do their best to live by it.
- oil25 7y ago
  Apple only does so when it's also convenient to their bottom line. They provide the Chinese government backdoor access to iMessage, remove VPN apps from their store to enable censorship, and have we all forgotten they are a PRISM partner? These actions seem pretty "evil" to me.
  - xenadu02 7y ago
    > They provide the Chinese government backdoor access to iMessage No. What gave you this idea? iMessage is end-to-end encrypted. The keys are managed by the devices themselves. There is no facility to backdoor or intercept the messages. Apple acts as a registration server, notifying your devices when a new device signed in as you joins the pool but the devices themselves tell you when this has happened. That’s all client-side. If the server didn’t tell the client about a new peer it would never encrypt a copy of the message for that peer and that peer wouldn’t get the messages.
    - oil25 7y ago
      > iMessage is end-to-end encrypted. The keys are managed by the devices themselves. There is no facility to backdoor or intercept the messages. That is only a half-truth. Apple controls the key infrastructure; they may replace your keys with arbitrary ones at the demand, coercion or compromise by any number of bad actors. The software is closed source, making it impossible to verify any actual claims made otherwise. If they truly valued privacy, why not open source iMessage, allow users to verify iMessage keys, hire an independent third party to audit their infrastructure, or all of the above? Moreover, Apple has moved iCloud infrastructure to Chinese data centers to enable spying on millions of innocent people. They have removed apps from their store which circumvent Chinese censorship. These are truly shameful acts which has appropriately drawn criticism from human rights watch organizations. https://techcrunch.com/2018/02/25/apple-moves-icloud-encryption-keys-for-chinese-users-to-china/ https://techcrunch.com/2018/02/25/apple-moves-icloud-encrypt... https://www.cnbc.com/2018/02/24/apple-moves-to-store-icloud-keys-in-china-raising-human-rights-fears.html https://www.cnbc.com/2018/02/24/apple-moves-to-store-icloud-... https://www.nytimes.com/2017/07/29/technology/china-apple-censorhip.html https://www.nytimes.com/2017/07/29/technology/china-apple-ce... https://blog.cryptographyengineering.com/2013/06/26/can-apple-read-your-imessages/ https://blog.cryptographyengineering.com/2013/06/26/can-appl...
gruez 7y ago
And why did Apple shut down the app regardless? Was it not properly patched? Did Apple not care?
- bdibs 7y ago
  Probably to not allow it to run if the users didn't update Zoom.
- eddieplan9 7y ago
  Because zoom’s patch will only help users still using and updating zoom while those who have uninstalled zoom are still vulnerable (because the uninstalled leaves the web server behind)
  - duxup 7y ago
    "(because the uninstalled leaves the web server behind)" For cripes sake...
    - londons_explore 7y ago
      Because macos has no decent concept of package management or containerization.
      - Operyl 7y ago
        I mean. The issue at hand was that they purposely left the webserver behind to auto reinstall if a zoom link was clicked. This was an intended feature, and the same could have been done on Linux or Windows. Package management or containers are irrelevant to this conversation.
        deleted 7y ago
        [deleted]
        nitrogen 7y ago
        A package manager would typically have removed the web server, too.
kunday 7y ago
I wonder if this was the real reason behind the Zoom backflip. It certainly cannot be good for business if your app gets marked as malware. Seriously though, they should have owned the mistake, apologised and reversed their decision rather than handling it with a PR spin. It is a great product but somehow it has left me with little trust for zoom. It's probably still not too late. Does anyone know if bluejeans et all are also removing this? Or does it require public shaming, like the zoom case?
xeeeeeeeeeeenu 7y ago
They are basically solving a self-inflicted problem. The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app.
- millstone 7y ago
  Neither does Windows or Linux. I don't think you can have such a standardized way on a flexible general-purpose OS.
  - fastball 7y ago
    What apple should do though is provide an API that developers can hook into, where in when the user drags the app to the trash, it can also uninstall anything else the app placed elsewhere on the system.
    - dev_tty01 7y ago
      They do! The app developers didn't follow the guidelines.
      - fastball 7y ago
        Oh really? Cool! I've been out of the MacOS app dev scene for too long, it seems.
- wwright 7y ago
  It does provide a standard way to uninstall an app: drag it to the trash can. I would say that what Zoom did was have their app intentionally install malware that bypassed this normal uninstall. I do think that it would be great to have a more thoroughly sandboxed idea of what an “app” is on the desktop, though.
  - krferriter 7y ago
    Snapd, flatpak, appimage all can do this on Linux. Even docker/singularity can sort of do the same for some, if you pass through all the necessary devices and sockets from the host. When you remove the app (or container) all the files it brought with it or created during runtime are now gone. Even the regular Linux package managers like apt, dnf, pacman track which files were installed by which packages, so they can be removed when the package is uninstalled. The downside to these is they don't track files created at runtime so a lot of the config or cache files created can be left over if the package itself doesn't remove them.
lighthazard 7y ago
Please, Apple, give me a way to disconnect my microphone and webcam on an OS level so apps can't randomly access it.
- sn0v 7y ago
  Doesn’t that already exist under Preferences > Security & Privacy? Afk rn so i might be misremembering the name of the setting.
  - lighthazard 7y ago
    TIL! Thanks! This is exactly what I wanted.
- ummonk 7y ago
  Wrt webcam I use a sliding webcam cover to block it on a hardware level.
MobileVet 7y ago
This explains why I couldn't find it on my system... was scratching my head when the .zoom folder wasn't on either system that had the Zoom.app. Strong work Apple.
userbinator 7y ago
It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating things like OS files, for example. Some other comments here suggest that the installation of this update is controlled by a setting described as being for system related updates, which a user would expect to leave his/her third-party software alone.) You may agree with its decision this time, but will you always agree? Apple's wielding of power in this way is likely to attract the attention of groups such as copyright/IP lobbyists, which have an immense desire to have all "non-authorised" files/software erased from all user's machines. As the saying goes, "two wrongs don't make a right". In any case, the idea of the OS/platform vendor meddling with third-party software that it doesn't like just feels wrong. I know Apple has historically held tight control over its mobile platforms, but the Mac is meant to be different. I am not an Apple customer, and I now feel even more reluctant to become one.
- saagarjha 7y ago
  > Some other comments here suggest that the installation of this update is controlled by a setting described as being for system related updates, which a user would expect to leave his/her third-party software alone. The setting is called "Install system data files and security updates": it's not just system components.
  - hunter2_ 7y ago
    I suppose that depends on the application of the transitive property of English grammar: "Install (system) (data files and security updates)" or "Install (system data files) and (security updates)"
    - lonelappde 7y ago
      Removing a malware app is installing a system security update.
akashima 7y ago
looks good to me. Do more and more at that pace.
ummonk 7y ago
I was thinking to myself “it is too bad Apple can’t just disable this like they could have on iOS, cause I suspect most people I know with Macs would be vulnerable to it and it is next to impossible to explain to a nontechnical user how to actually uninstall this”. Kudos to Apple for nuking this malware.
ccleve 7y ago
It bothers me that I see an increasing number of apps that run a local web server. I've got half a dozen apps, mostly development tools like pgAdmin, that force me to run the app and then access the UI through a browser. How many such apps am I running that I don't know about? And how many of them are exposing my system to malicious web sites, or to curious people in my office on the same subnet? I wish I knew.
gumby 7y ago
Note that dropbox also opens up three servers on your Mac, though when you exit the app they go away, so are arguably discretionary. I assume they are for lan syncing, though I don't know why that would require three ports. They're blocked in my little snitch anyway so no problem.
bori5 7y ago
Zoom? Thought they were talking about the zoom gesture in MacOS. I’ll move right along then ...
sahin-boydas 7y ago
Zoom should be investigated by the US government. https://news.ycombinator.com/item?id=20408502 https://news.ycombinator.com/item?id=20408502
mayurpipaliya 7y ago
No wonder Apple took this step! Many users are unable to enable Video feature even after applying recent patch released by Zoom. Also zoom has become security joke/conversation topic while starting a con calls!
devin 7y ago
Apple is punishing Zoom, because they explicitly built this mess to get around Safari appropriately prompting users to decide whether they wanted to open the app on each meeting join. If you are a safari user, there was never a vulnerability. You’d be prompted. Why is no one talking about Chrome and Firefox’s lax security posture here? It’s frustrating.
vinay_ys 7y ago
Huh? Why is it ok for Apple or anyone to do silent installs on my computer? As a customer, why am I getting this information from YC/Techcrunch and not Apple? What else have they pushed like this? Is there a transparent log? Can we verify if their track record is clean? How many times have they silently broken and fixed their own things? How do we know they won't abuse this? Isn't this the same dark pattern that we criticized zoom for? Did I consent to Apple doing silent editorial changes to my system? For having exercised this editorial privilege, will Apple take accountability for every thing that is done by every app on my computer? It seems like we are being slow-boiled into accepting outrageous things as normal.
- nhf 7y ago
  Apple has done silent updates for Gatekeeper, the macOS code signing/file quarantine/light anti-malware framework ever since Yosemite. These are done silently unless you explicitly disable all updates and only show up as a visible item when you manually list updates using the softwareupdate command line tool, I think. AFAIK these are just config files and hash databases or similar. You can view the history of these installs by running softwareupdate --history | grep -E "^MRT|^Gatekeeper" I see an average of 2 updates per month. FWIW Apple can also mark something as visible (but install automatically) with a certain config file key. A blog mentions this as being done for patching the NTP bug from a while back: > Marking these updates as ConfigData cues the App Store to not display these as available software updates in the App Store’s list of software updates. These updates are meant to be under Apple’s control and to be as invisible as possible. > Meanwhile, an automatically installed software update like OS X NTP Security Update 1.0 shows up as a normal software update, but has extra keys in its catalog listing to mark it as a critical update whose automatic installation is set to occur as soon as possible. https://derflounder.wordpress.com/2014/12/27/managing-automatic-installation-of-configdata-and-security-software-updates-on-yosemite/ https://derflounder.wordpress.com/2014/12/27/managing-automa...
  - saagarjha 7y ago
    > These are done silently unless you explicitly disable all updates You can turn off silent security updates from System Preferences without affecting software update checks for other components.
kizer 7y ago
Who cares?
snissn 7y ago
I haven't been following this issue, but i am very wary of Zoom since they automatically turn your camera on and broadcast your stream as soon as you click a Zoom link in your web browser which seems like a major issue to me...
gigatexal 7y ago
Zoom should just move to a webRTC based setup with no plugins or anything. Wouldn’t that make things easier?
gdfiutyer 7y ago
Does anyone know if issues like this would only affect the current user account? I currently have a separate limited user account just for meetings, and that’s where I install various meeting apps. So in my case is there any way to know if Zoom or WebEx would install stuff on all accounts?
ancorevard 7y ago
This is why I don’t trust apps outside the App Store as much. If we can’t trust an app that is the cornerstone of a 25 billion dollar business (Zoom’s market cap) not to install malware, then I don’t know. I want the trust through the App Store. PS. I love Zoom, and find it to be the best conference solution out there.
hidiegomariani 7y ago
i love apple for these kind of things
fluffything 7y ago
Now they should push an update to forbid Apps from doing that in the first place without asking the user at least.
geocar 7y ago
Why do web browsers even allow access to localhost? Seems like developers just use this to abuse/violate user preferences anyway. I think I'd be happy with a popup once-per-tab asking me for permission for a web page to talk to a local web server... Might even be okay if it's scary (Are you a developer?)
cyborgx7 7y ago
Once again, a popular site that is completely GDPR non-complient. To opt out of tracking you have to go through six layers of obfuscation. And don't take the wrong turn, or you will just come to walls of text, meant to do nothing but make you throw up your hands and give up. Or you can just opt in to everything with one click.
Razengan 7y ago
I appreciate Apple's handling of these issues, but is there a local log or something where you can see all such "secret" updates? Edit: Apparently there is: https://news.ycombinator.com/item?id=20409200 https://news.ycombinator.com/item?id=20409200
fbelzile 7y ago
Right, but when you try to report a busted macOS API to Apple that breaks your app, you have to walk on egg shells...
TheArcane 7y ago
This whole saga and how it played out is the final nudge I needed in my decision to move completely from Android/PC to Apple
fortran77 7y ago
Why wasn't Microsoft susceptible to this? Did the Microsoft Windows 10 firewall stop this?
xenophonf 7y ago
I don't know about the rest of you, but since crap like Zoom runs just fine in Firefox, that's where I'm keeping it. Ironically, I trust the browser's sandboxing way more than the vendor's app, which inevitably seem to open up my computer to some crazy vulnerability or phone home with my personal data or some other nonsense. I feel, perhaps wrongly, that I have more control over what the browser executes and what (web) applications can access, so Zoom, BlueJeans, Slack, Discord, and the rest are getting trashed.
anecdotalShit 7y ago
I don't like apple products but holy shit the amount of conspiracy theorists here is insane. Configurable silent updates for security vulnerabilities are an issue now? What about spectre,meltdown? Imagine if a user prompt was required for patching those.
Benjamin_Dobell 7y ago
Where can I find the technical details regarding this patch? Another application I've been running for years won't start-up anymore and is logging: > Thu 11 Jul 2019 23:12:59 AEST Waiting for web server to come up It may be coincidental, but would be good to know what Apple changed.
1-6 7y ago
What I'm more surprised about is how Apple can giveth and quickly take it away remotely.
victor106 7y ago
You can judge how a company functions internally by how they respond externally, Zoom’s initial response to this incident was shameful. They basically said “that’s how are app works. F U” I am moving away from Zoom. Any suggestions? Preferably open source
jvagner 7y ago
I had a prospective client/customer, just today, schedule a Zoom meeting for tomorrow. I was aware of the issue this week, but I wasn't really going to make a lot of noise with someone who was just a prospect. I figured.. this has probably evolved already to an acceptable situation. So the calendar invite came in, I started up zoom to see what it would do. There's an update available, where zoom says they're abandoning the local web server. Upgraded, should be good for tomorrow. Came here, noticed the "softwareupdate -i MRTConfigData_10_14-1.45 --include-config-data" command and ran it. Checked last update -- back in June, to 1.42 ... Updated that, ready to go. Business continues, maybe I'll delete zoom another day, but not just yet.
austinkregel 7y ago
I'm so glad they're killing it too. Zoom did a horrible job handling this. (yes, I'm assuming the reported timeline is correct).

1358 points by coloneltcb 7y ago

From the article, this sounds like it was a GateKeeper change, de-whitelisting the signature, rather than an update, per se.

saidajigumi 7y ago
Of note, Apple has had its own malware detection and removal system in place since the Mountain Lion - Snow Leopard timeframe. Since this article speaks to removal, it's sounding like the Zoom local server may have had its signature added to that system.
- bredren 7y ago
  So the local server is not a regular price of software with a vulnerability, it is now considered malware?
  - sieabahlpark 7y ago
    Yes because even if you purposely uninstalled the application it would reinstall if you went to a link even by accident without really notifying you that it did so. So yes, malware.
  - olliej 7y ago
    The server was intentionally left behind, and running, by the "uninstaller". The server would respond to requests by reinstalling the intentionally uninstalled software. That's malware. The server itself was deliberately added to work around a Safari security feature, that was designed specifically to prevent what they wanted: allowing arbitrary web content to open an app without user consent. They literally added an always on, persistent server, to avoid a security dialog
    - javagram 7y ago
      > The server was intentionally left behind, and running, by the "uninstaller FWIW, I don’t think there was a uninstaller? What I’ve seen people describe is that dragging the .App file to the trash wouldn’t remove the server, since it was installed in a different folder. There was no uninstaller until the Zoom update this week added an uninstall option to the menu.
      - fastball 7y ago
        I think that is the point. MacOS users expect an app that does not come bundled with an uninstaller to be "uninstalled" by dragging the .app bundle to the trash. This generally leaves behind metadata, but that is not a big deal as it is just data - not code. Leaving behind code that continues to execute after the user has removed the application without an option to uninstall it is obviously something that never should have shipped in the first place from a customer trust perspective.
        javagram 7y ago
        FWIW I am not sure how dragging the .app to the trash would uninstall other things installed by the app. If I drag photoshop to my trash instead of using Adobe’s uninstaller, I’m pretty sure that leaves Creative Cloud junk running on my machine. Now, zoom did mess up by not having a proper uninstaller shipped with their app, I think a lot of other Mac apps do fail at this too though.
        fastball 7y ago
        Yes, as is, dragging apps to the trash cannot do that. Apple should probably implement an API that allows developers to tell the OS what other stuff should be removed if the app is dragged to the trash. To prevent devs from removing other people's stuff, you could require that the subcomponents need to be cryptographically signed with the same key as the main app bundle. edit: or, even simpler solution (potentially) - have a fairly basic API via which devs can install subprograms elsewhere on the system. When you use this API to install something, it adds the thing installed to an OS-level registry. When the user drags the app to the trash, the OS checks the registry and removes anything that was added by the application.
  - vbezhenar 7y ago
    That's Apple's closed garden, even when they allow you to sideload application, they still have the ultimate decision. Of course it's not malware, but probably enough users have vulnerable software which could be remotely exploited, that they decided to blacklist it.
    - scarface74 7y ago
      A program that surreptitiously reinstalls software when you uninstall it is by definition malware. A piece of software that lets any website activate your camera without your permission is a security vulnerability.
      - vbezhenar 7y ago
        Malware is a software written to harm user. Their purpose was not to harm user, they wanted to make their service more convenient for users. Bugs are bugs, every product have bugs and many products have security bugs. That does not make them malware.
        scarface74 7y ago
        Intent doesn’t matter only results. The result is that unless you like for random websites to be able to activate your camera without your permission, it did harm users. It wasn’t a “bug”. They purposefully hacked around a security feature. Do you really think it was a “bug” that it reinstalled itself?
        vbezhenar 7y ago
        > Intent doesn’t matter only results. Then you should call Chrome a malware because there were vulnerabilities with remote code execution (and there will be similar vulnerabilities), so every website could install anything. But that is absurd. > The result is that unless you like for random websites to be able to activate your camera without your permission, it did harm users. First of all, you need a hard data that this vulnerability was exploited in the wild. Otherwise it did not harm users, it only opened a way for malicious websites to harm users. And, again, every vulnerability could be counted as a malware by that definition which makes malware term meaningless. > Do you really think it was a “bug” that it reinstalled itself? It is intended behaviour. And I don't see anything drastically bad with it. If you're opening their website with corresponding link, you want to use that service. In order to use that service, you have to run additional software and they are making it easier for you to run it. Only a few years ago every browser supported Java Applets and with Java Applets every website could run arbitrary code on your machine. And that feature was actually used a lot. Does it make all services which used that feature to overcome browser weaknesses malware? I don't think so. They probably should have communicated better about that aspect and provide proper uninstaller software for security-concerned users. And not making those vulnerabilities in the first place, of course. But world is not perfect.
  - saidajigumi 7y ago
    Beyond the unsolicited reinstallation (== malware) behavior other commenters rightly mentioned, the entire existence of the vulnerable server was a hack to work around a Safari security feature. Zoom wanted to eliminate an extra user click, required by Safari to confirm that it was OK to invoke a local application based on the public zoom link. This server was an implementation of that security "workaround". That makes this server at least doubly malware. And "vulnerability" understates the case: a negligent implementation that utterly disregarded any security concerns should be considered beyond the pale. That times 1000 for a major software vendor like Zoom.
msbarnett 7y ago
More likely this was done via a signature update to xprotect, which is essentially a background antivirus process in macOS.
- snuxoll 7y ago
  Doesn't appear so, current XProtect version remains at 2103 which was released a couple months ago now.
  - saagarjha 7y ago
    The update from today updates the MRT configuration data.
  - msbarnett 7y ago
    I haven’t checked, but are you looking at the version of the binary itself, or the MRT signature files it uses
    - snuxoll 7y ago
      Checked XProtect.meta.plist inside the app bundle, forcing an update check with softwareupdate has no impact either. Perhaps it’s a staged rollout, but at least on my iMac there’s no sign of updated signatures.
      - msbarnett 7y ago
        Yeah you’re just looking at the version of the xprotect binary, not the malware signature data files, which don’t live in the bundle and get updated more regularly. They also ship silently via system_installd, you’re not going to see anything in the software update GUI
        snuxoll 7y ago
        The signature files also live inside the XProtect.app bundle, unless in true Apple fashion they’ve got other stuff that’s lurking elsewhere in /System that I can’t locate.
ddeville 7y ago
Looks like the ZoomOpener app is still present on my machine but it’s not running anymore and it shows as unticked in the Login Items preferences.

cpncrunch 7y ago

My Macbook pro froze this morning...the mouse moved, but I couldn't interact with anything. After a few mins, I hard rebooted it, and it worked fine after that. I'm not sure if it was related to this update, but it's the first time that this has ever happened, so it's a little bit of a coincidence.

ketralnis 7y ago
I had the exact same symptom, also for the first time it'd ever happened.
eridius 7y ago
It's a coincidence.
Ambroos 7y ago
This has been widespread for the last week and a half, but nobody knows why. Unrelated to zoom.
- cpncrunch 7y ago
  Looking at my logs, I see a gpu reset at the time the problem occurred: Event: GPU Reset RCS Ring is: - busy - in the ring <-- Appears hung I suspect the automated GPU reset didn't quite work, as nothing wasn't redrawing properly.

Deimorz 7y ago

It's been really interesting to see how quickly the original Zoom response of "there's nothing wrong with this, everybody does it" ended up being reversed. I wonder if there's a known exploit for the Zoom server specifically, or if Apple discovered one while looking into it. It seems strange for them to go to these lengths in this case when it sounds like other software has been using a similar technique too. Maybe it's just the reinstallation aspect that makes Zoom's case exceptional?

threeseed 7y ago
It was the combination of the vulnerability in the Zoom client combined with this behaviour in the web server: "Additionally, if you’ve ever installed the Zoom client and then uninstalled it, you still have a localhost web server on your machine that will happily re-install the Zoom client for you, without requiring any user interaction on your behalf besides visiting a webpage. This re-install ‘feature’ continues to work to this day."
cjbprime 7y ago
Yeah, exactly. Software you've uninstalled gives away permission to use your camera to a remote web page? That's malware, and would get most apps banned permanently.
ultrarunner 7y ago
After that PR spin in response to threat disclosure in the original article, I am very skeptical of Zoom's PR machine. > Zoom spokesperson Priscilla McCarthy told TechCrunch: “We’re happy to have worked with Apple on testing this update. We expect the web server issue to be resolved today. We appreciate our users’ patience as we continue to work through addressing their concerns.” Yeah, I bet.
- Deimorz 7y ago
  Yeah, I'm quite curious now if Zoom's reversal and decision to remove the server was because Apple informed them they were going to forcibly remove it like this. It looked like they decided to remove the server themselves (or at least, as a response to pressure), but maybe they didn't actually have a choice at all.

vondur 7y ago

If you would like to force this update you can do so via the terminal: softwareupdate -ia --include-config-data It will show up as MRTConfigData if you look under Apple Menu->About This Mac->System Report->Software->Installations. The latest version is 1.45 and was updated today which includes the Zoom mitigations.

czbond 7y ago
Thank you!
_rs 7y ago
Any details about --include-config-data? Doesn't seem to be documented in the help message.
- sickmate 7y ago
  This blog post[1] has a good explanation of ConfigData updates. The flag would appear to force the install of new Gatekeeper configuration updates. >To help distinguish Gatekeeper and XProtect updates from other updates in the software update feed, Apple marks them as being ConfigData updates. >Marking these updates as ConfigData cues the App Store to not display these as available software updates in the App Store’s list of software updates. These updates are meant to be under Apple’s control and to be as invisible as possible. [1] https://derflounder.wordpress.com/2014/12/27/managing-automatic-installation-of-configdata-and-security-software-updates-on-yosemite/ https://derflounder.wordpress.com/2014/12/27/managing-automa...
lelf 7y ago
To check it with fewer mouse clicks: system_profiler SPInstallHistoryDataType |grep -A5 MRTConfigData
- rabboRubble 7y ago
  Helpful! Thanks...
rafwarn 7y ago

stefan_ 7y ago

So they installed without further confirmation a silent update that removes a silent installer? No irony?

eridius 7y ago
Not really, no. Apple's update is just a configuration change to XProtect, which is the anti-malware system. It's not an OS patch, it's just like any third-party malware system auto-updating signatures.

mukundmr 7y ago

There is an undisclosed RCE that prompted Apple to act. https://twitter.com/riskybusiness/status/1148819622558236673?s=21 https://twitter.com/riskybusiness/status/1148819622558236673...

sneak 7y ago
It sounds like silent updates from Apple without automatic updates turned on is also an undisclosed RCE - or an Apple backdoor, depending on how fine a point you wish to put on it. Being my OS or hardware vendor does not entitle you to permanent RCE on the machine that now belongs to me. Unless of course this is just a XProtect rules update or a Gatekeeper CRL update, then ignore what I said.
- saagarjha 7y ago
  It is.
chance_state 7y ago
Someone mentioned this above, too: https://news.ycombinator.com/item?id=20407699 https://news.ycombinator.com/item?id=20407699 Makes the story MUCH worse in my opinion. An unpatched RCE that they left open until someone else got 90% of the way there and went public with it.

Jedi72 7y ago

My coworker owes me lunch, I said they would yank the Zoom app for breaking the app stores TOS (close enough hahaha). Apple cant be very happy with public companies breaking their platform, especially in the name of "UX", which is supposed to be (and is) their differentiator.

amarshall 7y ago
Except Zoom isn’t available via the Mac App Store, so there’s no ToS for them to have broken.

Twirrim 7y ago

Disturbs me somewhat that Apple has a way to silently push changes to laptops without user interaction.

tjohns 7y ago
This has been in place since 10.6 Snow Leopard. It's part of their built-in anti-malware system (MRT + XProtect + Gatekeeper). It's no different than a virus scanner auto-updating its signatures.
- shakna 7y ago
  Except that if you auto-update disabled, you'd be somewhat surprised if the virus scanner could update it's signatures.
  - filoleg 7y ago
    As one of the posters already mentioned, it can be easily disabled through the OSX GUI by changing the setting in Preferences -> Software Update -> Advanced -> Install system data files and security updates
filchermcurr 7y ago
You can disable it in Preferences -> Software Update -> Advanced -> Install system data files and security updates From there you can manage the updates manually from the command line with the `softwareupdate` command. e.g. `softwareupdate --list --include-config-data` will show available updates, `softwareupdate -ia --include-config-data` will install them, etc.
deleted 7y ago
[deleted]
chipperyman573 7y ago
Windows update does the same, no?
- 7y ago

bcheung 7y ago

> Apple said the update does not require any user interaction and is deployed automatically. I think this scares me just as much. #singlePointOfFailure #rootKit

saagarjha 7y ago
This isn't an "update" in the traditional sense and you can turn this off from System Preferences.

davidhariri 7y ago

How do these kinds of silent updates work?

saagarjha 7y ago
This is an update to Apple's Malware Removal Tool (MRT) blacklist.

AlexCoventry 7y ago

Has anyone checked that `dpkg --purge zoom` does the right thing, on debian/ubuntu?

ars 7y ago
Keep in mind dpkg never removes user data. So that said, I checked, and it removes everything zoom installs that isn't in a user directory, plus (there is an extra script that does this): remove_folder "/opt/zoom" remove_folder "$HOME/.zoom/logs" remove_folder "$HOME/.cache/zoom" Which is stupid since it's removing this from root, who probably never ran zoom. Note it removes logs from .zoom, but not the directory itself. Which is good, since there might be user data in there (chat logs, and recordings). Unlike Macs, there is no hidden webserver. There is also (yes, it's commented out): #logged_in_users=$(who -q | head -n 1) #sorted_users=$(echo "$logged_in_users"|tr " " "\n"|sort|uniq|tr "\n" " ") #for user in $sorted_users;do # echo "removing $(grep -w ^$user /etc/passwd | cut -d ":" -f6)""/.zoom..." # remove_folder "$(grep -w ^$user /etc/passwd | cut -d ":" -f6)""/.zoom" # echo "removing $(grep -w ^$user /etc/passwd | cut -d ":" -f6)""/.config/zoomus.conf..." # remove_file "$(grep -w ^$user /etc/passwd | cut -d ":" -f6)""/.config/zoomus.conf"
- AlexCoventry 7y ago
  Thanks.

drevil-v2 7y ago

I wonder what happens now to the Product Owner who decided it was OK to install hidden web server on user machines?

rawrmaan 7y ago
Probably nothing, and mutual lamentation from product and marketing people about the loss of their easiest customer retention strategy.
mdellavo 7y ago
eng has responsibility here for going forward with this
- ummonk 7y ago
  This was likely a product manager decision, implemented by some hapless kid fresh out of college.

jiveturkey 7y ago

ertecheck found this for me maybe 2 months ago. coincidentally right in the disclosure window! i tried etrecheck on a lark. at the time i found it unremarkable. oh, i have this leftover dingle here, thanks etrecheck, i'll just remove it then. but otherwise i wasn't screaming etrecheck from on high. now i am!!

jhayward 7y ago
Everything about the etrecheck website screams "system optimizer scam!" and this comment does nothing but reinforce that feeling.
- jiveturkey 7y ago
  it's a very simple tool, to be sure. but come on, it's not like it's steve gibson wares ... the free version is perfectly adequate. it's simply an information gathering and reporting tool. anyone could write this tool themselves -- the mechanics of it are beyond simple. but like all sysadmin tasks, gathering the requirements is the hard part.
  - etresoft 7y ago
    Alas, EtreCheck is far from simple. Early versions were little more than a wrapper around system_profiler. But the current version is very sophisticated (~40K lines of ObjC, C, XSL, XML, HTML, and JS) and has some one-of-a-kind features. (see above)
- etresoft 7y ago
  If you try EtreCheck, you’ll find that it has nothing in common with system optimization scams. EtreCheck has no (or very few) magic “fix it” buttons. It only finds issues that appear to be problematic and (optionally) gives the user instructions on how to fix those issues. EtreCheck is definitely an end-user tool. It is designed for people who don’t know what software they have installed. It will even provide people with anti-scam tips if it detects that they might have installed scam apps in the past. For other users, it could still be helpful in listing partially uninstalled software like what is being discussed with the Zoom issue. The latest version of EtreCheckPro 6.0.2 has more features that might appeal to very tech-savvy users. It has a storage analysis feature to help find how your disk is being used since Apple’s own tools are notoriously bad at this. It also has a graphical view of the analytics data that macOS automatically collects. You won’t find this analytics display in any other tool.

rawrmaan 7y ago

That's pretty epic. Apple continues to make big, brave moral gestures (like when they yanked Facebook and Google's enterprise certs earlier this year, or killed long-term tracking cookies in Safari overnight). Makes me happy to be a customer. Hope they keep enforcing their own rules and protecting their users' privacy and security in this fearless manner.

ma2rten 7y ago
I don't think killing those enterprise cert was a moral gesture. They were just enforcing their walled garden.
- deleted 7y ago
  [deleted]
Deimorz 7y ago
I don't think disabling the enterprise certs was particularly moral, Facebook and Google were flagrantly violating the terms of the enterprise program. Apple also apparently didn't even notice (or didn't care) until articles about it started getting a lot of attention. Apple definitely does make some commendable decisions, but I think it's also important to distinguish between bravery and what Ben Thompson calls "Strategy Credits" (https://stratechery.com/2013/strategy-credit/ https://stratechery.com/2013/strategy-credit/): > Strategy Credit: An uncomplicated decision that makes a company look good relative to other companies who face much more significant trade-offs.
- curt15 7y ago
  Indeed a company's "morals" are better exposed when it has to make inconvenient choices.
  - wwright 7y ago
    I would say true morals lead to structuring your company in such a way that you don’t have to rely on business people making ethical decisions moment to moment, because they won’t.

m0dest 7y ago

This means there might have been another side to this story: Zoom's change of heart might have been forced by Apple, not the public backlash. Apple: Hey, your app poses a threat to macOS security. We're going to remove your server app with the built-in macOS anti-virus. Zoom: Oh crap. Okay, give us 2 sprints to release a new version that removes it. Apple: We're killing it in 48 hours. ... Zoom, after an all-nighter: HEyyy users, we have a patch for youu

deleted 7y ago
[deleted]
devin 7y ago
Wild speculation.
- dboreham 7y ago
  But highly plausible.
- vojta_letal 7y ago
  More like a good joke
- lhoff 7y ago
  Wouldn't say so. The who found the Vulnerability where at least talking to the people at chrome and firefox: Quote from there Blogpost (https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5 https://medium.com/bugbountywriteup/zoom-zero-day-4-million-...) "Apr 10, 2019 — Vulnerability disclosed to Chromium security team. Apr 19, 2019 — Vulnerability disclosed to Mozilla FireFox security team." So, not entirely unrealistic that the other Browser manufacturer also got a notice.
deleted 7y ago
[deleted]
DickSmith 7y ago
I've been on the Catalina Beta since the week of WWDC, and Zoom hasnt worked for me until the update today. The loading modal would come up, but the app window would never open and I would have to force kill the app entirely, since I couldn't close the modal. I suspect that Apple had already closed the possibility of the loophole on Catalina, which is why it wasn't working. So I suspect they had probably noticed it weeks ago.

tonymet 7y ago

The bigger question -- what other desktop apps have similar, latent daemons hanging around? I'm always wary of installing stuff like this (e.g. zoom, go2meeting, teamviewer). Anyone know of other sneaky apps to avoid?

gaogao 7y ago
Razer gaming keyboard drivers spin up a webserver for controlling the chroma, which I've always found scary. (Using the much more reasonable community open source drivers that don't do that.)
- krferriter 7y ago
  Why in the world would a keyboard driver need to run a webserver? Client software should just be able to call driver functions directly in order to configure the keyboard. It sounds like they hired a web developer to write their driver configuration tool and didn't give any architectural constraints or have someone managing the project who knows best practices or security principles.
  - nemothekid 7y ago
    I don’t have the keyboard, but it’s my understanding that application developers can customize the lights on the keyboard. For example if you die in the game your keyboard turns red. To do that you need IPC, and a JSON endpoint is the most popular form of RPC. If the server listens on localhost, I don’t see any issue with it - any issue you would have with IPC, you would have with this style of of RPC. Now they could have provided a library to communicate directly with the keyboard - but I think the drawback was games developers didn’t want to integrate it into their games.
    - deleted 7y ago
      [deleted]
    - Slartie 7y ago
      > Now they could have provided a library to communicate directly with the keyboard They could have also opened a named pipe. Much cleaner, faster, less overhead than a web server, and way more secure (last time I checked, a website could not simply perform a request on a named pipe via JavaScript. With a local web server however...).

heisenbergs 7y ago

I always wondered why the zoom app required root permissions, which is why I never installed it in the first place. What would a video conferencing app ever need root permissions for?! Now we know: a backdoor. Thank god for Apple putting down the law. This is why I happily pay premium prices...

eridius 7y ago
I can't verify since I don't have it installed but I see no reason why this webserver would need root permissions. If it's asking for root it must be for something else.
- fouc 7y ago
  Quite a few apps ask for root during installation. But now you have me wondering which apps ask for root and which don't. Would be neat if there was a huge app registry website that could show this. Name and shame the ones that ask for root..
  - universenz 7y ago
    Let me introduce you to the nice folks over at Objective See.. https://objective-see.com/products.html https://objective-see.com/products.html They have a bunch of cool little apps (that are free) like BlockBlock that let you know when things are happening you wouldn't have otherwise allowed. For example, BlockBlock warned me randomly about 30 minutes ago about an app that was being silently installed in the background.. something I hadn't seen before called MRT.app. Turns out - that was Apple silently updating the OS to protect against Zoom. Wouldn't have known if it weren't for these apps.
    - hunter2_ 7y ago
      Wow, neat stuff. Several machines ago, I used to run Little Snitch, but never got past the trial. At some point I searched for free alternatives but didn't find anything. LuLu seems to be very similar, so I'm giving it a try! Funny how both companies have "objective" in their names.

tonymet 7y ago

I imagine Apple has known about this daemon for a long time from it's OS analytics.

eridius 7y ago
What OS analytics? Apple gathers various anonymous metrics, yes, but I don't think they collect information on arbitrary web servers running on Macs.
- tonymet 7y ago
  Crash reports include running processes. What do you think the anonymous metrics are if the process list and open sockets are excluded?
  - eridius 7y ago
    Crash reports do not include information from processes other than the one that crashed. They also don't include open sockets. If the web server crashed and produced a crash log, maybe that'll get sent, but I don't know if Apple even collects crash logs from non-MAS apps anyway (what would they do with them? They collect crash logs from MAS apps in order to provide them to the developer).

kaiwen1 7y ago

Wasn't there once a company with the motto "Don't be evil."? If that motto is abandoned, Apple should claim it since they genuinely try do their best to live by it.

oil25 7y ago
Apple only does so when it's also convenient to their bottom line. They provide the Chinese government backdoor access to iMessage, remove VPN apps from their store to enable censorship, and have we all forgotten they are a PRISM partner? These actions seem pretty "evil" to me.
- xenadu02 7y ago
  > They provide the Chinese government backdoor access to iMessage No. What gave you this idea? iMessage is end-to-end encrypted. The keys are managed by the devices themselves. There is no facility to backdoor or intercept the messages. Apple acts as a registration server, notifying your devices when a new device signed in as you joins the pool but the devices themselves tell you when this has happened. That’s all client-side. If the server didn’t tell the client about a new peer it would never encrypt a copy of the message for that peer and that peer wouldn’t get the messages.
  - oil25 7y ago
    > iMessage is end-to-end encrypted. The keys are managed by the devices themselves. There is no facility to backdoor or intercept the messages. That is only a half-truth. Apple controls the key infrastructure; they may replace your keys with arbitrary ones at the demand, coercion or compromise by any number of bad actors. The software is closed source, making it impossible to verify any actual claims made otherwise. If they truly valued privacy, why not open source iMessage, allow users to verify iMessage keys, hire an independent third party to audit their infrastructure, or all of the above? Moreover, Apple has moved iCloud infrastructure to Chinese data centers to enable spying on millions of innocent people. They have removed apps from their store which circumvent Chinese censorship. These are truly shameful acts which has appropriately drawn criticism from human rights watch organizations. https://techcrunch.com/2018/02/25/apple-moves-icloud-encryption-keys-for-chinese-users-to-china/ https://techcrunch.com/2018/02/25/apple-moves-icloud-encrypt... https://www.cnbc.com/2018/02/24/apple-moves-to-store-icloud-keys-in-china-raising-human-rights-fears.html https://www.cnbc.com/2018/02/24/apple-moves-to-store-icloud-... https://www.nytimes.com/2017/07/29/technology/china-apple-censorhip.html https://www.nytimes.com/2017/07/29/technology/china-apple-ce... https://blog.cryptographyengineering.com/2013/06/26/can-apple-read-your-imessages/ https://blog.cryptographyengineering.com/2013/06/26/can-appl...

gruez 7y ago

And why did Apple shut down the app regardless? Was it not properly patched? Did Apple not care?

bdibs 7y ago
Probably to not allow it to run if the users didn't update Zoom.
eddieplan9 7y ago
Because zoom’s patch will only help users still using and updating zoom while those who have uninstalled zoom are still vulnerable (because the uninstalled leaves the web server behind)
- duxup 7y ago
  "(because the uninstalled leaves the web server behind)" For cripes sake...
  - londons_explore 7y ago
    Because macos has no decent concept of package management or containerization.
    - Operyl 7y ago
      I mean. The issue at hand was that they purposely left the webserver behind to auto reinstall if a zoom link was clicked. This was an intended feature, and the same could have been done on Linux or Windows. Package management or containers are irrelevant to this conversation.
      - deleted 7y ago
        [deleted]
      - nitrogen 7y ago
        A package manager would typically have removed the web server, too.

kunday 7y ago

I wonder if this was the real reason behind the Zoom backflip. It certainly cannot be good for business if your app gets marked as malware. Seriously though, they should have owned the mistake, apologised and reversed their decision rather than handling it with a PR spin. It is a great product but somehow it has left me with little trust for zoom. It's probably still not too late. Does anyone know if bluejeans et all are also removing this? Or does it require public shaming, like the zoom case?

xeeeeeeeeeeenu 7y ago

They are basically solving a self-inflicted problem. The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app.

millstone 7y ago
Neither does Windows or Linux. I don't think you can have such a standardized way on a flexible general-purpose OS.
- fastball 7y ago
  What apple should do though is provide an API that developers can hook into, where in when the user drags the app to the trash, it can also uninstall anything else the app placed elsewhere on the system.
  - dev_tty01 7y ago
    They do! The app developers didn't follow the guidelines.
    - fastball 7y ago
      Oh really? Cool! I've been out of the MacOS app dev scene for too long, it seems.
wwright 7y ago
It does provide a standard way to uninstall an app: drag it to the trash can. I would say that what Zoom did was have their app intentionally install malware that bypassed this normal uninstall. I do think that it would be great to have a more thoroughly sandboxed idea of what an “app” is on the desktop, though.
- krferriter 7y ago
  Snapd, flatpak, appimage all can do this on Linux. Even docker/singularity can sort of do the same for some, if you pass through all the necessary devices and sockets from the host. When you remove the app (or container) all the files it brought with it or created during runtime are now gone. Even the regular Linux package managers like apt, dnf, pacman track which files were installed by which packages, so they can be removed when the package is uninstalled. The downside to these is they don't track files created at runtime so a lot of the config or cache files created can be left over if the package itself doesn't remove them.

lighthazard 7y ago

Please, Apple, give me a way to disconnect my microphone and webcam on an OS level so apps can't randomly access it.

sn0v 7y ago
Doesn’t that already exist under Preferences > Security & Privacy? Afk rn so i might be misremembering the name of the setting.
- lighthazard 7y ago
  TIL! Thanks! This is exactly what I wanted.
ummonk 7y ago
Wrt webcam I use a sliding webcam cover to block it on a hardware level.

MobileVet 7y ago

This explains why I couldn't find it on my system... was scratching my head when the .zoom folder wasn't on either system that had the Zoom.app. Strong work Apple.

userbinator 7y ago

It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating things like OS files, for example. Some other comments here suggest that the installation of this update is controlled by a setting described as being for system related updates, which a user would expect to leave his/her third-party software alone.) You may agree with its decision this time, but will you always agree? Apple's wielding of power in this way is likely to attract the attention of groups such as copyright/IP lobbyists, which have an immense desire to have all "non-authorised" files/software erased from all user's machines. As the saying goes, "two wrongs don't make a right". In any case, the idea of the OS/platform vendor meddling with third-party software that it doesn't like just feels wrong. I know Apple has historically held tight control over its mobile platforms, but the Mac is meant to be different. I am not an Apple customer, and I now feel even more reluctant to become one.

saagarjha 7y ago
> Some other comments here suggest that the installation of this update is controlled by a setting described as being for system related updates, which a user would expect to leave his/her third-party software alone. The setting is called "Install system data files and security updates": it's not just system components.
- hunter2_ 7y ago
  I suppose that depends on the application of the transitive property of English grammar: "Install (system) (data files and security updates)" or "Install (system data files) and (security updates)"
  - lonelappde 7y ago
    Removing a malware app is installing a system security update.

akashima 7y ago

looks good to me. Do more and more at that pace.

ummonk 7y ago

I was thinking to myself “it is too bad Apple can’t just disable this like they could have on iOS, cause I suspect most people I know with Macs would be vulnerable to it and it is next to impossible to explain to a nontechnical user how to actually uninstall this”. Kudos to Apple for nuking this malware.

ccleve 7y ago

It bothers me that I see an increasing number of apps that run a local web server. I've got half a dozen apps, mostly development tools like pgAdmin, that force me to run the app and then access the UI through a browser. How many such apps am I running that I don't know about? And how many of them are exposing my system to malicious web sites, or to curious people in my office on the same subnet? I wish I knew.

gumby 7y ago

Note that dropbox also opens up three servers on your Mac, though when you exit the app they go away, so are arguably discretionary. I assume they are for lan syncing, though I don't know why that would require three ports. They're blocked in my little snitch anyway so no problem.

bori5 7y ago

Zoom? Thought they were talking about the zoom gesture in MacOS. I’ll move right along then ...

sahin-boydas 7y ago

Zoom should be investigated by the US government. https://news.ycombinator.com/item?id=20408502 https://news.ycombinator.com/item?id=20408502

mayurpipaliya 7y ago

No wonder Apple took this step! Many users are unable to enable Video feature even after applying recent patch released by Zoom. Also zoom has become security joke/conversation topic while starting a con calls!

devin 7y ago

Apple is punishing Zoom, because they explicitly built this mess to get around Safari appropriately prompting users to decide whether they wanted to open the app on each meeting join. If you are a safari user, there was never a vulnerability. You’d be prompted. Why is no one talking about Chrome and Firefox’s lax security posture here? It’s frustrating.

vinay_ys 7y ago

Huh? Why is it ok for Apple or anyone to do silent installs on my computer? As a customer, why am I getting this information from YC/Techcrunch and not Apple? What else have they pushed like this? Is there a transparent log? Can we verify if their track record is clean? How many times have they silently broken and fixed their own things? How do we know they won't abuse this? Isn't this the same dark pattern that we criticized zoom for? Did I consent to Apple doing silent editorial changes to my system? For having exercised this editorial privilege, will Apple take accountability for every thing that is done by every app on my computer? It seems like we are being slow-boiled into accepting outrageous things as normal.

nhf 7y ago
Apple has done silent updates for Gatekeeper, the macOS code signing/file quarantine/light anti-malware framework ever since Yosemite. These are done silently unless you explicitly disable all updates and only show up as a visible item when you manually list updates using the softwareupdate command line tool, I think. AFAIK these are just config files and hash databases or similar. You can view the history of these installs by running softwareupdate --history | grep -E "^MRT|^Gatekeeper" I see an average of 2 updates per month. FWIW Apple can also mark something as visible (but install automatically) with a certain config file key. A blog mentions this as being done for patching the NTP bug from a while back: > Marking these updates as ConfigData cues the App Store to not display these as available software updates in the App Store’s list of software updates. These updates are meant to be under Apple’s control and to be as invisible as possible. > Meanwhile, an automatically installed software update like OS X NTP Security Update 1.0 shows up as a normal software update, but has extra keys in its catalog listing to mark it as a critical update whose automatic installation is set to occur as soon as possible. https://derflounder.wordpress.com/2014/12/27/managing-automatic-installation-of-configdata-and-security-software-updates-on-yosemite/ https://derflounder.wordpress.com/2014/12/27/managing-automa...
- saagarjha 7y ago
  > These are done silently unless you explicitly disable all updates You can turn off silent security updates from System Preferences without affecting software update checks for other components.

kizer 7y ago

Who cares?

snissn 7y ago

I haven't been following this issue, but i am very wary of Zoom since they automatically turn your camera on and broadcast your stream as soon as you click a Zoom link in your web browser which seems like a major issue to me...

gigatexal 7y ago

Zoom should just move to a webRTC based setup with no plugins or anything. Wouldn’t that make things easier?

gdfiutyer 7y ago

Does anyone know if issues like this would only affect the current user account? I currently have a separate limited user account just for meetings, and that’s where I install various meeting apps. So in my case is there any way to know if Zoom or WebEx would install stuff on all accounts?

ancorevard 7y ago

This is why I don’t trust apps outside the App Store as much. If we can’t trust an app that is the cornerstone of a 25 billion dollar business (Zoom’s market cap) not to install malware, then I don’t know. I want the trust through the App Store. PS. I love Zoom, and find it to be the best conference solution out there.

hidiegomariani 7y ago

i love apple for these kind of things

fluffything 7y ago

Now they should push an update to forbid Apps from doing that in the first place without asking the user at least.

geocar 7y ago

Why do web browsers even allow access to localhost? Seems like developers just use this to abuse/violate user preferences anyway. I think I'd be happy with a popup once-per-tab asking me for permission for a web page to talk to a local web server... Might even be okay if it's scary (Are you a developer?)

cyborgx7 7y ago

Once again, a popular site that is completely GDPR non-complient. To opt out of tracking you have to go through six layers of obfuscation. And don't take the wrong turn, or you will just come to walls of text, meant to do nothing but make you throw up your hands and give up. Or you can just opt in to everything with one click.

Razengan 7y ago

I appreciate Apple's handling of these issues, but is there a local log or something where you can see all such "secret" updates? Edit: Apparently there is: https://news.ycombinator.com/item?id=20409200 https://news.ycombinator.com/item?id=20409200

fbelzile 7y ago

Right, but when you try to report a busted macOS API to Apple that breaks your app, you have to walk on egg shells...

TheArcane 7y ago

This whole saga and how it played out is the final nudge I needed in my decision to move completely from Android/PC to Apple

fortran77 7y ago

Why wasn't Microsoft susceptible to this? Did the Microsoft Windows 10 firewall stop this?

xenophonf 7y ago

I don't know about the rest of you, but since crap like Zoom runs just fine in Firefox, that's where I'm keeping it. Ironically, I trust the browser's sandboxing way more than the vendor's app, which inevitably seem to open up my computer to some crazy vulnerability or phone home with my personal data or some other nonsense. I feel, perhaps wrongly, that I have more control over what the browser executes and what (web) applications can access, so Zoom, BlueJeans, Slack, Discord, and the rest are getting trashed.

anecdotalShit 7y ago

I don't like apple products but holy shit the amount of conspiracy theorists here is insane. Configurable silent updates for security vulnerabilities are an issue now? What about spectre,meltdown? Imagine if a user prompt was required for patching those.

Benjamin_Dobell 7y ago

Where can I find the technical details regarding this patch? Another application I've been running for years won't start-up anymore and is logging: > Thu 11 Jul 2019 23:12:59 AEST Waiting for web server to come up It may be coincidental, but would be good to know what Apple changed.

1-6 7y ago

What I'm more surprised about is how Apple can giveth and quickly take it away remotely.

victor106 7y ago

You can judge how a company functions internally by how they respond externally, Zoom’s initial response to this incident was shameful. They basically said “that’s how are app works. F U” I am moving away from Zoom. Any suggestions? Preferably open source

jvagner 7y ago

I had a prospective client/customer, just today, schedule a Zoom meeting for tomorrow. I was aware of the issue this week, but I wasn't really going to make a lot of noise with someone who was just a prospect. I figured.. this has probably evolved already to an acceptable situation. So the calendar invite came in, I started up zoom to see what it would do. There's an update available, where zoom says they're abandoning the local web server. Upgraded, should be good for tomorrow. Came here, noticed the "softwareupdate -i MRTConfigData_10_14-1.45 --include-config-data" command and ran it. Checked last update -- back in June, to 1.42 ... Updated that, ready to go. Business continues, maybe I'll delete zoom another day, but not just yet.

austinkregel 7y ago

I'm so glad they're killing it too. Zoom did a horrible job handling this. (yes, I'm assuming the reported timeline is correct).