7 ms·

There’s nothing in /proc/PID/cmdline etc that would definitely confirm an app has a GUI. The two concepts are at very different layers of the stack — to the OS

There’s nothing in /proc/PID/cmdline etc that would definitely confirm an app has a GUI. The two concepts are at very different layers of the stack — to the OS the GUI is just another app on top of the kernel. Mayyyyyybe Zoom could be doing some crude pattern matching on process name or environment variables of a given process (though it’d only be able to read data of processes running as the same user) but it’s a long shot. Personally I’d guess it is either some other library Zoom uses or some kind of debug info capturing system. But I don’t know work at Zoom so who knows.

woodruffw 5y ago
This is an unlikely stretch, but it looks like they're also attempting to read `/proc/PID/exe` -- they could be doing something (extremely) cursed like attempting to parse the program linkages and filtering by programs that link to `libX11`. But that's me straining to explain this in the context of the GP's hypothesis.
- thrower123 5y ago
  Never attribute to malice what is adequately explained by laziness. I can easily believe somebody just wrote a chunk of naive code that grabbed all the running processes, and it worked, and they moved on.
  - propogandist 5y ago
    or it’s spyware, maybe not as bad as a keylogger, but it can be mining your active usage behavior
    - reilly3000 5y ago
      This could be verified by inspecting their analytics requests. If I have time I may take a peek at those later.
      - propogandist 5y ago
        whoever does the analysis may also become a whistleblower.
        dylan604 5y ago
        Does "whistleblower" apply to people not working directly for the company being reported? I've always understood it to be employee reporting against the employer. I could totally be limiting it from what other people use it though.
        stjohnswarts 5y ago
        I think it's a generic definition for someone closely associated with the company to out them out something that they would like to keep secret because it would embarrass them or lead to legal redress.
      - reilly3000 5y ago
        I wasn't able to find much of interest from their desktop client, as all of the data is encrypted and I'm not sure how to grab an SSL key from a desktop app for use in Wireshark decryption. If somebody clever wants to help, please let me know. I did take at their privacy policy and didn't see anything that explicitly states they are collecting info about running applications. "and other" leaves room for interpretation... Regardless, my main concern after viewing this isn't that they are snooping my running processes and sending that back to home base. Its that they are openly keylogging and tracking everything under the sun, and can view every aspect of the meeting's content (audio, video, text, etc) and share it with 3rd parties like law enforcement and others. Source: https://zoom.us/privacy#_qhklx843v2zq https://zoom.us/privacy#_qhklx843v2zq > Device Information: Information about the computers, phones, and other devices people use when interacting with Zoom Products, which may include information about the speakers, microphone, camera, OS version, hard disk ID, PC name, MAC address, IP address (which may be used to infer general location at a city or country level), device attributes (like operating system version and battery level), WiFi information, and other device information (like Bluetooth signals). > Meeting, Webinar, and Messaging Content and Context: Content generated in meetings, webinars, or messages that are hosted on Zoom Products, which may include audio, video, in-meeting messages, chat messaging content, transcriptions, written feedback, responses to polls and Q&A, and files, as well as related context, such as invitation details, meeting or chat name, or meeting agenda. Content may contain your voice and image, depending on the account owner’s settings, what you choose to share, your settings, and what you do on Zoom Products. > Product and Website Usage: Information about how people and their devices interact with Zoom Products, such as: when participants join and leave a meeting; whether participants sent messages and who they message with; performance data; mouse movements, clicks, keystrokes or actions (such as mute/unmute or video on/off), and other user inputs that help Zoom to understand feature usage, improve product design, and suggest features; which third-party apps users add to a meeting or other Product and what information and actions the app is authorized to access and perform; features used (such as screen sharing, emojis, or filters); and other usage information and metrics. This also includes information about when and how people visit and interact with Zoom’s websites, including what pages they accessed, their interaction with the website features, and whether or not they signed up for a Zoom Product.
  - MereInterest 5y ago
    I can easily believe either. However, while the default assumption of laziness/incompetence works well for good faith discussions, it also provides cover for malicious actors. At some point, even though any given actor is likely to be non-malicious, there is no way to distinguish them from the malicious actors.
  - heavyset_go 5y ago
    Hanlon's razor is a great principle to apply to personal relationships, but it falls apart in these situations. You can explain away any deliberate malice or negligence using it, even when there are clear incentives to enage is such behavior, unless there's absolute evidence of malice. By then it's too late because you've already been swindled, and the principle ignores the lengths organizations will go to cover that evidence up.
    - TeMPOraL 5y ago
      If you're dealing with bigger threats, you need a more powerful weapon. Sheathe the Hanlon's razor, and unholster the Hanlon's handgun: "Never attribute to stupidity that which can be adequately explained by systemic incentives promoting malice." https://news.ycombinator.com/item?id=21691282 https://news.ycombinator.com/item?id=21691282
  - addicted 5y ago
    I’d argue that laziness is worse in security/privacy situations than malicious intent. At least malicious intent only exposes me to Zoom and whoever they answer to. Their laziness, however, which would probably also reflect itself in other security situations, exposes me to them as well as basically the entire world of black hat hackers.
- gmueckl 5y ago
  Nah, the readlink on exe looks like it's simply to query the real name of the executable, so that's pretty benign.
  - nonameiguess 5y ago
    I believe they mean grab the absolute path to the real executable, run ldd against it, and parse that output to see if it links against libX11. That doesn't tell you a program is really using X11, though, as plenty have some sort of no-gui option to launch without a window. You can always cat /proc/{PID}/maps to see if libx11 is actually loaded into the process' address space, and just use readlink on exe to figure out the application name. That's a really stupid way to figure out if a program has a window, though, compared to just using the X11 API directly.
    - gmueckl 5y ago
      Do you have evidence of old being executed or similar? The posted strace log section is fairly benign and shows no hints of what you insinuate.
      - woodruffw 5y ago
        You wouldn’t actually need to execute `ldd` to get this information: you could parse the ELF entirely in user space. That, in turn, wouldn’t show up in the `strace` logs, since there would be no syscalls. I think that’s extremely unlikely, but it’s certainly possible.
        IgorPartola 5y ago
        Reading the file would show up as syscalls.
        woodruffw 5y ago
        Sure, but you could minimize it to just two: the `open` that we already see here, and an `mmap` that maps the entire thing in. The rest could be in userspace (at least in terms of effects). We only have an excerpt of the syscall trace, so it's possible that happens. But again: extraordinarily unlikely.
- dathinab 5y ago
  Why would you implement such a overly complex and unreliable thing when: 1. The windows manager can provide you with a list of open windows. 2. Screensharing including only sharing specific windows is a feature provided by the windows manager over standardized protocols. 3. Even knowing the processes which do have a GUI doesn't allow you to share that GUI, at least not without going through roughly the same mechanisms as mentioned in 2nd.
  - woodruffw 5y ago
    Hence “unlikely stretch.”
    - inter_netuser 5y ago
      Let's just say the quiet part outloud: they sell that data.
      - cranekam 5y ago
        Haha. What possible market is there for knowing which other binaries Zoom (desktop) users run? OMG Zoom users also run Chrome, cat, and init! That'll be $10k please.
      - woodruffw 5y ago
        They probably don't. The list of programs running on a random Linux box probably isn't especially valuable.
        failuser 5y ago
        That machine can be in a Russian or Iranian nuclear physics or bioweapon lab and run very specific software. E.g. you can be looking for some project code names.
        woodruffw 5y ago
        Sure. But that's a very distinct task vs. the implication that Zoom is somehow making ad revenue off of Linux process names. The latter strikes me as not very likely because there's no money in it; the former is well outside of anything I feel qualified to opine on.

woodruffw 5y ago

This is an unlikely stretch, but it looks like they're also attempting to read `/proc/PID/exe` -- they could be doing something (extremely) cursed like attempting to parse the program linkages and filtering by programs that link to `libX11`. But that's me straining to explain this in the context of the GP's hypothesis.

thrower123 5y ago
Never attribute to malice what is adequately explained by laziness. I can easily believe somebody just wrote a chunk of naive code that grabbed all the running processes, and it worked, and they moved on.
- propogandist 5y ago
  or it’s spyware, maybe not as bad as a keylogger, but it can be mining your active usage behavior
  - reilly3000 5y ago
    This could be verified by inspecting their analytics requests. If I have time I may take a peek at those later.
    - propogandist 5y ago
      whoever does the analysis may also become a whistleblower.
      - dylan604 5y ago
        Does "whistleblower" apply to people not working directly for the company being reported? I've always understood it to be employee reporting against the employer. I could totally be limiting it from what other people use it though.
        stjohnswarts 5y ago
        I think it's a generic definition for someone closely associated with the company to out them out something that they would like to keep secret because it would embarrass them or lead to legal redress.
    - reilly3000 5y ago
      I wasn't able to find much of interest from their desktop client, as all of the data is encrypted and I'm not sure how to grab an SSL key from a desktop app for use in Wireshark decryption. If somebody clever wants to help, please let me know. I did take at their privacy policy and didn't see anything that explicitly states they are collecting info about running applications. "and other" leaves room for interpretation... Regardless, my main concern after viewing this isn't that they are snooping my running processes and sending that back to home base. Its that they are openly keylogging and tracking everything under the sun, and can view every aspect of the meeting's content (audio, video, text, etc) and share it with 3rd parties like law enforcement and others. Source: https://zoom.us/privacy#_qhklx843v2zq https://zoom.us/privacy#_qhklx843v2zq > Device Information: Information about the computers, phones, and other devices people use when interacting with Zoom Products, which may include information about the speakers, microphone, camera, OS version, hard disk ID, PC name, MAC address, IP address (which may be used to infer general location at a city or country level), device attributes (like operating system version and battery level), WiFi information, and other device information (like Bluetooth signals). > Meeting, Webinar, and Messaging Content and Context: Content generated in meetings, webinars, or messages that are hosted on Zoom Products, which may include audio, video, in-meeting messages, chat messaging content, transcriptions, written feedback, responses to polls and Q&A, and files, as well as related context, such as invitation details, meeting or chat name, or meeting agenda. Content may contain your voice and image, depending on the account owner’s settings, what you choose to share, your settings, and what you do on Zoom Products. > Product and Website Usage: Information about how people and their devices interact with Zoom Products, such as: when participants join and leave a meeting; whether participants sent messages and who they message with; performance data; mouse movements, clicks, keystrokes or actions (such as mute/unmute or video on/off), and other user inputs that help Zoom to understand feature usage, improve product design, and suggest features; which third-party apps users add to a meeting or other Product and what information and actions the app is authorized to access and perform; features used (such as screen sharing, emojis, or filters); and other usage information and metrics. This also includes information about when and how people visit and interact with Zoom’s websites, including what pages they accessed, their interaction with the website features, and whether or not they signed up for a Zoom Product.
- MereInterest 5y ago
  I can easily believe either. However, while the default assumption of laziness/incompetence works well for good faith discussions, it also provides cover for malicious actors. At some point, even though any given actor is likely to be non-malicious, there is no way to distinguish them from the malicious actors.
- heavyset_go 5y ago
  Hanlon's razor is a great principle to apply to personal relationships, but it falls apart in these situations. You can explain away any deliberate malice or negligence using it, even when there are clear incentives to enage is such behavior, unless there's absolute evidence of malice. By then it's too late because you've already been swindled, and the principle ignores the lengths organizations will go to cover that evidence up.
  - TeMPOraL 5y ago
    If you're dealing with bigger threats, you need a more powerful weapon. Sheathe the Hanlon's razor, and unholster the Hanlon's handgun: "Never attribute to stupidity that which can be adequately explained by systemic incentives promoting malice." https://news.ycombinator.com/item?id=21691282 https://news.ycombinator.com/item?id=21691282
- addicted 5y ago
  I’d argue that laziness is worse in security/privacy situations than malicious intent. At least malicious intent only exposes me to Zoom and whoever they answer to. Their laziness, however, which would probably also reflect itself in other security situations, exposes me to them as well as basically the entire world of black hat hackers.
gmueckl 5y ago
Nah, the readlink on exe looks like it's simply to query the real name of the executable, so that's pretty benign.
- nonameiguess 5y ago
  I believe they mean grab the absolute path to the real executable, run ldd against it, and parse that output to see if it links against libX11. That doesn't tell you a program is really using X11, though, as plenty have some sort of no-gui option to launch without a window. You can always cat /proc/{PID}/maps to see if libx11 is actually loaded into the process' address space, and just use readlink on exe to figure out the application name. That's a really stupid way to figure out if a program has a window, though, compared to just using the X11 API directly.
  - gmueckl 5y ago
    Do you have evidence of old being executed or similar? The posted strace log section is fairly benign and shows no hints of what you insinuate.
    - woodruffw 5y ago
      You wouldn’t actually need to execute `ldd` to get this information: you could parse the ELF entirely in user space. That, in turn, wouldn’t show up in the `strace` logs, since there would be no syscalls. I think that’s extremely unlikely, but it’s certainly possible.
      - IgorPartola 5y ago
        Reading the file would show up as syscalls.
        woodruffw 5y ago
        Sure, but you could minimize it to just two: the `open` that we already see here, and an `mmap` that maps the entire thing in. The rest could be in userspace (at least in terms of effects). We only have an excerpt of the syscall trace, so it's possible that happens. But again: extraordinarily unlikely.
dathinab 5y ago
Why would you implement such a overly complex and unreliable thing when: 1. The windows manager can provide you with a list of open windows. 2. Screensharing including only sharing specific windows is a feature provided by the windows manager over standardized protocols. 3. Even knowing the processes which do have a GUI doesn't allow you to share that GUI, at least not without going through roughly the same mechanisms as mentioned in 2nd.
- woodruffw 5y ago
  Hence “unlikely stretch.”
  - inter_netuser 5y ago
    Let's just say the quiet part outloud: they sell that data.
    - cranekam 5y ago
      Haha. What possible market is there for knowing which other binaries Zoom (desktop) users run? OMG Zoom users also run Chrome, cat, and init! That'll be $10k please.
    - woodruffw 5y ago
      They probably don't. The list of programs running on a random Linux box probably isn't especially valuable.
      - failuser 5y ago
        That machine can be in a Russian or Iranian nuclear physics or bioweapon lab and run very specific software. E.g. you can be looking for some project code names.
        woodruffw 5y ago
        Sure. But that's a very distinct task vs. the implication that Zoom is somehow making ad revenue off of Linux process names. The latter strikes me as not very likely because there's no money in it; the former is well outside of anything I feel qualified to opine on.