3 ms·

I remember a few months ago when Google Cloud was offline and people made a room on Zoom to discuss it. Just clicking on a link opened the Zoom app, because it

by ratww 7y ago

I remember a few months ago when Google Cloud was offline and people made a room on Zoom to discuss it. Just clicking on a link opened the Zoom app, because it had installed a daemon behind my back. Considering it's an app with microphone access, I was VERY concerned when it happened. I might be saying that to the wrong audience, but I think Apple is being overly cautious not to bother developers and power users at the expense of security on the desktop. Not as if other OSs are better – just this week my flash drive came back with a Windows virus after I sent it to a print shop –, but still. In this specific case it shouldn't be possible to run without SIP outside of safe mode IMO, but it's still possible because some people need to run unsigned kexts and other hacks. It's the same thing with the sandbox. I've seen a lot of developers making excuses not to publish on the App Store because they need things like unlimited access to home directory for whatever reason and the sandbox restricts them. Last excuse I saw was "we need to scan for subtitles". Yeah, right.

Scapeghost 7y ago
> Last excuse I saw was "we need to scan for subtitles". Yeah, right. Yeah, that's not even a valid excuse! Once a user manually selects a file, the macOS sandbox also gives an app access to any "associated" files like subtitles, automatically: https://developer.apple.com/library/archive/documentation/Security/Conceptual/AppSandboxDesignGuide/AppSandboxInDepth/AppSandboxInDepth.html#//apple_ref/doc/uid/TP40011183-CH3-SW16 https://developer.apple.com/library/archive/documentation/Se... (search for "subtitle" on that page)
- saagarjha 7y ago
  Note that the file name has to match exactly for this to kick in.
whatusername 7y ago
Was that this one? https://www.theverge.com/2019/7/8/20687014/zoom-security-flaw-video-conference-websites-hijack-mac-cameras https://www.theverge.com/2019/7/8/20687014/zoom-security-fla... https://www.macworld.com/article/3407764/zoom-mac-app-flaw-camera-patch.html https://www.macworld.com/article/3407764/zoom-mac-app-flaw-c...
- ratww 7y ago
  That was discovered a short time after I noticed the rogue daemon myself! Let me try to explain better: There was a thread here in HN about a Google Cloud outage and someone posted a link to a Zoom conference. I noticed that their app was still installed after clicking the given link. This happened to other people too: https://news.ycombinator.com/item?id=20077805 https://news.ycombinator.com/item?id=20077805 I wonder if it's a coincidence!
sterlind 7y ago
In a limited way, Windows is better about this sort of thing. System integrity checks (checksums of critical files) can't be disabled, only defeated. All drivers must be signed or you have to enable test signing mode, which requires a reboot and puts annoying text permanently in the corner of the screen. ...but you can still delete whatever you want out of System32 (though it may grow back), and you can add your own things, and dll hijacking is an issue etc. Just when it comes to kernel code are the protections better.
- ratww 7y ago
  I vaguely remember Microsoft pissing off a lot of device makers and users with Vista because it started requiring signed drivers. I might be remembering it wrong, but I thought it was definitely a good thing and definitely a step forward. I wish that would happen more often. With so many things moving to the web there's not that many excuses left to sacrifice security and stability for backwards compatibility.
LgWoodenBadger 7y ago
Are you referring to the same Apple that pushed a silent update to REMOVE the hidden Zoom server? https://news.ycombinator.com/item?id=20407233 https://news.ycombinator.com/item?id=20407233
- ratww 7y ago
  Well, I'd expect the "Malware Removal Tool" to remove malware/backdoors in the first place. But my point is that Zoom shouldn't even have been able to install that server on my system in the first place. It's my computer, so I should have been asked before. Same for Google Keystone Updater.

by ratww 7y ago

Scapeghost 7y ago

> Last excuse I saw was "we need to scan for subtitles". Yeah, right. Yeah, that's not even a valid excuse! Once a user manually selects a file, the macOS sandbox also gives an app access to any "associated" files like subtitles, automatically: https://developer.apple.com/library/archive/documentation/Security/Conceptual/AppSandboxDesignGuide/AppSandboxInDepth/AppSandboxInDepth.html#//apple_ref/doc/uid/TP40011183-CH3-SW16 https://developer.apple.com/library/archive/documentation/Se... (search for "subtitle" on that page)

saagarjha 7y ago
Note that the file name has to match exactly for this to kick in.

whatusername 7y ago

Was that this one? https://www.theverge.com/2019/7/8/20687014/zoom-security-flaw-video-conference-websites-hijack-mac-cameras https://www.theverge.com/2019/7/8/20687014/zoom-security-fla... https://www.macworld.com/article/3407764/zoom-mac-app-flaw-camera-patch.html https://www.macworld.com/article/3407764/zoom-mac-app-flaw-c...

ratww 7y ago
That was discovered a short time after I noticed the rogue daemon myself! Let me try to explain better: There was a thread here in HN about a Google Cloud outage and someone posted a link to a Zoom conference. I noticed that their app was still installed after clicking the given link. This happened to other people too: https://news.ycombinator.com/item?id=20077805 https://news.ycombinator.com/item?id=20077805 I wonder if it's a coincidence!

sterlind 7y ago

In a limited way, Windows is better about this sort of thing. System integrity checks (checksums of critical files) can't be disabled, only defeated. All drivers must be signed or you have to enable test signing mode, which requires a reboot and puts annoying text permanently in the corner of the screen. ...but you can still delete whatever you want out of System32 (though it may grow back), and you can add your own things, and dll hijacking is an issue etc. Just when it comes to kernel code are the protections better.

ratww 7y ago
I vaguely remember Microsoft pissing off a lot of device makers and users with Vista because it started requiring signed drivers. I might be remembering it wrong, but I thought it was definitely a good thing and definitely a step forward. I wish that would happen more often. With so many things moving to the web there's not that many excuses left to sacrifice security and stability for backwards compatibility.

LgWoodenBadger 7y ago

Are you referring to the same Apple that pushed a silent update to REMOVE the hidden Zoom server? https://news.ycombinator.com/item?id=20407233 https://news.ycombinator.com/item?id=20407233

ratww 7y ago
Well, I'd expect the "Malware Removal Tool" to remove malware/backdoors in the first place. But my point is that Zoom shouldn't even have been able to install that server on my system in the first place. It's my computer, so I should have been asked before. Same for Google Keystone Updater.