4 ms·
Because it lies about its identity, calling itself "System" not Zoom. This is also a MacOS vuln that lets apps lie about their identity in sudo prompts, much l
by lonelappde 7y ago
Because it lies about its identity, calling itself "System" not Zoom.
This is also a MacOS vuln that lets apps lie about their identity in sudo prompts, much like a browser showing an https site with no certificate checking.
- Wowfunhappy 7y agomacOS allows apps to write arbitrary lines of text above password prompts, which is what Zoom is doing. I don't see how that's different from a shell script echo'ing something before a sudo prompt. How would you design this system?
- jedieaston 7y agoDon't allow the application to do any of it, and when the app asks for access, have the system instead say "{processName}.app is requesting {permissionFlavorText}. Enter a name and password to continue."