6 ms·

I think this also shows how macOS has been training users to enter their password in random dialogs that have absolutely nothing that identifies them as being l

I think this also shows how macOS has been training users to enter their password in random dialogs that have absolutely nothing that identifies them as being legit OS dialogs. The dialog that Zoom uses could very well be sending the credentials to a remote server, and the user would be none the wiser.

Wowfunhappy 7y ago
Note that in this case, it's still a legit OS dialog. Preflight scripts are very much built into the macOS pkg format, they're just not intended to be used like this.
- tantalor 7y ago
  It doesn't look legit, it looks like the installer script is faking a system dialog in this screenshot: https://twitter.com/c1truz_/status/1244737675191619584/photo/3 https://twitter.com/c1truz_/status/1244737675191619584/photo... This message is a lie; it not coming from system but from the installer script. Just because the OS is used to show the dialog doesn't mean it should be trusted. As other commenter noted this could be used to steal passwords; that is effectively what it does.
  - rainforest 7y ago
    To their credit, they seem to be using AuthorizationExecuteWithPrivileges which doesn't get the user's password, but executes a command as root, which is marginally better than stealing the password like Dropbox did.
    - tantalor 7y ago
      How hard do you think it is to steal a password once you have root?
      - swiley 7y ago
        It would take an extra step, you have access to the hash and maybe shared memory/SOs but you’d need a second trick to actually steal it.
      - jedieaston 7y ago
        It should be impossible with SIP enabled, as in OS X 10.14 Apple protected the files in /var/db/dslocal where the user shadow files are stored so that root could not read them (unless triggered by an Apple signed executable, like Software Update). If you are running with SIP disabled you've taken the risk of it happening, and if you are on a corporate laptop (or 99% of personal machines) it is engaged. https://apple.stackexchange.com/questions/344117/mac-10-13-10-14-where-are-the-hash-passwords-located https://apple.stackexchange.com/questions/344117/mac-10-13-1...
        tantalor 7y ago
        Think a little harder. With root, you can install a keylogger.
        saagarjha 7y ago
        You'd still need to bypass TCC.
  - Wowfunhappy 7y ago
    The script asks for root which subsequently pops up an OS password prompt. Zoom never sees your password. How is this different from the way e.g. Virtualbox gets root?
    - lonelappde 7y ago
      Because it lies about its identity, calling itself "System" not Zoom. This is also a MacOS vuln that lets apps lie about their identity in sudo prompts, much like a browser showing an https site with no certificate checking.
      - Wowfunhappy 7y ago
        macOS allows apps to write arbitrary lines of text above password prompts, which is what Zoom is doing. I don't see how that's different from a shell script echo'ing something before a sudo prompt. How would you design this system?
        jedieaston 7y ago
        Don't allow the application to do any of it, and when the app asks for access, have the system instead say "{processName}.app is requesting {permissionFlavorText}. Enter a name and password to continue."
    - auiya 7y ago
      It's not making the proper privilege escalation call, it's faking the box entirely. There's even a typo in the dialog box.
      - Wowfunhappy 7y ago
        ...are you sure? I'm pretty sure that code just pops up the system box to get privileges, with a custom message at the top. I'm running Mavericks—the last version of macOS before they made the UI flat—and the prompt didn't look out of place. If Zoom is indeed faking the box, they actually went through the trouble to make a separate version for Mavericks with Mavericks-style visuals.
- danieldk 7y ago
  I never understood why Apple still supports the pkg format. It seems a half-baked leftover from the 2000s and even then I was already surprised that there is no way to uninstall things through the macOS GUI. I am not sure if this has changed (I try to avoid pkg files and use Homebrew cask to uninstall such packages), but IIRC you had to list the files with pkgutil on the command-line, remove stuff by hand and then --forget the package. They should just kill the format. Everything should just be drag to install, drag to trash to remove.
  - javagram 7y ago
    In my experience I’ve seen even technical users (Who were used to windows) struggle with the idea of dragging an .app from an open disk image to the Applications folder. They would end up running the app from the disk image and then getting confused when it disappears after restart.
    - Wowfunhappy 7y ago
      This system worked so much better when the Applications folder was placed in the Dock by default, and everyone used that folder launch applications (which weren't common enough to keep in the Dock directly). It was actually a really beautiful synergy—you install applications by copying them to a folder, and launch them from that folder. Same way you'd acquire and open files. Lovely. Then Apple ruined it in Lion with Launchpad. Their app install flow for anything outside of the app store doesn't make any sense.
      - Smoosh 7y ago
        In even earlier days, applications didn't need to be installed at all. You just ran them from wherever they were. Of course, it made sense to store them somewhere together, and you could cause yourself problems if you put applications onto disks you then ejected. But the current system is clearly influenced by the UNIX underpinnings, and I'm not sure that the average user fully "gets it". though preferences files were a bit of a mess. I vaguely remember if early Macintosh System versions you would be prompted to insert the disk (with the correct disk name in the message) if you tried to open a file belonging to an application which was on an ejected disk.
- lonelappde 7y ago
  Incorrect. Look at the second tweet in the thread. It's a phishing popup that misidentifies itself in order to steal priveleges intended for System, not Zoom. https://mobile.twitter.com/c1truz_/status/1244737675191619584/photo/2 https://mobile.twitter.com/c1truz_/status/124473767519161958...
  - Wowfunhappy 7y ago
    That's still an OS prompt, they just put their own message at the top, as you're allowed to do.
    - joshuaissac 7y ago
      Yes, they are allowed to put a fake message (identifying the requester as System instead of Zoom), but that does not make it OK.
- thaumasiotes 7y ago
  > Note that in this case, it's still a legit OS dialog. No it isn't. The dialog prompt is "System need your privilege to change." That's not passing QA anywhere -- it's just a custom message someone put into Zoom without bothering to proofread.
Aachen 7y ago
One could say the same for gksudo, UAC prompts, or the equivalent dialog on your favorite operating system, no? Or is there something on other OSes that identifies it?
- sudosysgen 7y ago
  gksudo and UAC don't let the process lie about what it is.
- lultimouomo 7y ago
  I don't think UAC is spoofable - if I remember well it minimizes all the other windows and hides the taskbar, which you shouldn't be able to do with a regular dialog. gksudo is definitely spoofable, except I almost never get a gksudo dialog. I am not trained to expect every other app to periodically ask me for my password.
  - Aachen 7y ago
    Any application can draw over the task bar as far as I know? Seems weird if games needed root permissions just to be full screen.

Wowfunhappy 7y ago

Note that in this case, it's still a legit OS dialog. Preflight scripts are very much built into the macOS pkg format, they're just not intended to be used like this.

tantalor 7y ago
It doesn't look legit, it looks like the installer script is faking a system dialog in this screenshot: https://twitter.com/c1truz_/status/1244737675191619584/photo/3 https://twitter.com/c1truz_/status/1244737675191619584/photo... This message is a lie; it not coming from system but from the installer script. Just because the OS is used to show the dialog doesn't mean it should be trusted. As other commenter noted this could be used to steal passwords; that is effectively what it does.
- rainforest 7y ago
  To their credit, they seem to be using AuthorizationExecuteWithPrivileges which doesn't get the user's password, but executes a command as root, which is marginally better than stealing the password like Dropbox did.
  - tantalor 7y ago
    How hard do you think it is to steal a password once you have root?
    - swiley 7y ago
      It would take an extra step, you have access to the hash and maybe shared memory/SOs but you’d need a second trick to actually steal it.
    - jedieaston 7y ago
      It should be impossible with SIP enabled, as in OS X 10.14 Apple protected the files in /var/db/dslocal where the user shadow files are stored so that root could not read them (unless triggered by an Apple signed executable, like Software Update). If you are running with SIP disabled you've taken the risk of it happening, and if you are on a corporate laptop (or 99% of personal machines) it is engaged. https://apple.stackexchange.com/questions/344117/mac-10-13-10-14-where-are-the-hash-passwords-located https://apple.stackexchange.com/questions/344117/mac-10-13-1...
      - tantalor 7y ago
        Think a little harder. With root, you can install a keylogger.
        saagarjha 7y ago
        You'd still need to bypass TCC.
- Wowfunhappy 7y ago
  The script asks for root which subsequently pops up an OS password prompt. Zoom never sees your password. How is this different from the way e.g. Virtualbox gets root?
  - lonelappde 7y ago
    Because it lies about its identity, calling itself "System" not Zoom. This is also a MacOS vuln that lets apps lie about their identity in sudo prompts, much like a browser showing an https site with no certificate checking.
    - Wowfunhappy 7y ago
      macOS allows apps to write arbitrary lines of text above password prompts, which is what Zoom is doing. I don't see how that's different from a shell script echo'ing something before a sudo prompt. How would you design this system?
      - jedieaston 7y ago
        Don't allow the application to do any of it, and when the app asks for access, have the system instead say "{processName}.app is requesting {permissionFlavorText}. Enter a name and password to continue."
  - auiya 7y ago
    It's not making the proper privilege escalation call, it's faking the box entirely. There's even a typo in the dialog box.
    - Wowfunhappy 7y ago
      ...are you sure? I'm pretty sure that code just pops up the system box to get privileges, with a custom message at the top. I'm running Mavericks—the last version of macOS before they made the UI flat—and the prompt didn't look out of place. If Zoom is indeed faking the box, they actually went through the trouble to make a separate version for Mavericks with Mavericks-style visuals.
danieldk 7y ago
I never understood why Apple still supports the pkg format. It seems a half-baked leftover from the 2000s and even then I was already surprised that there is no way to uninstall things through the macOS GUI. I am not sure if this has changed (I try to avoid pkg files and use Homebrew cask to uninstall such packages), but IIRC you had to list the files with pkgutil on the command-line, remove stuff by hand and then --forget the package. They should just kill the format. Everything should just be drag to install, drag to trash to remove.
- javagram 7y ago
  In my experience I’ve seen even technical users (Who were used to windows) struggle with the idea of dragging an .app from an open disk image to the Applications folder. They would end up running the app from the disk image and then getting confused when it disappears after restart.
  - Wowfunhappy 7y ago
    This system worked so much better when the Applications folder was placed in the Dock by default, and everyone used that folder launch applications (which weren't common enough to keep in the Dock directly). It was actually a really beautiful synergy—you install applications by copying them to a folder, and launch them from that folder. Same way you'd acquire and open files. Lovely. Then Apple ruined it in Lion with Launchpad. Their app install flow for anything outside of the app store doesn't make any sense.
    - Smoosh 7y ago
      In even earlier days, applications didn't need to be installed at all. You just ran them from wherever they were. Of course, it made sense to store them somewhere together, and you could cause yourself problems if you put applications onto disks you then ejected. But the current system is clearly influenced by the UNIX underpinnings, and I'm not sure that the average user fully "gets it". though preferences files were a bit of a mess. I vaguely remember if early Macintosh System versions you would be prompted to insert the disk (with the correct disk name in the message) if you tried to open a file belonging to an application which was on an ejected disk.
lonelappde 7y ago
Incorrect. Look at the second tweet in the thread. It's a phishing popup that misidentifies itself in order to steal priveleges intended for System, not Zoom. https://mobile.twitter.com/c1truz_/status/1244737675191619584/photo/2 https://mobile.twitter.com/c1truz_/status/124473767519161958...
- Wowfunhappy 7y ago
  That's still an OS prompt, they just put their own message at the top, as you're allowed to do.
  - joshuaissac 7y ago
    Yes, they are allowed to put a fake message (identifying the requester as System instead of Zoom), but that does not make it OK.
thaumasiotes 7y ago
> Note that in this case, it's still a legit OS dialog. No it isn't. The dialog prompt is "System need your privilege to change." That's not passing QA anywhere -- it's just a custom message someone put into Zoom without bothering to proofread.

Aachen 7y ago

One could say the same for gksudo, UAC prompts, or the equivalent dialog on your favorite operating system, no? Or is there something on other OSes that identifies it?

sudosysgen 7y ago
gksudo and UAC don't let the process lie about what it is.
lultimouomo 7y ago
I don't think UAC is spoofable - if I remember well it minimizes all the other windows and hides the taskbar, which you shouldn't be able to do with a regular dialog. gksudo is definitely spoofable, except I almost never get a gksudo dialog. I am not trained to expect every other app to periodically ask me for my password.
- Aachen 7y ago
  Any application can draw over the task bar as far as I know? Seems weird if games needed root permissions just to be full screen.