5 ms·

It doesn't look legit, it looks like the installer script is faking a system dialog in this screenshot: https://twitter.com/c1truz_/status/1244737675191619584/

It doesn't look legit, it looks like the installer script is faking a system dialog in this screenshot: https://twitter.com/c1truz_/status/1244737675191619584/photo/3 https://twitter.com/c1truz_/status/1244737675191619584/photo... This message is a lie; it not coming from system but from the installer script. Just because the OS is used to show the dialog doesn't mean it should be trusted. As other commenter noted this could be used to steal passwords; that is effectively what it does.

rainforest 7y ago
To their credit, they seem to be using AuthorizationExecuteWithPrivileges which doesn't get the user's password, but executes a command as root, which is marginally better than stealing the password like Dropbox did.
- tantalor 7y ago
  How hard do you think it is to steal a password once you have root?
  - swiley 7y ago
    It would take an extra step, you have access to the hash and maybe shared memory/SOs but you’d need a second trick to actually steal it.
  - jedieaston 7y ago
    It should be impossible with SIP enabled, as in OS X 10.14 Apple protected the files in /var/db/dslocal where the user shadow files are stored so that root could not read them (unless triggered by an Apple signed executable, like Software Update). If you are running with SIP disabled you've taken the risk of it happening, and if you are on a corporate laptop (or 99% of personal machines) it is engaged. https://apple.stackexchange.com/questions/344117/mac-10-13-10-14-where-are-the-hash-passwords-located https://apple.stackexchange.com/questions/344117/mac-10-13-1...
    - tantalor 7y ago
      Think a little harder. With root, you can install a keylogger.
      - saagarjha 7y ago
        You'd still need to bypass TCC.
Wowfunhappy 7y ago
The script asks for root which subsequently pops up an OS password prompt. Zoom never sees your password. How is this different from the way e.g. Virtualbox gets root?
- lonelappde 7y ago
  Because it lies about its identity, calling itself "System" not Zoom. This is also a MacOS vuln that lets apps lie about their identity in sudo prompts, much like a browser showing an https site with no certificate checking.
  - Wowfunhappy 7y ago
    macOS allows apps to write arbitrary lines of text above password prompts, which is what Zoom is doing. I don't see how that's different from a shell script echo'ing something before a sudo prompt. How would you design this system?
    - jedieaston 7y ago
      Don't allow the application to do any of it, and when the app asks for access, have the system instead say "{processName}.app is requesting {permissionFlavorText}. Enter a name and password to continue."
- auiya 7y ago
  It's not making the proper privilege escalation call, it's faking the box entirely. There's even a typo in the dialog box.
  - Wowfunhappy 7y ago
    ...are you sure? I'm pretty sure that code just pops up the system box to get privileges, with a custom message at the top. I'm running Mavericks—the last version of macOS before they made the UI flat—and the prompt didn't look out of place. If Zoom is indeed faking the box, they actually went through the trouble to make a separate version for Mavericks with Mavericks-style visuals.

rainforest 7y ago

To their credit, they seem to be using AuthorizationExecuteWithPrivileges which doesn't get the user's password, but executes a command as root, which is marginally better than stealing the password like Dropbox did.

tantalor 7y ago
How hard do you think it is to steal a password once you have root?
- swiley 7y ago
  It would take an extra step, you have access to the hash and maybe shared memory/SOs but you’d need a second trick to actually steal it.
- jedieaston 7y ago
  It should be impossible with SIP enabled, as in OS X 10.14 Apple protected the files in /var/db/dslocal where the user shadow files are stored so that root could not read them (unless triggered by an Apple signed executable, like Software Update). If you are running with SIP disabled you've taken the risk of it happening, and if you are on a corporate laptop (or 99% of personal machines) it is engaged. https://apple.stackexchange.com/questions/344117/mac-10-13-10-14-where-are-the-hash-passwords-located https://apple.stackexchange.com/questions/344117/mac-10-13-1...
  - tantalor 7y ago
    Think a little harder. With root, you can install a keylogger.
    - saagarjha 7y ago
      You'd still need to bypass TCC.

Wowfunhappy 7y ago

The script asks for root which subsequently pops up an OS password prompt. Zoom never sees your password. How is this different from the way e.g. Virtualbox gets root?

lonelappde 7y ago
Because it lies about its identity, calling itself "System" not Zoom. This is also a MacOS vuln that lets apps lie about their identity in sudo prompts, much like a browser showing an https site with no certificate checking.
- Wowfunhappy 7y ago
  macOS allows apps to write arbitrary lines of text above password prompts, which is what Zoom is doing. I don't see how that's different from a shell script echo'ing something before a sudo prompt. How would you design this system?
  - jedieaston 7y ago
    Don't allow the application to do any of it, and when the app asks for access, have the system instead say "{processName}.app is requesting {permissionFlavorText}. Enter a name and password to continue."
auiya 7y ago
It's not making the proper privilege escalation call, it's faking the box entirely. There's even a typo in the dialog box.
- Wowfunhappy 7y ago
  ...are you sure? I'm pretty sure that code just pops up the system box to get privileges, with a custom message at the top. I'm running Mavericks—the last version of macOS before they made the UI flat—and the prompt didn't look out of place. If Zoom is indeed faking the box, they actually went through the trouble to make a separate version for Mavericks with Mavericks-style visuals.