26 ms·

How the Zoom macOS installer does its job without you clicking ‘install’

796 points by _Microft 7y ago

t0mas88 7y ago
The whole torrent of grey area, just over the line and outright shady behavior at Zoom is a problem in itself even if all the separate instances in isolation aren't grounds to stop using them. Their responses to security issues and today's revelation of misleading marketing on E2E encryption make it clear they're not just making isolated mistakes. Shady is at the core of how they operate, this is an indication that Zoom has a company culture of accepting borderline behavior. Otherwise it wouldn't be so widespread. As a customer this is a reason for me to stop using Zoom. Not in the last place because I'm quite sure we're only seeing the public tip of the iceberg of all the unacceptable things happening within Zoom.
- capableweb 7y ago
  Unfortunately, the current system and people in power seems to not give a damn about security and shady behavior, as long as the thing they are using is working and working well. Zoom is an example of very useful and performant software with shady company behind it, that's why people will continue using it. Same with Uber, Google and bunch of other companies. It doesn't matter what they do, as their product is helping people enough for people to look past the terrible things.
  - Fiahil 7y ago
    Enterprise customer DO give a damn about security. They can be slow to react, but rules are also there for a very long time. If Zoom doesn't want to loose most of their marketshare in favor of WebEx, they should probably address these issues.
    - m-p-3 7y ago
      Correct, and we blocked zoom.us on the corporate network. No way we're allowing this malware within our walls. We already have meet.google.com that works well for us, and external clients can easily join through a web browser.
    - krageon 7y ago
      > Enterprise customer DO give a damn about security You are wrong. Even without extensive experience in the space, you can very easily see how even large companies don't secure themselves at all. The US has had equifax recently, and it's not like that was an isolated example either. There just isn't a security culture at the eye-watering heights of corporate upper management and while everyone's as busy making money as they are, there never will be. It doesn't fit into the system, and anyone who tries to change it gets muscled out by people who don't want it to change - because that is simply what's most efficient.
      - mywittyname 7y ago
        This has been my experience as well. Large companies pay lip-service to security that protects their customers; they want just enough for legal deniability in the event of a breach, but not so much that it impacts operations or profits. However, they can be...enthusiastic when it comes to security around protecting themselves. If you report an issue with customer information on a public S3 bucket, they might get around to fixing it someday, but if there are "trade secrets" or the like in that bucket, the issue is going to get fixed immediately and someone with a big title probably won't be coming in tomorrow.
    - taylortrusty 7y ago
      They're much more likely to lose it to Microsoft Teams, which has been doing great the last several weeks.
    - kamyarg 7y ago
      As an employee of a corporate can tell you that they do not care about security more than money. cheaper the better. Money > Security
    - Ididntdothis 7y ago
      “Enterprise customer DO give a damn about security.“ When I look at IT they give a damn about some security but then completely ignore other huge problems. I think a bigger concern for them is cost, liability and convenience for the administrators.
    - neuronic 7y ago
      This is hilariously wrong. I brought up Zoom issues at our enterprise client - no one gives a shit (this is in Germany, so rather privacy focused). As a consultant I felt a need to bring the issues up, backed with sources of course. So why does no one care? Because Zoom UI/UX apparently works 100x better than most other solutions. People dont even REACT when I mentions Jitsi or just using the Teams solution that every Microsoft customer has anyways. The enterprise I was talking about is using a mix of Microsoft Teams and Zoom. Our team started with Teams, now we are using Zoom because I don't even know. Others also move from Teams to Zoom. I bring this up to lots of people and the response is rolling eyes and "shut the fuck up" in business euphemisms. Zoom is viral now and privacy has no say in its success.
      - president 7y ago
        Could also be an issue of pricing. I wouldn't be surprised if Zoom is cheaper than MS. Maybe someone with knowledge on the sourcing side could comment on that.
        neuronic 7y ago
        Sorry, I wasn't clear enough. The enterprise already has a Teams license which is part of an Office/Microsoft deal that they will of course continue to have. So Teams is there, will stay there and it works well but people are still moving to Zoom anyways.
  - mikorym 7y ago
    I think you underappreciate one point here: We can still have long term alternatives to Zoom (and we can have them now). Google and Uber are already difficult to replace or to otherwise challange.
    - ForHackernews 7y ago
      Uber is trivially easy to replace with Lyft or $generic-taxi-app.
      - minhazm 7y ago
        Lyft only operates in US and Canada. Uber is available in 63 countries. The convenience you get just having that one Uber app work is not easily replaced. But yeah you could always try to find the local ride sharing companies app, but it can be far less convenient.
        ForHackernews 7y ago
        Only a tiny minority of wealthy people frequently travel internationally. This is not a major selling point that will save Uber.
      - aembleton 7y ago
        How do you persuade enough taxi drivers to use $generic-taxi-app in enough areas to make it worthwhile for someone to choose to use it instead of Uber?
  - m-p-3 7y ago
    They're using malware-like behaviors to spread out and reach more customers, even at the cost of security.
- rwmj 7y ago
  They probably learned a lesson from Whatsapp which was a nightmare of insecurity in the early days that cutting corners gets results and approximately no one cares (except the tiny minority like us who would never use it anyway).
lultimouomo 7y ago
I think this also shows how macOS has been training users to enter their password in random dialogs that have absolutely nothing that identifies them as being legit OS dialogs. The dialog that Zoom uses could very well be sending the credentials to a remote server, and the user would be none the wiser.
- Wowfunhappy 7y ago
  Note that in this case, it's still a legit OS dialog. Preflight scripts are very much built into the macOS pkg format, they're just not intended to be used like this.
  - tantalor 7y ago
    It doesn't look legit, it looks like the installer script is faking a system dialog in this screenshot: https://twitter.com/c1truz_/status/1244737675191619584/photo/3 https://twitter.com/c1truz_/status/1244737675191619584/photo... This message is a lie; it not coming from system but from the installer script. Just because the OS is used to show the dialog doesn't mean it should be trusted. As other commenter noted this could be used to steal passwords; that is effectively what it does.
    - rainforest 7y ago
      To their credit, they seem to be using AuthorizationExecuteWithPrivileges which doesn't get the user's password, but executes a command as root, which is marginally better than stealing the password like Dropbox did.
      - tantalor 7y ago
        How hard do you think it is to steal a password once you have root?
        swiley 7y ago
        It would take an extra step, you have access to the hash and maybe shared memory/SOs but you’d need a second trick to actually steal it.
dbbk 7y ago
But why are they doing this? What is the benefit?
- mstolpm 7y ago
  If one assumes there is nothing really nefarious going on, it seems they are trying to gain market share: Growth marketing to raise the company value. And looking at some people already using "zoom" and "zooming" as synonym for video conferencing, it kind of works.
- Wowfunhappy 7y ago
  Several less mouse clicks to get into a meeting. (I am not arguing in favor of the practice, just stating the advantage)
- dceddia 7y ago
  If I had to guess, it’s an attempt to optimize install conversions. Every multi-step process you ask a user to perform is effectively a (marketing/sales) funnel. Some percentage of people drop off at every step. Maybe Zoom they thought that if they moved the actual installation closer to Step 1, then more people would accomplish it. It’s awfully sneaky though, especially that password dialog.
  - my123 7y ago
    They could have made it just a zip containing an app bundle instead of this mess, but of course they didn't.
  - drewg123 7y ago
    They could have also made it just work in a web browser without having to use workarounds. That's one of the reasons why I strongly prefer Google Meet and get annoyed at vendors that want me to use solutions that require me to install software.
    - dbbk 7y ago
      Conversely, I much prefer a desktop app to Google Meet, since that's stuck in the browser the video can't float PIP when you navigate away from the call
aequitas 7y ago
Not that I'm in favor of this practice, but the one key feature that conference software must have is: it just works™. Nothing turns you off more from a conferencing solution than: any problem getting it working right now. When there is just the slightest issue, one person not being able to join, one person not getting voice to work, bad audio, your entire team is blocked/distracted. Which results in a collective distain for the solution and video conferencing as a whole. This extends to getting the solution working for greenfield installs as simple as possible. Because who knows which non-tech users from which department all need to join and can't figure out how to set the permission in their browser right or install/use the other browser that is compatible. So sadly, from a functionality point of view, you want have the software be able to force itself onto the user in the most usable state it can.
- t0mas88 7y ago
  I'm still curious why everyone thinks Zoom "just works" while others don't. Because in an enterprise context it is often hard to download an executable and run it with sufficient permissions. While Google and Microsoft both offer a product that "just works" with only a browser. What makes Zoom more "just works" than that?
  - capableweb 7y ago
    Well, I have a feeling that the praise for zoom going around is not from people working in enterprises, it's people working for everything-but enterprises, who just want a solution that works. In my experience (also not enterprise), Zoom is the simplest solution with the best quality and latency, compared to the alternatives. The UX could be better, but the performance of Zoom for all platforms makes you survive the UX.
    - jrochkind1 7y ago
      Yep, Zoom is the only one I've used where I have never had an audio problem, never a drop out or glitch.
    - tardo99 7y ago
pottertheotter 7y ago
I installed Zoom on macOS yesterday and I thought that the install was crashing because this is not the expected behavior. I would double click the download, try to install, and then the installation program would "crash", so I'd try it again. Did that a few times before I realized it was installed. Until now I thought it had somehow gotten far enough in the installation process before crashing that I could at least use the application. I'd been hearing everyone raving about how Zoom was such better software than anything else, and my first experience was their installer doesn't even work. This was a horrible user experience for me, and I wasn't thinking about security implications at all.
- macleginn 7y ago
  Same here. I thought the process didn't finish until I tried launching the app (which I was supposed to do by clicking a link in the browser, which is also rather unintuitive).
- pehtis 7y ago
  I would highly recommend checking all installers on macOS through Suspicious Package. It will give you a complete picture of all the installer scripts that will be run and all the files that will be written. I did just that for zoom and decided against installing it.
  - twodayslate 7y ago
    https://mothersruin.com/software/SuspiciousPackage/ https://mothersruin.com/software/SuspiciousPackage/ for those curious
    - 0xff00ffee 7y ago
      Oooh this is good. A few years ago I came home drunk and wanted to watch this old film that wasn't on any channels. I found it on some dubious website, which required me to install a player .dmg. I drunkenly typed in my password, and then an hour later was like: dafuq did I just do?!? Next day I re-imaged my mac because I'm both paranoid and don't know enough about secops. SuspiciousPackage wouldn't have helped combat Drunk Install Syndrome, but it might have been a helpful tool before I nuked my OS. Or maybe this is just good marketing for SuspiciousPackage, which is really malware. Well played.
paulgpetty 7y ago
Two questions this raises, for me at least: How do I know I’ve completely uninstalled all the things Zoom installed? And, if Zoom provided a separate uninstaller (like many apps do) and it was verified to purge all of the stuff they installed (along with the uninstaller); would that appease people's concerns? For now I’m sticking with the iOS app for video & their web-based experience for desktop sharing...
- simonh 7y ago
  A previous version of Zoom installed a web server on MacOS without telling you, and left it there after the uninstall process. So the answer is no, you can't be sure. Oh, and there was a known vulnerability in the web server that allowed remote access to your camera. The company claimed this was all intentional and was a feature and refused to remediate it for months. Eventually Apple issues a system update that removed the web server. https://www.buzzfeednews.com/article/nicolenguyen/zoom-webcam-hacker-watching-you-vulnerability https://www.buzzfeednews.com/article/nicolenguyen/zoom-webca...
- why_only_15 7y ago
  Part of the benefit of macOS apps is that you can just put them in the trash and they're gone. Breaking that contract isn't like awful but it is frustrating.
- aequitas 7y ago
  I think it's interesting to see the outcry when Apple poses new restrictions in the application distribution process (like signing and sandboxing) but conversely the same cries go up when there is an App that seems to be abusing loose control mechanisms. I think a lot of power users rightfully feel they are belittled by sandboxes and application restrictions. But seeing that they are not the major userbase and most Apps don't really need any permissions at all for their intended purpose (the user's purpose at least) I think Apple is moving in the right direction.
  - lonelappde 7y ago
    It's possible to things wrong in more than one way.
factorialboy 7y ago
Why isn't this categorized a major Mac OS vulnerability? If Zoom abuses preinstall scripts, what's to say others aren't.
- scumbert 7y ago
  Underrated take. They shouldn't be able to do this. This should flag Zoom as PUP for malware removal, if it weren't the new go-to.
- lonelappde 7y ago
  It's not a vulnerability, as the dialog says "run a program" and prompts for confirmation. It's up to the user's imagination to consider what a program can do. The prompt is terribly worded though.
  - ddebernardy 7y ago
    It seems macOS could use virtualization or permissions to run these scripts in some throw away environment to get rid of the problem altogether. Preflight check programs shouldn't be able to write anything to disk.
- deleted 7y ago
  [deleted]
realityking 7y ago
I really wish they'd make the client available in the Mac App Store. Not only is the installation experience better than this, things also stay nicely up-to-date. If your company runs an MDM for your Macs, it's easy to deploy apps en-mass to everyone.
- diebeforei485 7y ago
  It's times like this when I realize how much I prefer the Mac App Store over everything else. Zoom should definitely offer a Mac App Store version. Even if they just take their iPad app and Catalyst it, I'd probably use it.
- saagarjha 7y ago
  But then they'd need to opt-in to sandboxing and other "onerous" requirements and couldn't pull shady things like this.
  - ThePowerOfFuet 7y ago
    Nailed it.
xenophonf 7y ago
I missed the part where Zoom is holding people's computers for ransom, or formatting the drive, or exfiltrating sensitive information to criminals or state intelligence officers, or mining bitcoin, or other similarly malicious behaviors. An admin can write to /Applications without privilege escalation? That's a macOS bug. If the operating system didn't rely on an 80s-style put-all-the-executables-in-one-place app launch paradigm, maybe there'd be less incentive for app developers to ignore the per-user Applications folder that macOS supports. An app can spoof or abuse privilege escalation dialogs? That's because macOS doesn't implement an Orange Book-style Trusted Path. It's why Windows and similar operating systems have secure attention keys in the first place. So yeah, Zoom is (ab)using flaws in macOS to get itself installed with minimum fuss, but it isn't doing it with evil intent. They fixed past issues; they'll probably fix this. Meanwhile, these long-standing macOS security flaws won't be addressed by Apple, who has a terrible track record about these things except when it lets people bypass their App Store. P.S. As an enterprise customer, I'm much more worried about end-to-end encryption in Zoom, and the apparent lack thereof. I'm also not sure how that compares with other video conferencing services.
- oefrha 7y ago
  > An admin can write to /Applications without privilege escalation? That's a macOS bug. /Applications has been root:admin 775 since forever ago. It’s not a bug, and drag this app to (an alias of) /Applications is very standard behavior of dmg installers. Working as designed.
  - xenophonf 7y ago
    That behavior goes all the way back to Classic Mac OS. If the above is working as designed, then Zoom automating the copy-app-to-/Applications process doesn't really seem that hinky to me.
    - oefrha 7y ago
      It’s a weird thing to do, but I don’t find it particularly concerning, no. You launched the installer after all. (I do use Suspicious Package to quicklook pkgs myself, FWIW.)
staz 7y ago
https://www.theverge.com/2019/7/8/20687014/zoom-security-flaw-video-conference-websites-hijack-mac-cameras https://www.theverge.com/2019/7/8/20687014/zoom-security-fla...
RocketSyntax 7y ago
Okay, great. Let's wrap some permissions around it to make this a legit process?
wodenokoto 7y ago
Having never installed Zoom, and honestly not having photographic memory of how the installation process on MacOS is, how is it supposed to look in the installer? Also, what happened to just dragging the program into the applications folder? I really liked that way of installing apps, but most things seems to have an annoying click-through wizard.
- jtvjan 7y ago
  They embedded their installation into a pre-install script. Normally, you'd go through a next-next-next process with a pkg installer, but in this case you get a popup asking you if you want to allow it to "run a program to determine if the software can be installed" (the purpose of pre-install scripts) immediately after opening the pkg, you authenticate, and then the installer just disappears.
  - giovannibajo1 7y ago
    Before that, when they had the shady web server, the zoom application would pop up immediately connected to the right meaning, as your browser would be “waking it up” via http. It looks like they still haven’t fixed this after they removed the http server.
josteink 7y ago
Root-kit authors: watch and learn!
proffan 7y ago
resReitna.7z Reminds me of tech support XD
rgovostes 7y ago
I installed the WebEx client for macOS today and it seemed similar, installing almost instantly without going through the normal EULA, volume selection, etc. flow. It seems like they've stuck their installation flow into an Installer.app _plugin_ which is unusual. I haven't encountered that before, and I'm somewhat surprised the feature exists considering Apple waged war on loading code into first-party software. (The user is prompted before the plugin loads.)
- mrpippy 7y ago
  Ughhh, this is probably where Zoom got the idea from.
  - cpeterso 7y ago
    Zoom was founded by Eric Yuan, a lead engineer from Cisco's WebEx business unit.
manigandham 7y ago
1) If Zoom can do this then it's a MacOS security bug. 2) UX matters. Users don't care about the technical details, they want a smooth experience and that can be the difference between a billion-dollar business or a failed startup. And yes the desktop version is more stable than the web-based UI. 3) Malware is defined by what it does, not how it's installed.
- keymone 7y ago
  is botnet agent not malware? it's not doing anything until the operator sends the payload.
  - manigandham 7y ago
    A botnet agent is designed to take control and run a bot, so yes it's malware. It doesn't have to be actively doing it at that moment to be considered such.
    - munk-a 7y ago
      Zoom does report usage to Facebook whether you have an account or not - and that data is used to stitch together a web profile of the user that is of no benefit to the user. Zoom is bordering on malware, just... malware that comes with a useful app that allows video conferencing.
      - vijaybritto 7y ago
        They removed that Facebook sdk after complaints.
- Gaelan 7y ago
  I mean, it's not really a security bug. Installer.app displays a dialog box that says "Hey, this package wants to run arbitrary code to check if it's compatible with your system. Is that OK?" The user is explicitly opting into the code execution. Zoom's "compatibility check" installs the app and kills the installer window. That's certainly unexpected behavior, but I don't think it's an exploit in any real sense. While normally I'd object to running arbitrary code with just an easily-skippable dialog as confirmation, but I think it's OK in this case where the expectation was that we're installing their software anyway.
j1elo 7y ago
Some background info for those commenters who say that Zoom should be requiring just a web browser because web browsers already have everything needed (aka. WebRTC). TL;DR summary: they want to do their own thing, outside of what the WebRTC standard allows, that's all (and enough reason for not using WebRTC?) Zoom doesn't want to use the stock H.264 encoder as provided by the browser for WebRTC communication. Instead, they use their own video encoders and decoders (which while still being H.264, it is presumedly better optimized for their use case). WebRTC forces you to use either the H.264 or the VP8 encoder/decoder that the browser provides. How they do this is by having their own custom application that you have to install. Still, some users have noticed that there is a well hidden web-based version of Zoom, which works by again running their custom encoders, thanks to WebAssembly. Also it seems that their video is transmitted via DataCahnnels [0]. They are not alone. Companies want to provide additional "value" by innovating outside of what the WebRTC standard offers. That's nice and all, although it of course tends to disgregation and incompatibilities in the long run. For this reason, I've heard talks about how future revisions of the standard might explore adding WebAssembly support, in order to allow everyone embedding their own compiled components into their applications [1]. [0]: https://webrtchacks.com/zoom-avoids-using-webrtc/ https://webrtchacks.com/zoom-avoids-using-webrtc/ [1]: https://webrtcbydralex.com/index.php/2019/11/13/webrtc-standard-status-update-q3-2019/ https://webrtcbydralex.com/index.php/2019/11/13/webrtc-stand...
- xorcist 7y ago
  Right. It's also important to understand when the reason to build non-standard things are just "productization" (intended to open the wallets of enterprise clients) and when it is because it really provides a better service to the end user. Having native code running in every client makes a service provider more valuable. It is much the same reason service providers would rather have you running their app on mobile than utilizing the web browser. This link provides a bit of background to the webrtchack articles above and give a bit of background to when WebRTC is sufficient: https://bloggeek.me/webrtc-vs-zoom-video-quality/ https://bloggeek.me/webrtc-vs-zoom-video-quality/
jeroenhd 7y ago
As someone who's never used or seen Zoom in action, what's pulling people into Zoom that's not already available in other tools (Hangouts Meet, MS Teams) and even works without installing anything (such as Jitsi)? Based on what I've seen, there's just so much hostile behaviour by the company (including lying about meeting HIPAA e2e requirements!) and the fact that their _official client_ had parts removed by the macOS malware removal tool that I just don't get why people still consider it as an option. If it were the only "just works" tool out there I'd understand, but there's plenty of competition in this space. I've personally began using the Jitsi server the local student network association has set up and it's been working like a dream. You can even share a window to others (which I didn't even know browsers had support for) for presentations and such.
- milesskorpen 7y ago
  I use Meet at work. For social gatherings, my friend group exclusively uses Zoom because (a) better tiling (seems small, but you want to see everyone) and (b) video quality seems better.
  - giovannibajo1 7y ago
    There’s a chrome extension to do tiling: https://chrome.google.com/webstore/detail/google-meet-grid-view/bjkegbgpfgpikgkfidhcihhiflbjgfic https://chrome.google.com/webstore/detail/google-meet-grid-v... Which is even more infuriating because it shows that missing tiling in Meet is just a frontend issue. I’m completely baffled that this is not implemented.
    - milesskorpen 7y ago
      Yes, that extension is great. Doesn't work on iPads though.
- aeyes 7y ago
  I use Zoom, Hangouts, Slack and WebEx. Out of those Zoom has the best call quality, and it is the only solution out of the 4 on which huge meetings (50+ persons) are workable.
e40 7y ago
I can't imagine why anyone logs in and uses macOS as an admin user. First account I create on a new Mac: admin. Then, when setup is done, I login and create my non-admin user account. This is a good reason for many reasons, this abusive installer being one.
danans 7y ago
For those calling this a security vulnerability in MacOS, isn't this just using a GUI equivalent of "sudo"? There may be a decent argument that a consumer OS shouldn't offer such a sudo-like API to installers, but MacOS probably does this for legacy app support reasons. IMO the better question in this case is why Zoom needs to be installed as admin on MacOS? After all, the mobile apps and chrome extension don't need those privileges.
- saagarjha 7y ago
  This is like the GUI equivalent of running "apt install zoom" and the installation script killing the APT process and then running amok with its root privileges.
  - danans 7y ago
    > This is like the GUI equivalent of running "apt install zoom" and the installation script killing the APT process and then running amok with its root privileges. So in that case it seems like there is perhaps an issue on both sides. - I understand that the OS API to get root/admin privileges likely exists for legacy app install reasons, but why should any install script even be able to run amok with admin privileges? Shouldn't privileges granted by this API this is using be sandboxed in the extreme? Something this sensitive shouldn't be left to the honor system of the app developer. - Independently, I still don't understand why Zoom needs admin privs on Mac when it clearly doesn't need them when installed as a browser extension. I'm using it just fine in Chrome all the time - no admin rights needed.
fermienrico 7y ago
Also, Zoom's entire engineering team is based in China [1]. China and Chinese companies have no real culture of user centric privacy. [1] https://news.ycombinator.com/item?id=22707528 https://news.ycombinator.com/item?id=22707528 Edit: Why downvote me? I am not trying to stir up flame wars. Saying anything against China has become impossible to do on HN. Voices get drowned despite of raising real legitimate concerns about privacy, especially for a tool used by millions all of a sudden during this pandemic. People should be speaking up on HN. I know, I am not supposed to complain about downvotes on HN, I've read the guidelines. Edit2: Not able to find the source for Tianjin datacenter, I will reply if I can find it. Please take it with a grain of salt. Edit3: Holyshit, so much attention on my comment. Redacting unsubstantiated claims and adding more sources that can be traced on the wikipedia section of Zoom privacy criticisms: https://en.wikipedia.org/wiki/Zoom_Video_Communications#Criticism https://en.wikipedia.org/wiki/Zoom_Video_Communications#Crit...
- Lucasoato 7y ago
  totalitarian dictatorship intensifies
  - dang 7y ago
    Please stop posting unsubstantive comments here.
- kerng 7y ago
  Thanks for sharing. I'm not too concerned about engineering happening in China but data storage seems problematic, especially because of the lack of encryption on their side. The post or the CNBC link don't seem to have the word Tianjin in them (comments do). Can you provide more details or another source? If that's indeed true I won't be hopping on a Zoom call later this week with my bank for instance.
  - fermienrico 7y ago
    I'll try to dig out where I read it - Google isn't helping. I am gonna edit my comment to clarify about the source.
jopolous 7y ago
On a simpler level, zoom on macOS sketches me out in lots of ways. My macbook's bluetooth will not connect to my earbuds, but only when zoom is running. Other audio recording/playing apps don't affect things at all. What the heck is going on here?! Scrolling on settings panels is definitely their own home-brewed scrolling functionality. Why?! Was macOS's not cutting it for some reason? The settings menu is very clearly not using native OS buttons and inputs. Why?! Why build your own? What is that for?
- jcelerier 7y ago
  > My macbook's bluetooth will not connect to my earbuds, but only when zoom is running. that sounds like something related to this bug : https://www.jeffgeerling.com/blog/2018/airpods-get-stuck-low-quality-16-khz-audio-mode-when-starting-vm https://www.jeffgeerling.com/blog/2018/airpods-get-stuck-low...
  - jopolous 7y ago
    Nice, that's pretty much what I had to do to fix this. I used the bluetooth explorer to force AAC, and force zoom to use the internal MacBook mic
tambourine_man 7y ago
Zoom's got a tradition of being, let's put it like this, way too clever for everyone's own good. See previous “lets install a server on this Mac that is not removed when you uninstall the app and leaves your camera open to the entire internet” for more examples. I use it on a VM, I suggest you do it too.
- ummonk 7y ago
  I use the web browser version, and refuse to even install Zoom. It's borderline spyware.
  - junky228 7y ago
    sunova.... I couldn't find the web based version...That's what frustrated me about zoom compared to webex. I could use Weber in the browser and zoom had to be installed
    - lloeki 7y ago
      It's gated behind a fallback after three "failed" attempts at clicking on the link to open the app after opening a meeting URL, or a meeting setting. So, not on by default, seems to be unable to join audio unless you use Chrome, and shows a single video only.
      - 333c 7y ago
        This browser extension enables the web interface: https://github.com/arkadiyt/zoom-redirector https://github.com/arkadiyt/zoom-redirector
      - MarkyC4 7y ago
        I tried using the web client in Chrome today on my Mac, and the audio was playing to me at what felt like 50% speed; everyone sounded like slow motion to me.
- saagarjha 7y ago
  It's very Dropbox-esque…
0xff00ffee 7y ago
One suggestion... My company has been using Gotomeeting for 5+ years. No video (thankfully), but meetings are generally 20-30 people and largely seamless. It is expensive: $300 per seat to host a meeting, but it pretty much just works. The UI is annoying and could be simpler. However, I don't know if it is as shady as Zoom because I don't think anyone has done a deep dive.
gentleman11 7y ago
> Zoom has been criticized for its data collection practices,[45] which include its collection and storage of "the content contained in cloud recordings, and instant messages, files, whiteboards" as well as its enabling employers to monitor workers remotely;[46][47] the Electronic Frontier Foundation warned that administrators can join any call at any time "without in-the-moment consent or warning for the attendees of the call."[48] The Ministry of Defence of the U.K. banned its use.[49][50] During signup for a Zoom free account, Zoom requires users to permit it to identify users with their personal information on Google and also offers to permanently delete their Google contacts. Widespread use of Zoom for online education during the novel coronavirus pandemic increased concerns regarding students' data privacy and, in particular, their personally identifiable information.[17] According to the FBI, students’ IP addresses, browsing history, academic progress, and biometric data may be at risk during the use of similar online learning services.[17] Privacy experts are also concerned that the use of Zoom by schools and universities may raise issues regarding unauthorized surveillance of students and possible violations of students’ rights under the Family Educational Rights and Privacy Act (FERPA) - Wikipedia
merpnderp 7y ago
I wish I knew how it installed on my partner's Mac. No root password was ever given, yet it installed when we thought we were still using the web app. Quickly uninstalled and will use different software next time.
miguelmota 7y ago
What I like about zoom is that I can click on a zoom link and it opens up my video conference pretty quickly. Last thing I want is to go through installation steps when people are waiting for me on a call. I understand the security implications but it's a trade-off between user experience and lesser security.
- mr_toad 7y ago
  People will go through the hassle of booking airline tickets, hotels, taxis and take the time to travel to face to face meetings (and some of them even seem to enjoy it). But they won’t spend 5 minutes installing software properly, or half an hour doing some legwork.
  - miguelmota 7y ago
    The difference is that it's expected that booking airlines and hotels will take time so they make time for it but nobody expects to spend minutes installing video conferencing software properly. They expect meeting chat software to just work and be as easy as opening a link. If a person needs to fly somewhere they have limited choices with airlines, but if a person gets frustrated with video conferencing software then they have an abundance of alternative options.
diebir 7y ago
A lot of this is Mac OS X fault: it still does not have an easy canonical way of installing things and has no way for uninstalling. I don't get why in this day mac os can't have something like RPM or any number of other package managers.
- saagarjha 7y ago
  It very much does! Zoom even stumbled upon it, it's called Installer.app. Except, of course, they killed it before it even finished…
overgard 7y ago
I understand wanting to reduce friction, but this is the second time Zoom has kinda done something weird and suspect security wise in the name of removing really minor obstacles that users are probably used to dealing with anyway. Considering how many tech companies are using Zoom right now, I would hope they are cognizant that they don't become known as "the company that does sketchy stuff so our IT people say we can't use it"
AngeloAnolin 7y ago
I removed Zoom from my Mac following this instruction [0] Given their security issues as of late, is there further way I could ensure that my machine has completely removed this software? [0]
Razengan 7y ago
If I search my bookmarks for "zoom" every link is about a discovery of it doing some shady shit. At this point I would just classify it as spyware.
Kaze404 7y ago
Discord also does this On Windows at least) and I don't understand how / why it's allowed.
eyegor 7y ago
Can someone explain to me what the problem is? If you run the installer, isn't that consent to install the software? That's the whole point of it. I guess this isn't the "Mac way" but this is exactly how I would write an install script if I was slapping together support for other platforms. In fact this is the same way most installers work: it unzips an archive somewhere, then creates the links for remove/launch/etc. What is the typical install process for software on a Mac?
- notriddle 7y ago
  Zoom is using a hook in the macOS installer framework in a way that is not intended. This is forming a troubling pattern [1]. Zoom will do anything to reduce the number of clicks to start a conference, even if results in a misleading installer prompt or security vulnerability. [1]: https://www.zdnet.com/article/zoom-defends-use-of-local-web-server-on-macs-after-security-report/ https://www.zdnet.com/article/zoom-defends-use-of-local-web-...
  - whateveracct 7y ago
    Many PMs are obsessed with click optimization. I've been told many times that a certain feature of security method is no-go due to it being "too many clicks" full-stop -.-
emilecantin 7y ago
I have this irrational disgust of .pkg installs, and this is is a good example why. Every time I have to install a .pkg, I wonder what crap it's spreading all around my system. What's wrong with dragging .apps? Does your app really need to spread its tentacles beyond an app bundle and (maybe) some preference files?
int_19h 7y ago
That Twitter thread has a link to a more detailed analysis that was done all the way back in 2016: https://macpkghallofshame.tumblr.com/post/138612887932/indistinguishable-from-malware https://macpkghallofshame.tumblr.com/post/138612887932/indis...
musicale 7y ago
Zoom's malware-like behavior is the reason I only use their web app, in a browser with minimal privileges.
scelerat 7y ago
I have a friend who has some intimate knowledge of MacOS installation software who refuses to use Zoom. "It's not merely because it uses the same install patterns as Russian malware," this person told me, "no; it's personal." Seriously, despite this person's aversion to anything Google, Hangouts ends up being the one tolerable exception.
fouc 7y ago
Are there other app installers that do this? I've got a feeling Zoom is definitely not the only one that does that.
clay_the_ripper 7y ago
To me this implies that the installation process on Mac OS should be improved. The fact that they have to resort to these types of things to make it “just work” for people suggests that the official way of doing things is less than ideal. They are aiming to make the process completely idiot proof, and good for them. If you’ve ever watched a nontechnical user try to install an application you’ll understand why they had to do all this. I recently watched One of my friends who has only ever used an iPad and not a laptop try to install an application downloaded from the internet. Things we take for granted like “find your downloads folder” were not obvious. I had to explain what the Finder is, and it seemed laughably not obvious to someone who has never used it before.
teknologist 7y ago
Instead of installing the Zoom software, join Zoom calls from within your web browser With this trick you can join Zoom calls without ever installing the client on your computer. Here's how to do it: 1) Uninstall the Zoom client if you have it installed (this is important). 2) When you get a Zoom link to join a meeting, click it to open it in your browser. 3) You'll be asked to download Zoom. Click the "download & run Zoom" link, but don't run the installer. 4) Wait for a few moments and a link to "join from your browser" will appear. Click this and join the call as normal. Most of the features work in this browser based version -- there is no need to ever risk your computer! Here's a gif demoing what to click: https://assets.zoom.us/images/en-us/web/client/join-web-client.gif https://assets.zoom.us/images/en-us/web/client/join-web-clie...
neycoda 7y ago
Why does Apple allow this?

796 points by _Microft 7y ago

The whole torrent of grey area, just over the line and outright shady behavior at Zoom is a problem in itself even if all the separate instances in isolation aren't grounds to stop using them. Their responses to security issues and today's revelation of misleading marketing on E2E encryption make it clear they're not just making isolated mistakes. Shady is at the core of how they operate, this is an indication that Zoom has a company culture of accepting borderline behavior. Otherwise it wouldn't be so widespread. As a customer this is a reason for me to stop using Zoom. Not in the last place because I'm quite sure we're only seeing the public tip of the iceberg of all the unacceptable things happening within Zoom.

capableweb 7y ago
Unfortunately, the current system and people in power seems to not give a damn about security and shady behavior, as long as the thing they are using is working and working well. Zoom is an example of very useful and performant software with shady company behind it, that's why people will continue using it. Same with Uber, Google and bunch of other companies. It doesn't matter what they do, as their product is helping people enough for people to look past the terrible things.
- Fiahil 7y ago
  Enterprise customer DO give a damn about security. They can be slow to react, but rules are also there for a very long time. If Zoom doesn't want to loose most of their marketshare in favor of WebEx, they should probably address these issues.
  - m-p-3 7y ago
    Correct, and we blocked zoom.us on the corporate network. No way we're allowing this malware within our walls. We already have meet.google.com that works well for us, and external clients can easily join through a web browser.
  - krageon 7y ago
    > Enterprise customer DO give a damn about security You are wrong. Even without extensive experience in the space, you can very easily see how even large companies don't secure themselves at all. The US has had equifax recently, and it's not like that was an isolated example either. There just isn't a security culture at the eye-watering heights of corporate upper management and while everyone's as busy making money as they are, there never will be. It doesn't fit into the system, and anyone who tries to change it gets muscled out by people who don't want it to change - because that is simply what's most efficient.
    - mywittyname 7y ago
      This has been my experience as well. Large companies pay lip-service to security that protects their customers; they want just enough for legal deniability in the event of a breach, but not so much that it impacts operations or profits. However, they can be...enthusiastic when it comes to security around protecting themselves. If you report an issue with customer information on a public S3 bucket, they might get around to fixing it someday, but if there are "trade secrets" or the like in that bucket, the issue is going to get fixed immediately and someone with a big title probably won't be coming in tomorrow.
  - taylortrusty 7y ago
    They're much more likely to lose it to Microsoft Teams, which has been doing great the last several weeks.
  - kamyarg 7y ago
    As an employee of a corporate can tell you that they do not care about security more than money. cheaper the better. Money > Security
  - Ididntdothis 7y ago
    “Enterprise customer DO give a damn about security.“ When I look at IT they give a damn about some security but then completely ignore other huge problems. I think a bigger concern for them is cost, liability and convenience for the administrators.
  - neuronic 7y ago
    This is hilariously wrong. I brought up Zoom issues at our enterprise client - no one gives a shit (this is in Germany, so rather privacy focused). As a consultant I felt a need to bring the issues up, backed with sources of course. So why does no one care? Because Zoom UI/UX apparently works 100x better than most other solutions. People dont even REACT when I mentions Jitsi or just using the Teams solution that every Microsoft customer has anyways. The enterprise I was talking about is using a mix of Microsoft Teams and Zoom. Our team started with Teams, now we are using Zoom because I don't even know. Others also move from Teams to Zoom. I bring this up to lots of people and the response is rolling eyes and "shut the fuck up" in business euphemisms. Zoom is viral now and privacy has no say in its success.
    - president 7y ago
      Could also be an issue of pricing. I wouldn't be surprised if Zoom is cheaper than MS. Maybe someone with knowledge on the sourcing side could comment on that.
      - neuronic 7y ago
        Sorry, I wasn't clear enough. The enterprise already has a Teams license which is part of an Office/Microsoft deal that they will of course continue to have. So Teams is there, will stay there and it works well but people are still moving to Zoom anyways.
- mikorym 7y ago
  I think you underappreciate one point here: We can still have long term alternatives to Zoom (and we can have them now). Google and Uber are already difficult to replace or to otherwise challange.
  - ForHackernews 7y ago
    Uber is trivially easy to replace with Lyft or $generic-taxi-app.
    - minhazm 7y ago
      Lyft only operates in US and Canada. Uber is available in 63 countries. The convenience you get just having that one Uber app work is not easily replaced. But yeah you could always try to find the local ride sharing companies app, but it can be far less convenient.
      - ForHackernews 7y ago
        Only a tiny minority of wealthy people frequently travel internationally. This is not a major selling point that will save Uber.
    - aembleton 7y ago
      How do you persuade enough taxi drivers to use $generic-taxi-app in enough areas to make it worthwhile for someone to choose to use it instead of Uber?
- m-p-3 7y ago
  They're using malware-like behaviors to spread out and reach more customers, even at the cost of security.
rwmj 7y ago
They probably learned a lesson from Whatsapp which was a nightmare of insecurity in the early days that cutting corners gets results and approximately no one cares (except the tiny minority like us who would never use it anyway).

lultimouomo 7y ago

I think this also shows how macOS has been training users to enter their password in random dialogs that have absolutely nothing that identifies them as being legit OS dialogs. The dialog that Zoom uses could very well be sending the credentials to a remote server, and the user would be none the wiser.

Wowfunhappy 7y ago
Note that in this case, it's still a legit OS dialog. Preflight scripts are very much built into the macOS pkg format, they're just not intended to be used like this.
- tantalor 7y ago
  It doesn't look legit, it looks like the installer script is faking a system dialog in this screenshot: https://twitter.com/c1truz_/status/1244737675191619584/photo/3 https://twitter.com/c1truz_/status/1244737675191619584/photo... This message is a lie; it not coming from system but from the installer script. Just because the OS is used to show the dialog doesn't mean it should be trusted. As other commenter noted this could be used to steal passwords; that is effectively what it does.
  - rainforest 7y ago
    To their credit, they seem to be using AuthorizationExecuteWithPrivileges which doesn't get the user's password, but executes a command as root, which is marginally better than stealing the password like Dropbox did.
    - tantalor 7y ago
      How hard do you think it is to steal a password once you have root?
      - swiley 7y ago
        It would take an extra step, you have access to the hash and maybe shared memory/SOs but you’d need a second trick to actually steal it.

dbbk 7y ago

But why are they doing this? What is the benefit?

mstolpm 7y ago
If one assumes there is nothing really nefarious going on, it seems they are trying to gain market share: Growth marketing to raise the company value. And looking at some people already using "zoom" and "zooming" as synonym for video conferencing, it kind of works.
Wowfunhappy 7y ago
Several less mouse clicks to get into a meeting. (I am not arguing in favor of the practice, just stating the advantage)
dceddia 7y ago
If I had to guess, it’s an attempt to optimize install conversions. Every multi-step process you ask a user to perform is effectively a (marketing/sales) funnel. Some percentage of people drop off at every step. Maybe Zoom they thought that if they moved the actual installation closer to Step 1, then more people would accomplish it. It’s awfully sneaky though, especially that password dialog.
- my123 7y ago
  They could have made it just a zip containing an app bundle instead of this mess, but of course they didn't.
- drewg123 7y ago
  They could have also made it just work in a web browser without having to use workarounds. That's one of the reasons why I strongly prefer Google Meet and get annoyed at vendors that want me to use solutions that require me to install software.
  - dbbk 7y ago
    Conversely, I much prefer a desktop app to Google Meet, since that's stuck in the browser the video can't float PIP when you navigate away from the call

aequitas 7y ago

Not that I'm in favor of this practice, but the one key feature that conference software must have is: it just works™. Nothing turns you off more from a conferencing solution than: any problem getting it working right now. When there is just the slightest issue, one person not being able to join, one person not getting voice to work, bad audio, your entire team is blocked/distracted. Which results in a collective distain for the solution and video conferencing as a whole. This extends to getting the solution working for greenfield installs as simple as possible. Because who knows which non-tech users from which department all need to join and can't figure out how to set the permission in their browser right or install/use the other browser that is compatible. So sadly, from a functionality point of view, you want have the software be able to force itself onto the user in the most usable state it can.

t0mas88 7y ago
I'm still curious why everyone thinks Zoom "just works" while others don't. Because in an enterprise context it is often hard to download an executable and run it with sufficient permissions. While Google and Microsoft both offer a product that "just works" with only a browser. What makes Zoom more "just works" than that?
- capableweb 7y ago
  Well, I have a feeling that the praise for zoom going around is not from people working in enterprises, it's people working for everything-but enterprises, who just want a solution that works. In my experience (also not enterprise), Zoom is the simplest solution with the best quality and latency, compared to the alternatives. The UX could be better, but the performance of Zoom for all platforms makes you survive the UX.
  - jrochkind1 7y ago
    Yep, Zoom is the only one I've used where I have never had an audio problem, never a drop out or glitch.
  - tardo99 7y ago

pottertheotter 7y ago

I installed Zoom on macOS yesterday and I thought that the install was crashing because this is not the expected behavior. I would double click the download, try to install, and then the installation program would "crash", so I'd try it again. Did that a few times before I realized it was installed. Until now I thought it had somehow gotten far enough in the installation process before crashing that I could at least use the application. I'd been hearing everyone raving about how Zoom was such better software than anything else, and my first experience was their installer doesn't even work. This was a horrible user experience for me, and I wasn't thinking about security implications at all.

macleginn 7y ago
Same here. I thought the process didn't finish until I tried launching the app (which I was supposed to do by clicking a link in the browser, which is also rather unintuitive).
pehtis 7y ago
I would highly recommend checking all installers on macOS through Suspicious Package. It will give you a complete picture of all the installer scripts that will be run and all the files that will be written. I did just that for zoom and decided against installing it.
- twodayslate 7y ago
  https://mothersruin.com/software/SuspiciousPackage/ https://mothersruin.com/software/SuspiciousPackage/ for those curious
  - 0xff00ffee 7y ago
    Oooh this is good. A few years ago I came home drunk and wanted to watch this old film that wasn't on any channels. I found it on some dubious website, which required me to install a player .dmg. I drunkenly typed in my password, and then an hour later was like: dafuq did I just do?!? Next day I re-imaged my mac because I'm both paranoid and don't know enough about secops. SuspiciousPackage wouldn't have helped combat Drunk Install Syndrome, but it might have been a helpful tool before I nuked my OS. Or maybe this is just good marketing for SuspiciousPackage, which is really malware. Well played.

paulgpetty 7y ago

Two questions this raises, for me at least: How do I know I’ve completely uninstalled all the things Zoom installed? And, if Zoom provided a separate uninstaller (like many apps do) and it was verified to purge all of the stuff they installed (along with the uninstaller); would that appease people's concerns? For now I’m sticking with the iOS app for video & their web-based experience for desktop sharing...

simonh 7y ago
A previous version of Zoom installed a web server on MacOS without telling you, and left it there after the uninstall process. So the answer is no, you can't be sure. Oh, and there was a known vulnerability in the web server that allowed remote access to your camera. The company claimed this was all intentional and was a feature and refused to remediate it for months. Eventually Apple issues a system update that removed the web server. https://www.buzzfeednews.com/article/nicolenguyen/zoom-webcam-hacker-watching-you-vulnerability https://www.buzzfeednews.com/article/nicolenguyen/zoom-webca...
why_only_15 7y ago
Part of the benefit of macOS apps is that you can just put them in the trash and they're gone. Breaking that contract isn't like awful but it is frustrating.
aequitas 7y ago
I think it's interesting to see the outcry when Apple poses new restrictions in the application distribution process (like signing and sandboxing) but conversely the same cries go up when there is an App that seems to be abusing loose control mechanisms. I think a lot of power users rightfully feel they are belittled by sandboxes and application restrictions. But seeing that they are not the major userbase and most Apps don't really need any permissions at all for their intended purpose (the user's purpose at least) I think Apple is moving in the right direction.
- lonelappde 7y ago
  It's possible to things wrong in more than one way.

factorialboy 7y ago

Why isn't this categorized a major Mac OS vulnerability? If Zoom abuses preinstall scripts, what's to say others aren't.

scumbert 7y ago
Underrated take. They shouldn't be able to do this. This should flag Zoom as PUP for malware removal, if it weren't the new go-to.
lonelappde 7y ago
It's not a vulnerability, as the dialog says "run a program" and prompts for confirmation. It's up to the user's imagination to consider what a program can do. The prompt is terribly worded though.
- ddebernardy 7y ago
  It seems macOS could use virtualization or permissions to run these scripts in some throw away environment to get rid of the problem altogether. Preflight check programs shouldn't be able to write anything to disk.
deleted 7y ago
[deleted]

realityking 7y ago

I really wish they'd make the client available in the Mac App Store. Not only is the installation experience better than this, things also stay nicely up-to-date. If your company runs an MDM for your Macs, it's easy to deploy apps en-mass to everyone.

diebeforei485 7y ago
It's times like this when I realize how much I prefer the Mac App Store over everything else. Zoom should definitely offer a Mac App Store version. Even if they just take their iPad app and Catalyst it, I'd probably use it.
saagarjha 7y ago
But then they'd need to opt-in to sandboxing and other "onerous" requirements and couldn't pull shady things like this.
- ThePowerOfFuet 7y ago
  Nailed it.

xenophonf 7y ago

I missed the part where Zoom is holding people's computers for ransom, or formatting the drive, or exfiltrating sensitive information to criminals or state intelligence officers, or mining bitcoin, or other similarly malicious behaviors. An admin can write to /Applications without privilege escalation? That's a macOS bug. If the operating system didn't rely on an 80s-style put-all-the-executables-in-one-place app launch paradigm, maybe there'd be less incentive for app developers to ignore the per-user Applications folder that macOS supports. An app can spoof or abuse privilege escalation dialogs? That's because macOS doesn't implement an Orange Book-style Trusted Path. It's why Windows and similar operating systems have secure attention keys in the first place. So yeah, Zoom is (ab)using flaws in macOS to get itself installed with minimum fuss, but it isn't doing it with evil intent. They fixed past issues; they'll probably fix this. Meanwhile, these long-standing macOS security flaws won't be addressed by Apple, who has a terrible track record about these things except when it lets people bypass their App Store. P.S. As an enterprise customer, I'm much more worried about end-to-end encryption in Zoom, and the apparent lack thereof. I'm also not sure how that compares with other video conferencing services.

oefrha 7y ago
> An admin can write to /Applications without privilege escalation? That's a macOS bug. /Applications has been root:admin 775 since forever ago. It’s not a bug, and drag this app to (an alias of) /Applications is very standard behavior of dmg installers. Working as designed.
- xenophonf 7y ago
  That behavior goes all the way back to Classic Mac OS. If the above is working as designed, then Zoom automating the copy-app-to-/Applications process doesn't really seem that hinky to me.
  - oefrha 7y ago
    It’s a weird thing to do, but I don’t find it particularly concerning, no. You launched the installer after all. (I do use Suspicious Package to quicklook pkgs myself, FWIW.)

staz 7y ago

https://www.theverge.com/2019/7/8/20687014/zoom-security-flaw-video-conference-websites-hijack-mac-cameras https://www.theverge.com/2019/7/8/20687014/zoom-security-fla...

RocketSyntax 7y ago

Okay, great. Let's wrap some permissions around it to make this a legit process?

wodenokoto 7y ago

Having never installed Zoom, and honestly not having photographic memory of how the installation process on MacOS is, how is it supposed to look in the installer? Also, what happened to just dragging the program into the applications folder? I really liked that way of installing apps, but most things seems to have an annoying click-through wizard.

jtvjan 7y ago
They embedded their installation into a pre-install script. Normally, you'd go through a next-next-next process with a pkg installer, but in this case you get a popup asking you if you want to allow it to "run a program to determine if the software can be installed" (the purpose of pre-install scripts) immediately after opening the pkg, you authenticate, and then the installer just disappears.
- giovannibajo1 7y ago
  Before that, when they had the shady web server, the zoom application would pop up immediately connected to the right meaning, as your browser would be “waking it up” via http. It looks like they still haven’t fixed this after they removed the http server.

josteink 7y ago

Root-kit authors: watch and learn!

proffan 7y ago

resReitna.7z Reminds me of tech support XD

rgovostes 7y ago

I installed the WebEx client for macOS today and it seemed similar, installing almost instantly without going through the normal EULA, volume selection, etc. flow. It seems like they've stuck their installation flow into an Installer.app _plugin_ which is unusual. I haven't encountered that before, and I'm somewhat surprised the feature exists considering Apple waged war on loading code into first-party software. (The user is prompted before the plugin loads.)

mrpippy 7y ago
Ughhh, this is probably where Zoom got the idea from.
- cpeterso 7y ago
  Zoom was founded by Eric Yuan, a lead engineer from Cisco's WebEx business unit.

manigandham 7y ago

1) If Zoom can do this then it's a MacOS security bug. 2) UX matters. Users don't care about the technical details, they want a smooth experience and that can be the difference between a billion-dollar business or a failed startup. And yes the desktop version is more stable than the web-based UI. 3) Malware is defined by what it does, not how it's installed.

keymone 7y ago
is botnet agent not malware? it's not doing anything until the operator sends the payload.
- manigandham 7y ago
  A botnet agent is designed to take control and run a bot, so yes it's malware. It doesn't have to be actively doing it at that moment to be considered such.
  - munk-a 7y ago
    Zoom does report usage to Facebook whether you have an account or not - and that data is used to stitch together a web profile of the user that is of no benefit to the user. Zoom is bordering on malware, just... malware that comes with a useful app that allows video conferencing.
    - vijaybritto 7y ago
      They removed that Facebook sdk after complaints.
Gaelan 7y ago
I mean, it's not really a security bug. Installer.app displays a dialog box that says "Hey, this package wants to run arbitrary code to check if it's compatible with your system. Is that OK?" The user is explicitly opting into the code execution. Zoom's "compatibility check" installs the app and kills the installer window. That's certainly unexpected behavior, but I don't think it's an exploit in any real sense. While normally I'd object to running arbitrary code with just an easily-skippable dialog as confirmation, but I think it's OK in this case where the expectation was that we're installing their software anyway.

j1elo 7y ago

Some background info for those commenters who say that Zoom should be requiring just a web browser because web browsers already have everything needed (aka. WebRTC). TL;DR summary: they want to do their own thing, outside of what the WebRTC standard allows, that's all (and enough reason for not using WebRTC?) Zoom doesn't want to use the stock H.264 encoder as provided by the browser for WebRTC communication. Instead, they use their own video encoders and decoders (which while still being H.264, it is presumedly better optimized for their use case). WebRTC forces you to use either the H.264 or the VP8 encoder/decoder that the browser provides. How they do this is by having their own custom application that you have to install. Still, some users have noticed that there is a well hidden web-based version of Zoom, which works by again running their custom encoders, thanks to WebAssembly. Also it seems that their video is transmitted via DataCahnnels [0]. They are not alone. Companies want to provide additional "value" by innovating outside of what the WebRTC standard offers. That's nice and all, although it of course tends to disgregation and incompatibilities in the long run. For this reason, I've heard talks about how future revisions of the standard might explore adding WebAssembly support, in order to allow everyone embedding their own compiled components into their applications [1]. [0]: https://webrtchacks.com/zoom-avoids-using-webrtc/ https://webrtchacks.com/zoom-avoids-using-webrtc/ [1]: https://webrtcbydralex.com/index.php/2019/11/13/webrtc-standard-status-update-q3-2019/ https://webrtcbydralex.com/index.php/2019/11/13/webrtc-stand...

xorcist 7y ago
Right. It's also important to understand when the reason to build non-standard things are just "productization" (intended to open the wallets of enterprise clients) and when it is because it really provides a better service to the end user. Having native code running in every client makes a service provider more valuable. It is much the same reason service providers would rather have you running their app on mobile than utilizing the web browser. This link provides a bit of background to the webrtchack articles above and give a bit of background to when WebRTC is sufficient: https://bloggeek.me/webrtc-vs-zoom-video-quality/ https://bloggeek.me/webrtc-vs-zoom-video-quality/

jeroenhd 7y ago

As someone who's never used or seen Zoom in action, what's pulling people into Zoom that's not already available in other tools (Hangouts Meet, MS Teams) and even works without installing anything (such as Jitsi)? Based on what I've seen, there's just so much hostile behaviour by the company (including lying about meeting HIPAA e2e requirements!) and the fact that their _official client_ had parts removed by the macOS malware removal tool that I just don't get why people still consider it as an option. If it were the only "just works" tool out there I'd understand, but there's plenty of competition in this space. I've personally began using the Jitsi server the local student network association has set up and it's been working like a dream. You can even share a window to others (which I didn't even know browsers had support for) for presentations and such.

milesskorpen 7y ago
I use Meet at work. For social gatherings, my friend group exclusively uses Zoom because (a) better tiling (seems small, but you want to see everyone) and (b) video quality seems better.
- giovannibajo1 7y ago
  There’s a chrome extension to do tiling: https://chrome.google.com/webstore/detail/google-meet-grid-view/bjkegbgpfgpikgkfidhcihhiflbjgfic https://chrome.google.com/webstore/detail/google-meet-grid-v... Which is even more infuriating because it shows that missing tiling in Meet is just a frontend issue. I’m completely baffled that this is not implemented.
  - milesskorpen 7y ago
    Yes, that extension is great. Doesn't work on iPads though.
aeyes 7y ago
I use Zoom, Hangouts, Slack and WebEx. Out of those Zoom has the best call quality, and it is the only solution out of the 4 on which huge meetings (50+ persons) are workable.

e40 7y ago

I can't imagine why anyone logs in and uses macOS as an admin user. First account I create on a new Mac: admin. Then, when setup is done, I login and create my non-admin user account. This is a good reason for many reasons, this abusive installer being one.

danans 7y ago

For those calling this a security vulnerability in MacOS, isn't this just using a GUI equivalent of "sudo"? There may be a decent argument that a consumer OS shouldn't offer such a sudo-like API to installers, but MacOS probably does this for legacy app support reasons. IMO the better question in this case is why Zoom needs to be installed as admin on MacOS? After all, the mobile apps and chrome extension don't need those privileges.

saagarjha 7y ago
This is like the GUI equivalent of running "apt install zoom" and the installation script killing the APT process and then running amok with its root privileges.
- danans 7y ago
  > This is like the GUI equivalent of running "apt install zoom" and the installation script killing the APT process and then running amok with its root privileges. So in that case it seems like there is perhaps an issue on both sides. - I understand that the OS API to get root/admin privileges likely exists for legacy app install reasons, but why should any install script even be able to run amok with admin privileges? Shouldn't privileges granted by this API this is using be sandboxed in the extreme? Something this sensitive shouldn't be left to the honor system of the app developer. - Independently, I still don't understand why Zoom needs admin privs on Mac when it clearly doesn't need them when installed as a browser extension. I'm using it just fine in Chrome all the time - no admin rights needed.

fermienrico 7y ago

Also, Zoom's entire engineering team is based in China [1]. China and Chinese companies have no real culture of user centric privacy. [1] https://news.ycombinator.com/item?id=22707528 https://news.ycombinator.com/item?id=22707528 Edit: Why downvote me? I am not trying to stir up flame wars. Saying anything against China has become impossible to do on HN. Voices get drowned despite of raising real legitimate concerns about privacy, especially for a tool used by millions all of a sudden during this pandemic. People should be speaking up on HN. I know, I am not supposed to complain about downvotes on HN, I've read the guidelines. Edit2: Not able to find the source for Tianjin datacenter, I will reply if I can find it. Please take it with a grain of salt. Edit3: Holyshit, so much attention on my comment. Redacting unsubstantiated claims and adding more sources that can be traced on the wikipedia section of Zoom privacy criticisms: https://en.wikipedia.org/wiki/Zoom_Video_Communications#Criticism https://en.wikipedia.org/wiki/Zoom_Video_Communications#Crit...

Lucasoato 7y ago
totalitarian dictatorship intensifies
- dang 7y ago
  Please stop posting unsubstantive comments here.
kerng 7y ago
Thanks for sharing. I'm not too concerned about engineering happening in China but data storage seems problematic, especially because of the lack of encryption on their side. The post or the CNBC link don't seem to have the word Tianjin in them (comments do). Can you provide more details or another source? If that's indeed true I won't be hopping on a Zoom call later this week with my bank for instance.
- fermienrico 7y ago
  I'll try to dig out where I read it - Google isn't helping. I am gonna edit my comment to clarify about the source.

jopolous 7y ago

On a simpler level, zoom on macOS sketches me out in lots of ways. My macbook's bluetooth will not connect to my earbuds, but only when zoom is running. Other audio recording/playing apps don't affect things at all. What the heck is going on here?! Scrolling on settings panels is definitely their own home-brewed scrolling functionality. Why?! Was macOS's not cutting it for some reason? The settings menu is very clearly not using native OS buttons and inputs. Why?! Why build your own? What is that for?

jcelerier 7y ago
> My macbook's bluetooth will not connect to my earbuds, but only when zoom is running. that sounds like something related to this bug : https://www.jeffgeerling.com/blog/2018/airpods-get-stuck-low-quality-16-khz-audio-mode-when-starting-vm https://www.jeffgeerling.com/blog/2018/airpods-get-stuck-low...
- jopolous 7y ago
  Nice, that's pretty much what I had to do to fix this. I used the bluetooth explorer to force AAC, and force zoom to use the internal MacBook mic

tambourine_man 7y ago

Zoom's got a tradition of being, let's put it like this, way too clever for everyone's own good. See previous “lets install a server on this Mac that is not removed when you uninstall the app and leaves your camera open to the entire internet” for more examples. I use it on a VM, I suggest you do it too.

ummonk 7y ago
I use the web browser version, and refuse to even install Zoom. It's borderline spyware.
- junky228 7y ago
  sunova.... I couldn't find the web based version...That's what frustrated me about zoom compared to webex. I could use Weber in the browser and zoom had to be installed
  - lloeki 7y ago
    It's gated behind a fallback after three "failed" attempts at clicking on the link to open the app after opening a meeting URL, or a meeting setting. So, not on by default, seems to be unable to join audio unless you use Chrome, and shows a single video only.
    - 333c 7y ago
      This browser extension enables the web interface: https://github.com/arkadiyt/zoom-redirector https://github.com/arkadiyt/zoom-redirector
    - MarkyC4 7y ago
      I tried using the web client in Chrome today on my Mac, and the audio was playing to me at what felt like 50% speed; everyone sounded like slow motion to me.
saagarjha 7y ago
It's very Dropbox-esque…

0xff00ffee 7y ago

One suggestion... My company has been using Gotomeeting for 5+ years. No video (thankfully), but meetings are generally 20-30 people and largely seamless. It is expensive: $300 per seat to host a meeting, but it pretty much just works. The UI is annoying and could be simpler. However, I don't know if it is as shady as Zoom because I don't think anyone has done a deep dive.

gentleman11 7y ago

> Zoom has been criticized for its data collection practices,[45] which include its collection and storage of "the content contained in cloud recordings, and instant messages, files, whiteboards" as well as its enabling employers to monitor workers remotely;[46][47] the Electronic Frontier Foundation warned that administrators can join any call at any time "without in-the-moment consent or warning for the attendees of the call."[48] The Ministry of Defence of the U.K. banned its use.[49][50] During signup for a Zoom free account, Zoom requires users to permit it to identify users with their personal information on Google and also offers to permanently delete their Google contacts. Widespread use of Zoom for online education during the novel coronavirus pandemic increased concerns regarding students' data privacy and, in particular, their personally identifiable information.[17] According to the FBI, students’ IP addresses, browsing history, academic progress, and biometric data may be at risk during the use of similar online learning services.[17] Privacy experts are also concerned that the use of Zoom by schools and universities may raise issues regarding unauthorized surveillance of students and possible violations of students’ rights under the Family Educational Rights and Privacy Act (FERPA) - Wikipedia

merpnderp 7y ago

I wish I knew how it installed on my partner's Mac. No root password was ever given, yet it installed when we thought we were still using the web app. Quickly uninstalled and will use different software next time.

miguelmota 7y ago

What I like about zoom is that I can click on a zoom link and it opens up my video conference pretty quickly. Last thing I want is to go through installation steps when people are waiting for me on a call. I understand the security implications but it's a trade-off between user experience and lesser security.

mr_toad 7y ago
People will go through the hassle of booking airline tickets, hotels, taxis and take the time to travel to face to face meetings (and some of them even seem to enjoy it). But they won’t spend 5 minutes installing software properly, or half an hour doing some legwork.
- miguelmota 7y ago
  The difference is that it's expected that booking airlines and hotels will take time so they make time for it but nobody expects to spend minutes installing video conferencing software properly. They expect meeting chat software to just work and be as easy as opening a link. If a person needs to fly somewhere they have limited choices with airlines, but if a person gets frustrated with video conferencing software then they have an abundance of alternative options.

diebir 7y ago

A lot of this is Mac OS X fault: it still does not have an easy canonical way of installing things and has no way for uninstalling. I don't get why in this day mac os can't have something like RPM or any number of other package managers.

saagarjha 7y ago
It very much does! Zoom even stumbled upon it, it's called Installer.app. Except, of course, they killed it before it even finished…

overgard 7y ago

I understand wanting to reduce friction, but this is the second time Zoom has kinda done something weird and suspect security wise in the name of removing really minor obstacles that users are probably used to dealing with anyway. Considering how many tech companies are using Zoom right now, I would hope they are cognizant that they don't become known as "the company that does sketchy stuff so our IT people say we can't use it"

AngeloAnolin 7y ago

I removed Zoom from my Mac following this instruction [0] Given their security issues as of late, is there further way I could ensure that my machine has completely removed this software? [0]

Razengan 7y ago

If I search my bookmarks for "zoom" every link is about a discovery of it doing some shady shit. At this point I would just classify it as spyware.

Kaze404 7y ago

Discord also does this On Windows at least) and I don't understand how / why it's allowed.

eyegor 7y ago

Can someone explain to me what the problem is? If you run the installer, isn't that consent to install the software? That's the whole point of it. I guess this isn't the "Mac way" but this is exactly how I would write an install script if I was slapping together support for other platforms. In fact this is the same way most installers work: it unzips an archive somewhere, then creates the links for remove/launch/etc. What is the typical install process for software on a Mac?

notriddle 7y ago
Zoom is using a hook in the macOS installer framework in a way that is not intended. This is forming a troubling pattern [1]. Zoom will do anything to reduce the number of clicks to start a conference, even if results in a misleading installer prompt or security vulnerability. [1]: https://www.zdnet.com/article/zoom-defends-use-of-local-web-server-on-macs-after-security-report/ https://www.zdnet.com/article/zoom-defends-use-of-local-web-...
- whateveracct 7y ago
  Many PMs are obsessed with click optimization. I've been told many times that a certain feature of security method is no-go due to it being "too many clicks" full-stop -.-

emilecantin 7y ago

I have this irrational disgust of .pkg installs, and this is is a good example why. Every time I have to install a .pkg, I wonder what crap it's spreading all around my system. What's wrong with dragging .apps? Does your app really need to spread its tentacles beyond an app bundle and (maybe) some preference files?

int_19h 7y ago

That Twitter thread has a link to a more detailed analysis that was done all the way back in 2016: https://macpkghallofshame.tumblr.com/post/138612887932/indistinguishable-from-malware https://macpkghallofshame.tumblr.com/post/138612887932/indis...

musicale 7y ago

Zoom's malware-like behavior is the reason I only use their web app, in a browser with minimal privileges.

scelerat 7y ago

I have a friend who has some intimate knowledge of MacOS installation software who refuses to use Zoom. "It's not merely because it uses the same install patterns as Russian malware," this person told me, "no; it's personal." Seriously, despite this person's aversion to anything Google, Hangouts ends up being the one tolerable exception.

fouc 7y ago

Are there other app installers that do this? I've got a feeling Zoom is definitely not the only one that does that.

clay_the_ripper 7y ago

To me this implies that the installation process on Mac OS should be improved. The fact that they have to resort to these types of things to make it “just work” for people suggests that the official way of doing things is less than ideal. They are aiming to make the process completely idiot proof, and good for them. If you’ve ever watched a nontechnical user try to install an application you’ll understand why they had to do all this. I recently watched One of my friends who has only ever used an iPad and not a laptop try to install an application downloaded from the internet. Things we take for granted like “find your downloads folder” were not obvious. I had to explain what the Finder is, and it seemed laughably not obvious to someone who has never used it before.

teknologist 7y ago

Instead of installing the Zoom software, join Zoom calls from within your web browser With this trick you can join Zoom calls without ever installing the client on your computer. Here's how to do it: 1) Uninstall the Zoom client if you have it installed (this is important). 2) When you get a Zoom link to join a meeting, click it to open it in your browser. 3) You'll be asked to download Zoom. Click the "download & run Zoom" link, but don't run the installer. 4) Wait for a few moments and a link to "join from your browser" will appear. Click this and join the call as normal. Most of the features work in this browser based version -- there is no need to ever risk your computer! Here's a gif demoing what to click: https://assets.zoom.us/images/en-us/web/client/join-web-client.gif https://assets.zoom.us/images/en-us/web/client/join-web-clie...

neycoda 7y ago

Why does Apple allow this?