25 ms·
The Zoom installer let a researcher hack his way to root access on macOS
- vbezhenar 4y agoWhy people install Zoom? You can use it from browser. I had to use it few times and it worked good enough.
- nicce 4y agoZoom tries its best to make people install it. You have to click quite many times before it allows browser session. The information is also quite hidden.
- vbezhenar 4y agoNot really. You have to click "join" and then additional hyperlink appears which you have to click once again. Yes, not super-obvious, but you don't need to click many times. I agree that this feature is not well presented, but hopefully word of mouth would help here.
- deleted 4y ago[deleted]
- fortran77 4y agoFWIW: This wasn't an issue on Windows Zoom. The Apollo-era Unix permissions systems that MacOS uses was the issue. More modern OS, like Windows 10 and 11, don't have this vulnerability.
- teakettle42 4y agomacOS has supported NFSv4 ACLs since 10.4 (released in 2005), and Zoom could have made use of them.
- latchkey 4y ago"When Zoom issued an update, the updater function would install the new package after checking that it had been cryptographically signed by Zoom. But a bug in how the checking method was implemented meant that giving the updater any file with the same name as Zoom’s signing certificate would be enough to pass the test — so an attacker could substitute any kind of malware program and have it be run by the updater with elevated privilege." This is beyond absurd.
- neodypsis 4y agoYes, and coupled with them taking months to address the issue makes me wonder if it is just carelessness or else.
- daniel-cussen 4y agoThere's companies that are just bad at some parts of the business. Myspace was like that, really slow programmers, reportedly. Like implementing things the executives knew they could do and weren't that hard, took them ages. In his essays, Paul Graham talks about this. If you are a company with no software brains at the top, the only way of getting ahold of competent programmers is luck. And business founders generally ruin their own luck.
- Lio 4y agoGiven Zoom’s history of “mistakenly” doing things, I don’t think your concern is completely unfounded. The FBI have previously issued warnings[1] about Zoom “accidentally” routing calls through China and for “accidentally” allowing CCP officials to monitor and end calls made outside of China they don’t like[2]. This is just the latest “accident” we’ve found out about. You’d be a fool to think there won’t be more. 1. https://www.fbi.gov/contact-us/field-offices/boston/news/press-releases/fbi-warns-of-teleconferencing-and-online-classroom-hijacking-during-covid-19-pandemic https://www.fbi.gov/contact-us/field-offices/boston/news/pre... 2. https://www.washingtonpost.com/technology/2020/12/18/zoom-helped-china-surveillance/ https://www.washingtonpost.com/technology/2020/12/18/zoom-he...
- webreac 4y ago
- anyfoo 4y agoNote that if SIP is enabled (the default), "root access" does not mean full compromise. On macOS, root is far from being as privileged as it was in the old days of UNIX yore. (Even on Linux it does not have to be, but my impression is that on most distributions it probably still is.) Just because you're root does not mean you get any entitlement you want, or arbitrary access to the whole filesystem, arbitrary memory access (a la /dev/(k)mem), or can replace the kernel just like that. (That's also probably why you don't hear of iPhones being "rooted", but rather "jailbroken". Just being root on an iPhone wouldn't do that much.) Make no mistake, this is still a privilege escalation attack and needs to be fixed.
- jbverschoor 4y agoI don’t need root access.. just your .ssh dir
- ssizn 4y agoGood luck bypassing my CGNAT ;)
- jbverschoor 4y agoWell.. with ipv6, there’s no need to nat anymore
- aidos 4y agoThough you should keep your private keys protected by a pass phrase. Top tip for people that use 1Password: I’ve discovered recently that you can run it as an ssh agent. That way your keys never leave the 1password app.
- NavinF 4y agoEither you're forced to type in your password 100 times a day (so the rootkit has to wait until you type it in) or you use ssh-agent and your decrypted key is in memory for all to see.
- galacticaactual 4y agoPatrick Wardle seems to be getting a lot of press these days…
- galad87 4y agoWhy does Zoom even need an installer for.
- ev1 4y agoTo harass you into downloading by hiding the "open in browser" link when you click a zoom url.
- darkteflon 4y agoPSA that you absolutely can attend Zoom calls from your Mac without installing this trashware. Firefox or Chrome is your friend.
- daniel-cussen 4y agoThis is what I did but it doesn't work all the way, break rooms don't work, broadcasts (Zoom theater) doesn't work, it's shitty. Like even in a VM it's shitty. Zoom no like VMs, Zoom yes like you installing it as root.
- neodypsis 4y agoCan it tell it is being run inside a VM?
- More-nitors 4y agohm that's what some banking apps / most malware apps do...
- daniel-cussen 4y agoNo it can't tell--I'm sure they'd like to, the attitude is omniscience, infinite data for infinite perving looking for patterns. Like most patterns just aren't virtuous, like oh I can fuck them out of a few extra bucks if I bug them at 5 in the morning after a bad experience at small claims court. That's business intelligence. That's a pattern. Or another pattern, we get more signups after sending users "informative" messages terms of service have changed--it's actually a form of marketing, anything to nag and bug people with some minuscule link to the business and money that it craves for its tumescent growth aspirations. Otherwise it would be technological, like come up with actual useful knowledge that would actually be useful. Economists say in the long run all wealth and all progress comes down to technology. Technology is the only thing that matters. But yeah it can tell it's in a VM because that's when it decides to crap its pants. By this point it's impossible to tell if bugs are intentional when they benefit the startup, there's a whole game in bugs, like no don't fix it it causes the user to lose his shit and give up and pay for this upgrade in the hopes that it all gets better. There was one bug, yeah a bank bug I saw in Chile. So what this bug did is it fucked up printing the receipts after the user had paid and the bank machine said the transaction was approved. Employees would then insist the user hadn't paid because a receipt hadn't gone through. So the customer had to pay again--and the second time it always worked--double billing. Fucking stealing. Theft. MacDonald's at the SCL airport brazenly stole from me in exactly that way. And did that bug get fixed promptly? Ha...na let it be a little longer, it's not a high priority. It's...not urgent. Fix it next quarter, it's too difficult. You can't assume good faith in software as it's delivered.
- frxx 4y agoStuff like this makes me downright angry. Because people not into IT think Zoom is now equivalent to online meetings and many events are held with Zoom too. Job interviews, etc. Most people don't have any idea that their software is so bad and they are a scummy company best avoided. I'm trying to let the people around me know, but mostly they don't care.
- imron 4y ago> but mostly they don't care Because the UX of other offerings is so poor and zoom for most part just works. I say this as someone who is aware of the security issues, but still prefer zoom over anything else.
- Schroedingersat 4y agojitsi just worked every time i've used it
- lokedhs 4y agoQuite honestly I would be love to hear an argument as to why anyone would use zoom over jitsi. I'm not trying to be controversial, and I readily admits I've only used zoom maybe twice, but I saw nothing that was better than jitsi. I also had performance issues on zoom, but I'm willing to ignore that since most other people don't seem to mention those issue so that's probably on me.
- Schroedingersat 4y agoMain downsides I knw of are a slightly worse codec, and in webrtc mode bandwidth needs to scale with participants so for large meetings you need to pay for hosting somehow. Neither are reasons not to use it as a default first option. Also matrix has voice and video now and there's big blue button.
- lokedhs 4y ago
- krono 4y agoNothing good has ever come from apps that required admin privileges to install for no obvious reason. They either abuse the rights, or end up with massive security holes that are completely neglected for months or longer.
- sofixa 4y agoZoom needs a ton of probably admin rights required access for it's features - raw access to mic and camera, screen sharing, remote control, etc.
- thejosh 4y agoIf the app needs to access a feature, ask for it via the native app, isn't that what phones do? (I think?) Chrome has to go through the hoops on Mac every time it updates to re-allow it in Privacy Settings for Google Hangouts to work. It's such a pain.
- krono 4y agoNope, that's what the protected resources API is for. https://developer.apple.com/documentation/bundleresources/information_property_list/protected_resources https://developer.apple.com/documentation/bundleresources/in...
- SulphurCrested 4y ago"But because of a subtlety of Unix systems (of which macOS is one), when an existing file is moved from another location to the root directory, it retains the same read-write permissions it previously had." And ownership. (The sentence before that suggests "root directory" here means "directory owned by root".) The permissions on the directory apply only to the file's directory entry, not the file itself. This isn't a "subtlety", it's how it works, and no-one who doesn't understand this should be writing macOS installers. The correct approach is to open the file for read and copy its bytes into your private area. Only then check the cryptographic signature. Just renaming into your private directory isn't enough, even if that directory has no read or execute access to other users, because the attacker could have opened the file for write access before you did the rename.
- pleb_nz 4y agoI might be misunderstanding what you are saying, but it sounds like a lot of reliance on people knowing and wanting to do the right thing?
- jacquesm 4y agoMost of unix is like that though.
- hungryforcodes 4y agoThis cannot be said enough.
- zbird 4y agoI'm not sure what you're suggesting. Would you go to a doctor who doesn't know or want to do the right thing?
- stevehawk 4y agoNo, we go to facebook sir.
- 4y ago
- baxtr 4y agoI have to admit: I hate the zoom experience. I use Chrome to avoid installing the app on my Mac. They use some dark patterns to force the app on you, but you can use zoom in the browser. However, you can’t use any backgrounds unlike google meet, which again is a way to force you into their app. These patterns alone show what kind of company you're dealing with.
- coconut_man 4y agoIf I switch to other tab while using the Zoom web version in one tab, all the video of everyone in the call disappear when go back to the Zoom tab, it's really annoying and a dump way to nudge people to switch to the app.
- wodenokoto 4y agoIn zooms defense, backgrounds in meet is a great way to stress test your laptop fans max capacity.
- baxtr 4y agoFair point. Then again, I think users are mature enough to make this trade-off decision by themselves.
- origin_path 4y agoBut you installed Chrome even though it does the exact same thing (runs an auto update Daemon with admin privileges, at least in Windows). Meet works well in Chrome because Google just adds whatever their apps need to html5. Other companies don't have that option. Seems kinda unfair to insist that everyone uses Google's app runtime otherwise they're guilty of "dark patterns".
- christophilus 4y agoI trust Chrome, Brave, and Firefox more than Zoom, by a lightyear or so.
- baxtr 4y ago
- userbinator 4y agoThe result is a privilege escalation attack, which assumes an attacker has already gained initial access to the target system Contrary opinion: I'd rather have a world in which everyone is always root on their machine and trusts all their software --- regardless of how mistaken that trust can be --- than the current trend of using "privilege separation" to take away freedom and control, create walled gardens, and silo applications from interoperating with each other. I have had little care for privilege escalation "attacks" ever since I realised that in practice they are so common, and also quite harmless (or sometimes even freedom-enabling), that it's often a way to feed the security-paranoia news machine and further drive users into the increasingly restrictive regimes of non-general-purpose computing. That said, I didn't install Zoom, but rather use a standard SIP client to join. As others have mentioned, using a browser is also possible when SIP is not an option.
- kortex 4y agoWe had that, it was called Windows 95 and you got viruses by merely connecting the computer to the net.
- klabb3 4y agoThe worst part is abusers of macOS install/update options are going to be used by Apple to further lock down app and update distribution outside of the app store. There are already changes coming in Ventura regarding "self-modifying code" which affects custom updaters. These types of security changes are eventually necessary, the problem is that Apple takes every opportunity they can to break apps outside of the app store pipeline, even though the security mechanism itself doesn't depend on any app store.
- neodypsis 4y agoZoom is already distributed for iOS in the App Store. Why not give users the option of installing the macOS app thru the App Store as well? I trust Apple more than Zoom and would prefer installing the latter's app from the App Store knowing it will comply better with best practices.
- pxc 4y ago> There are already changes coming in Ventura regarding "self-modifying code" which affects custom updaters. Per-app self-updaters are such a disgrace, it really makes me wish I could cheer this on. It's a shame that their elimination, for Mac users, might mean that the app store becomes the only or primary mechanism for automatic app updates on macOS.
- galad87 4y agoThe change doesn't affect self-updaters, only a app trying to update a different app from a different developer (which can still be done, but with some additional checks I don't remember).
- userbinator 4y agoSuch changes are not necessary. They only use security as an excuse to take away freedom and control, because it suits their motives.
- deleted 4y ago[deleted]
- pxc 4y agoThis kind of stuff is why macOS 'needs' System Integrity Protection. Unlike on Linux or the free Unices, users of macOS are expected to frequently and repeatedly give a large assortment of proprietary crap root access in the form of installer scripts in their .pkg files. The management of proprietary software is a frickin' minefield. The idea that publishers should be trusted to manage their own installations like this is madness.
- microtonal 4y agoShrug. At least Mac App Store apps are sandboxed. On Linux, you are only one vulnerability away from full user account compromise. (Zoom should just be an App Store app, not a crappy installer.)
- nicce 4y agoOn the contrary, advanced user can very easily sandbox all the apps in Linux. But anything custom is hard on MacOS.
- microtonal 4y agoSure, you can use something like bubblewrap, but it doesn’t make applications easy to sandbox. E.g. how do you sandbox an application and still make it possible to use Open/Save dialogs. You need to use something like portals like Flatlak does. But the Flatpak sandboxing model is clearly inspired by macOS and hated by a significant portion of the Linux community.
- pxc 4y agoLinux definitely lags behind macOS and mobile operating systems with the maturity and integration of sandboxing options for GUI apps. Hopefully Flatpak (or XDG Portals with just a policy system or something) can fill that gap for most apps in the future. And Linux users can typically expose themselves to the same shit as Mac users with Zoom here: when they grab proprietary DEBs for Discord or Google Chrome or whatever, those can run scripts that mess with the whole filesystem or call out to the internet at install time. It's only by convention that those behaviors are forbidden in the normal repos on most distros. I don't love that the only repository-like option that's part of the normal system is the App Store, or that it doesn't come with an official CLI. I can see how some small proprietary software authors trying to make a living might resent being funneled toward a platform where Apple takes their cut, and I empathize. But for end users, I still think centralizing app updates into one system and taking the implementation details out of the hands of app developers/publishers is the only thing that makes sense, even if that always means going with the App Store.
- toddmorey 4y agoThis from the company that previously dropped a hidden, persistent webserver on every mac allowing Zoom to even reinstall itself if deleted.
- codedokode 4y agoResearchers try to find complicated and unrealistic scenarios to exploit vulnerabilities, but do not notice an elephant in the room. Auto-update is an equivalent of a backdoor. It allows the company to upload and run any code at any user's computer unnoticed. I won't be surprised if soon governments will demand that every application having more than N users must support auto-update.
- grishka 4y agoI like to call auto-update functionality what it really is: a deliberate RCE vulnerability.
- dtx1 4y agoThat's an unfair argument to make though. I think in practical terms an auto update on a browser like chrome prevents an enormous amount of security breeches from truly malicious, criminal actors using public CVEs for their average users. And as much as i dislike google and their privacy invasions, chrome is likely one of the most secure browsers out there and a lot of people rightfully rely on chrome's security for very important things like their online banking. I'd rather have my mom use auto-updating chrome than having to remind and reteach her how to update chrome manually once a week.
- alliao 4y agodoes chrome update work the same way? i've felt uneasy enough that have jumped to firefox some time ago..
- origin_path 4y agoIt works in exactly the same way.
- ardel95 4y agoIt's way past time we accepted that all current operating systems are single user environments. Any access to the system means full access to the system.
- thehappypm 4y agoYeah. The browser is the only safe haven. And even the browser has its issues..
- lokedhs 4y agoThis is precisely the realisation that is the basis of Qubes OS. The entire system is basically an admission that you cannot hope to preserve security on a system where you have users running stuff. Just allow them to do anything, but isolate the environments such that it doesn't matter if one is compromised, because there is nothing to compromise other than the application itself. Strongly recommended if you're willing to live without GPU support.
- throwawaypcking 4y agoLinux isn't this way. I can understand Windows and perhaps Mac users have this predicament.
- ardel95 4y agoMay I introduce you to a long list of Linux breakout and privilege escalation CVEs.
- amelius 4y agoI think that on MacOS there must be two layers of root. One for owners, and a lower one for Apple. What is the correct terminology for these two layers? When people say "I have rooted the device" they typically mean the lower layer, whereas when somebody becomes root by typing "sudo su", they refer to the higher layer. Which is confusing.
- jyrkesh 4y agoSounds like Administrator vs. LOCALSYSTEM on Windows. Oh, and TRUSTEDINSTALLER. I know Windows has its issues, security and otherwise, but they actually did have some insightful prescience on this class of problems.
- pram 4y agoIt's called SIP, or rootless, but it can be turned off by the user unlike iOS. So you don't need to 'root' a Mac. An admin user in MacOS is always in sudoers though.
- deleted 4y ago[deleted]
- lizardactivist 4y agoWith all the past peculiar security issues in macOS, that happen to pop up somewhere else in the months after it's "fixed", I think Apple are just as sketchy and unreliable as Zoom. Zoom and Mac are perfect for eachother.
- deleted 4y ago[deleted]
- zadwang 4y agoThe discussion is mostly about features of teleconference software which is completely off topic. The point of the article is security. I am not sure if Zoom INTENTIONALLY left the bug for future exploits. I have suspicion and no proof. But in any case, not fixing a bug after 8 months is simply unacceptable.
- vladvasiliu 4y ago> I am not sure if Zoom INTENTIONALLY left the bug for future exploits. What would they stand to gain from this? They already have root on the machine, so they could just send an "update" to that code to do whatever they need.
- Linda703 4y ago[dead]
- muh_gradle 4y agoDoesn't surprise me the slightest Zoom has some of the most archaic security practices I have seen in 2022. It really practices security like it's 10-15 years behind a modern company. Almost all top-down initiatives to improve security have meant useless red tape practices such as hiding information from its own internal developers. source: I work at Zoom.
- thfuran 4y ago>Almost all top-down initiatives to improve security have meant useless red tape practices such as hiding information from its own internal developers. That doesn't sound like outdated security practices, it sounds like unconscionable bullshit.
- buildbot 4y agoIt sounds like a way to insert code a majority of the developers would tell others about, like actual spyware.
- WesolyKubeczek 4y agoThe Zoom's insistence on using .pkgs when you can perfectly well just drag an .app from a disk image doesn't exactly inspire confidence. And yet we keep wearing those handcuffs, maybe out of laziness or a habit.
- scarface74 4y agoAs a consultant, I have to use whatever video conferencing software that the customer uses. I refuse to install any of them on my work Mac and I use the web versions. The only video conferencing software I have installed is Chime [1]. [1] yeah I know. How do you say where you work without saying where you work.
- deleted 4y ago[deleted]
- sascha_sl 4y agoThere really wasn't any other reason but marketing for buying out the Keybase team, was there?
- ajross 4y agoSo... why exactly does Zoom even have root on the mac? Google and Microsoft make all this stuff work in a browser...
- api 4y agoWhy does Zoom need a f'ing installer? There's nothing it does that couldn't be in a sandboxed App Store app, and they certainly have the resources to easily publish one. If they need a bit more a regular drag and drop app would suffice.
- wonderbore 4y agoGotta thank Zoom for supplying a new excuse to not install Zoom on my Mac. I’ve been using it from iOS every time I had to and then deleting it afterwards. If anyone asks me when I’m on my phone, I tell them I don’t trust Zoom.
- gigatexal 4y agoAfter the first thing with the zoom installer and their shenanigans on MacOS a while back I refused to install the app on my devices (except for mobile where I have no choice to use the app if I have to use zoom for something) and always use it via the browsers.
- chris_wot 4y agoThe update says that Zoom said it was “newly reported”. The article says it was reported eight months ago!
- makeworld 4y agoAnother day I'm happy to run Zoom through Flatpak.
- jupp0r 4y agoWhy the hell does Zoom require root access to begin with? I used to work on a competitor and while it would have made some things easier we never found anything we wanted to do that was impossible without root permissions.
- tedmiston 4y agoSee previous HN posts about the Zoom installer. It does some unusual stuff that it probably doesn't actually need to be doing.
- jupp0r 4y agoThis says a lot about their engineering culture. There’s no way I’d just casually take on the liability of having root privileges in the software I’m shipping to customers if it can be avoided. Them not caring is a huge red flag imho.
- nikanj 4y agoTheir engineering culture is very much ”does it work”, instead of ”is it Correct”. They have taken the market by storm, because most people care about the former, not the latter
- deleted 4y ago[deleted]
- teawrecks 4y agoIt's the easiest way to add convenient features without dealing with edge cases. Unfortunately, that also means convenient vulnerabilities.
- ilikepi 4y agoThe Zoom app itself doesn't need admin access. My primary non-admin account on my work Mac has it installed in ~/Applications, and I don't notice any missing functionality. The only annoyance is having to manually extract it out of the downloaded archive when I want to update it. But IIRC, this takes two commands, not including the commands to swap the new app bundle with the old. The downloaded archive is compressed with xar, and I believe that one should be extracted into an empty directory because otherwise it will spray files everywhere. Then the app bundle is in a gzipped cpio file...I think it's at Contents/Payload.
- system2 4y agoZoom has been the crappiest most widely used software of this decade.
- caymanjim 4y agoIs there any practical impact to this? Zoom is broken, shouldn't need root at all, and there's no excuse for this kind of sloppiness, but...does it matter? Is there any Mac out there where this is a problem? Is there a single Mac out there with multiple users and Zoom installed? I'm being slightly hyperbolic, but this is a giant nothingburger.
- calvinmorrison 4y agoI am of the camp that very little software should be installed globally. Instead I make use of a precocious and large ~/bin and other things in my less privileged user directories
- epistasis 4y agoI've gone as far as to keep an ~/opt that has bin/, man/, lib/, src/, etc. underneath it, and when I can use --prefix on the configure script. Udocker and singularity (the containerization toolset) also help a ton too. Docker's root requirements make it unsuitable for lots and lots of situations where it would otherwise be useful.
- joebob42 4y agoI've become a big Google meet shill. It works great, it's easy to get people onto it, quality is quite good. I've heard it can fall apart with really big groups of people, but never had any problems up to about 10, and beyond that I don't really care.
- vinay_ys 4y agoFor years, I have refused to install zoom, webex etc clients for exactly this reason. Their installer wants admin user access for no apparent reason. They could have given a simple drag and drop installation app. Instead they want to run an installer with root user permissions to do whatever. Also, I hate apps that installs a helper background program, and doesn't let me disable it via preferences. I refuse to use those too. Besides, for what zoom does, why do they need an app? Browser has all the capabilities they need.
- pleb_nz 4y agoAgree totally, only problem is, imo, the browser experience, even for well built web apps, is 'usually' subpar or more problematic or poor performing than a desktop app.
- FBISurveillance 4y agoGoogle Meet is a great example of an app that uses AV and works well, running in a browser. Even with a large number of participants - and no client required. On the other hand, Zoom web client is an afterthought, to put it nicely.
- nikanj 4y agoAre you talking about Google Meet or Google Meet (nee Duo)? It’s hard to keep track, when they both have the same name https://www.pcworld.com/article/707997/google-pledges-to-make-messaging-simple-yet-again.html/amp https://www.pcworld.com/article/707997/google-pledges-to-mak...
- piperswe 4y agoI think they're referring to this one: https://meet.google.com/ https://meet.google.com/
- acdha 4y agoThan a well-written desktop app, maybe. Electron apps set the bar lower - for example, Microsoft sat on shipping ARM builds for Teams until this month so for a couple of years a browser was faster and used far less RAM.
- dillutedfixer 4y agoI just had to (reluctantly) install Zoom on my freshly formatted MBP for some classes I'm in. The web client wasn't that reliable for me. Unless I'm totally missing something here, it let me install as non-root. The installer asked me if I wanted to install for all users or just for me. I chose just for me and it never asked for an admin password and installed to the Applications folder under my user and not the main Applications folder. There doesn't seem to be any daemons or background processes running when the application isn't open. edit: meant this in response to some comments below about Zoom requiring admin access to install on macOS
- mikeryan 4y agoIf yours is the primary account on the mac then, essentially, your account is “root”.
- SoftTalker 4y agoNo it isn't, it's like any account that has sudo permission to become root. It isn't root all the time, and is only root when provided with the proper password.
- mikeryan 4y agoThat’s why I said “essentially” the whole point of the attack is that the installer gets “root privileges” when the user enters their password to install. It’s kind of moot if they’re actually root when it’s got super user privileges.
- dillutedfixer 4y agoI should have clarified. My account is a Standard non admin account. It never asked me for my password or an Admin password.
- thrillgore 4y agoZoom is the only Video Conferencing system that, to my knowledge, uses a kext for the audio support. Why the hell does it need a Kext?
- spideymans 4y agoSoftware publishers should not be allowed to get away with this with impunity.
- Animats 4y agoWhy does Zoom need root access at all? That's the elephant in the room here. Zoom should be able to run in a sandbox.
- lights0123 4y agoTo auto-update without requiring authentication every time. Useful for multi-user or enterprise setups where the current user may not have sudo access. Chrome and Firefox do the same thing.
- int_19h 4y agoIf you install per-user, you don't need root to update.
- deleted 4y ago[deleted]
- nuker 4y ago“The appeal of injection a library into Zoom, revolves around its (user-granted) access to the mic and camera. Once our malicious library is loaded into Zoom’s process/address space, the library will automatically inherit any/all of Zooms access rights/permissions! This means that if the user as given Zoom access to the mic and camera (a more than likely scenario), our injected library can equally access those devices.” https://objective-see.org/blog/blog_0x56.html https://objective-see.org/blog/blog_0x56.html
- nuker 4y agomoved here from https://news.ycombinator.com/item?id=32458878 https://news.ycombinator.com/item?id=32458878
- sneak 4y agoFool me once, shame on you…
- dannyw 4y agoIs there a legitimate purpose for this entitlement? Zoom for government is authorised for FedRAMP moderate, and has authorisations from the DoD and the Air Force. Does that mean anything?
- api 4y ago> Does that mean anything? It means they ticked a lot of boxes. Certifications only overlap a little bit with actual security. Most of SOC2 for example is just bureaucracy and a cash grab by enterprise SSO providers.
- pjot 4y agoThis post[0] from fly.io does a good job at giving examples of the boxes and bureaucracy. [0]: https://fly.io/blog/soc2-the-screenshots-will-continue-until-security-improves/ https://fly.io/blog/soc2-the-screenshots-will-continue-until...
- _kbh_ 4y agoYes, it can be used to allow an application to load user defined / compiled / etc plugins but Zoom probably doesn't need that.
- cma 4y agoI can't think of one for zoome ubless they allow filter plugins for the camera or something. One thing it is useful for is probably loading unsigned VSTs for DAWs.
- mdasen 4y agoI don't use Zoom for a lot, but when I do it's only through my browser. They just have such a sketchy history at this point and it works fine through the browser for my limited needs.
- deleted 4y ago[deleted]
- misterpigs 4y agoAlways through the browser!
- dev_tty01 4y agoI run it in a linux vm isolated from my mac system. It has access to the camera, network, and audio, but only when it is running. No host file system access. I just can't trust that company.
- fmajid 4y agoI only run it on iOS/iPadOS or on my work computer where if they don’t care enough about security to run Zoom, I am not going to be more royalist than the king.
- malshe 4y agoI have never used it though the browser. Is it possible to use virtual background in browser?
- FabHK 4y agoCan I sufficiently address this by deleting any zoom-related stuff from /Library/LaunchDaemons, then rebooting?
- lazyeye 4y agoZooms research and development team is based in China https://www.axios.com/2020/06/16/zoom-us-china https://www.axios.com/2020/06/16/zoom-us-china
- _kbh_ 4y agoSlides on the vulnerability if anyone is interested. https://speakerdeck.com/patrickwardle/youre-muted-rooted https://speakerdeck.com/patrickwardle/youre-muted-rooted