4 ms·

1) If Zoom can do this then it's a MacOS security bug. 2) UX matters. Users don't care about the technical details, they want a smooth experience and that can

1) If Zoom can do this then it's a MacOS security bug. 2) UX matters. Users don't care about the technical details, they want a smooth experience and that can be the difference between a billion-dollar business or a failed startup. And yes the desktop version is more stable than the web-based UI. 3) Malware is defined by what it does, not how it's installed.

keymone 7y ago
is botnet agent not malware? it's not doing anything until the operator sends the payload.
- manigandham 7y ago
  A botnet agent is designed to take control and run a bot, so yes it's malware. It doesn't have to be actively doing it at that moment to be considered such.
  - munk-a 7y ago
    Zoom does report usage to Facebook whether you have an account or not - and that data is used to stitch together a web profile of the user that is of no benefit to the user. Zoom is bordering on malware, just... malware that comes with a useful app that allows video conferencing.
    - vijaybritto 7y ago
      They removed that Facebook sdk after complaints.
Gaelan 7y ago
I mean, it's not really a security bug. Installer.app displays a dialog box that says "Hey, this package wants to run arbitrary code to check if it's compatible with your system. Is that OK?" The user is explicitly opting into the code execution. Zoom's "compatibility check" installs the app and kills the installer window. That's certainly unexpected behavior, but I don't think it's an exploit in any real sense. While normally I'd object to running arbitrary code with just an easily-skippable dialog as confirmation, but I think it's OK in this case where the expectation was that we're installing their software anyway.
- manigandham 7y ago
  You're right, it's more of a design issue. More explicit permissions on altering the Applications folder could help. Then again, most people want an easier install so this is really for those who want that extra control.
- etaioinshrdlu 7y ago
  It's really Apple's fault. "This package will run a program to determine if the software can be installed." Is just fundamentally a very strange statement to make, loaded with vagueness. Think about your average user... they are running an installer program... which alerts them that they need to run another program... to determine if they can install the program.... (Which the user thought they were already doing) The loaded expectation of the user to realize they are granting privileges to a program to determine whether they can install a program is just totally unreasonable. It just sounds more and more ridiculous written out like this.
  - Smoosh 7y ago
    On top of this, a standard install asks for permissions, but doesn't disclose who/what is asking for it (certified in some way) or what permissions it wants, if these are temporary for the install or permanent for the application, or what it is going to do during the install (what goes where, what gets changed etc). It is long past time for Apple to improve this process.
- opportune 7y ago
  As a user, I would not assume that checking compatibility means I'm executing arbitrary code. I mean it could just be macOS examining the binary to make sure it's compatible with my ISA, or checking some app metadata about recommended free resources like ram/disk space.
  - pvg 7y ago
    Apple agrees with you which is why the installer shows a warning the check will involve running code and lets you opt in or out.
thaumasiotes 7y ago
> 3) Malware is defined by what it does, not how it's installed. Well, from the tweet thread: > If the App is already installed but the current user is not admin, they use a helper tool called "zoomAutenticationTool" [sic] and the AuthorizationExecuteWithPrivileges API to spawn a password prompt identifying as "System" (!!) to gain root (including a typo).
- manigandham 7y ago
  It's not malicious, and you have to give it permissions somehow to finish the install. Dropbox (used to?) patch system files to integrate with Office better, and that wasn't considered malware either.
  - thaumasiotes 7y ago
    > It's not malicious By the time you're lying to the user, you are malicious.
  - 9935c101ab17a66 7y ago
    Malicious behaviour does not inherently make something malware. That said, The work arounds Dropbox used in the past should also be considered shady or malicious, and do not serve as a convincing defense in any way. Yes, zoom does need the user’s password to complete the install in the scenario described. So why isn’t there a proper installer that behaves like installers on macOS should. Why do they ask for the users password on the behalf of ‘system’? Oh, and zoom was just busted for sending user data to Facebook (regardless of whether or not you had a Facebook account and without disclosure AFAIK) so I reverse my previous statement. It is malware.
- Craighead 7y ago
  Why are you doing damage control?

keymone 7y ago

is botnet agent not malware? it's not doing anything until the operator sends the payload.

manigandham 7y ago
A botnet agent is designed to take control and run a bot, so yes it's malware. It doesn't have to be actively doing it at that moment to be considered such.
- munk-a 7y ago
  Zoom does report usage to Facebook whether you have an account or not - and that data is used to stitch together a web profile of the user that is of no benefit to the user. Zoom is bordering on malware, just... malware that comes with a useful app that allows video conferencing.
  - vijaybritto 7y ago
    They removed that Facebook sdk after complaints.

Gaelan 7y ago

I mean, it's not really a security bug. Installer.app displays a dialog box that says "Hey, this package wants to run arbitrary code to check if it's compatible with your system. Is that OK?" The user is explicitly opting into the code execution. Zoom's "compatibility check" installs the app and kills the installer window. That's certainly unexpected behavior, but I don't think it's an exploit in any real sense. While normally I'd object to running arbitrary code with just an easily-skippable dialog as confirmation, but I think it's OK in this case where the expectation was that we're installing their software anyway.

manigandham 7y ago
You're right, it's more of a design issue. More explicit permissions on altering the Applications folder could help. Then again, most people want an easier install so this is really for those who want that extra control.
etaioinshrdlu 7y ago
It's really Apple's fault. "This package will run a program to determine if the software can be installed." Is just fundamentally a very strange statement to make, loaded with vagueness. Think about your average user... they are running an installer program... which alerts them that they need to run another program... to determine if they can install the program.... (Which the user thought they were already doing) The loaded expectation of the user to realize they are granting privileges to a program to determine whether they can install a program is just totally unreasonable. It just sounds more and more ridiculous written out like this.
- Smoosh 7y ago
  On top of this, a standard install asks for permissions, but doesn't disclose who/what is asking for it (certified in some way) or what permissions it wants, if these are temporary for the install or permanent for the application, or what it is going to do during the install (what goes where, what gets changed etc). It is long past time for Apple to improve this process.
opportune 7y ago
As a user, I would not assume that checking compatibility means I'm executing arbitrary code. I mean it could just be macOS examining the binary to make sure it's compatible with my ISA, or checking some app metadata about recommended free resources like ram/disk space.
- pvg 7y ago
  Apple agrees with you which is why the installer shows a warning the check will involve running code and lets you opt in or out.

thaumasiotes 7y ago

> 3) Malware is defined by what it does, not how it's installed. Well, from the tweet thread: > If the App is already installed but the current user is not admin, they use a helper tool called "zoomAutenticationTool" [sic] and the AuthorizationExecuteWithPrivileges API to spawn a password prompt identifying as "System" (!!) to gain root (including a typo).

manigandham 7y ago
It's not malicious, and you have to give it permissions somehow to finish the install. Dropbox (used to?) patch system files to integrate with Office better, and that wasn't considered malware either.
- thaumasiotes 7y ago
  > It's not malicious By the time you're lying to the user, you are malicious.
- 9935c101ab17a66 7y ago
  Malicious behaviour does not inherently make something malware. That said, The work arounds Dropbox used in the past should also be considered shady or malicious, and do not serve as a convincing defense in any way. Yes, zoom does need the user’s password to complete the install in the scenario described. So why isn’t there a proper installer that behaves like installers on macOS should. Why do they ask for the users password on the behalf of ‘system’? Oh, and zoom was just busted for sending user data to Facebook (regardless of whether or not you had a Facebook account and without disclosure AFAIK) so I reverse my previous statement. It is malware.
Craighead 7y ago
Why are you doing damage control?