Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

MacRumors

macrumors bot
Original poster
Apr 12, 2001
63,194
30,135



Apple today pushed a second silent security update to Macs to address further vulnerabilities related to the Zoom video conferencing app for macOS, reports The Verge.

Apple removed software that was installed by RingCentral and Zhumu, two video conferencing apps that relied on technology from Zoom and were also found to have the same vulnerabilities as Zoom earlier this week.

zoom_logo-800x350.jpg

These two apps installed software able to respond to commands that could potentially allow websites to open up your webcam during a video conference without permission. Removing the apps did not remove the secondary software that was vulnerable to exploitation, which is also how Zoom worked.

Discovered last week, the Zoom vulnerability let a website forcibly initiate a video call on a Mac with the Zoom app installed, due to a web server that Zoom installed in the background.

When the vulnerability was first discovered, Zoom said that it used a local web server as a workaround to Safari changes that Apple introduced in Safari 12, calling it a "legitimate solution" to an otherwise "poor user experience" that allowed users to access "seamless, one-click-to-join meetings."

At issue was a new popup Apple implemented to require user approval when launching a third-party app, which Zoom wanted to avoid. Zoom did so through the aforementioned web server, which was designed to wait for calls to open up Zoom conferences automatically.

Zoom eventually released a patch to address the issue, and Apple also took the step of removing web server software that was not initially removed from the Mac when uninstalling the Zoom app. Zoom has since made it so uninstalling the Zoom app will remove the web server, and has made other changes.

Installing Zoom no longer installs a local web server on Mac devices, and there is a new setting to save the "Always turn off my video" preference that disables video in Zoom by default until it is manually enabled.

As with the original Zoom patch, the new patch for RingCentral and Zhumu is deployed automatically so that users are not required to apply it manually for it to take effect. Apple told The Verge that it plans to fix the vulnerability for all of Zoom's partner apps.

Article Link: Apple Pushes Another Automatic Mac Software Update to Address Further Zoom-Related Vulnerabilities
 

BWhaler

macrumors 68040
Jan 8, 2003
3,788
6,244
NO

It was NOT discovered last week.

ZOOM was informed months ago, decided not to fix the patch because it would lower their value proposition and product strategy. Again, they chose to leave the security hole open for their business gain.

Two weeks ago was when the researcher got fed up and disclosed it to the public. Only then did Zoom jump into PR mode and fox the problem.

Apple, god bless them, learned of this and shut the exploit down. No point waiting for an unethical company. What else does Zoom know about they still haven’t disclosed?

MacRumors writers, do your job. Don’t let unethical companies spin or this behavior will never go away.
 

Westside guy

macrumors 603
Oct 15, 2003
6,333
4,152
The soggy side of the Pacific NW
Even if you discount the security issues... thanks companies for installing a 24x7 service consuming resources just to avoid a potential CLICK.

Yeah, this is a problem - even setting aside security concerns. All sorts of companies add superfluous scripts to our system's LaunchAgents and LaunchDaemons folders, usually for no good reason. Adobe, Citrix, Google, Microsoft, etc. Maybe each one doesn't normally chew up much memory, but the effect is cumulative... and sometimes those processes run away.

I actually have a "cleanup unwanted launchers" bash script running as a cron job on all my Macs. It runs each hour and moves the cruft any of these companies (and a couple others) placed into the various LaunchAgents and LaunchDaemons folders into LaunchAgents-unused and LaunchDaemons-unused, respectively.
 

arkmannj

macrumors 68000
Oct 1, 2003
1,723
505
UT
Yeah, this is a problem - even setting aside security concerns. All sorts of companies add superfluous scripts to our system's LaunchAgents and LaunchDaemons folders, usually for no good reason. Adobe, Citrix, Google, Microsoft, etc. Maybe each one doesn't normally chew up much memory, but the effect is cumulative... and sometimes those processes run away.

I actually have a "cleanup unwanted launchers" bash script running as a cron job on all my Macs. It runs each hour and moves the cruft any of these companies (and a couple others) placed into the various LaunchAgents and LaunchDaemons folders into LaunchAgents-unused and LaunchDaemons-unused, respectively.

Any chance you’re willing to share your script? :) It’s a shame that you’d even need to make something like that, especially having to run regularly.
 

Mike MA

macrumors 68020
Sep 21, 2012
2,089
1,811
Germany
Appreciating Apple’s effort to protect its customers. I don’t see this as a given fact to be honest.
 

jweinraub

macrumors 6502
Jun 26, 2007
371
219
Sol III
Howso? By making sure people can NOT access your camera and mic without your knowledge in a way that was designed to sidestep basic OS protections, now it's invading your privacy?
Regardless of what security implications it resolves, I 100% want to be in charge of my computer. I want to see it in an update fix that I can choose to install, if I so choose. I vehemently disagree with the idea I can get updates pushed without my consent. How can you trust a company that much it can actually do that? If any other software did that on your computer, you would be ups and arms about it. Why does Apple get a free pass then?
 

emersive

macrumors newbie
Aug 25, 2010
8
10
NO

It was NOT discovered last week.

ZOOM was informed months ago, decided not to fix the patch because it would lower their value proposition and product strategy. Again, they chose to leave the security hole open for their business gain.

Two weeks ago was when the researcher got fed up and disclosed it to the public. Only then did Zoom jump into PR mode and fox the problem.

Apple, god bless them, learned of this and shut the exploit down. No point waiting for an unethical company. What else does Zoom know about they still haven’t disclosed?

MacRumors writers, do your job. Don’t let unethical companies spin or this behavior will never go away.


Exactly, this is the thing that I think so many people haven't noticed about all of this. They knew there was a grave security concern and didn't care at all until they were shamed into doing something. This isn't the mark of a company that gives a @#$# about our security. It also makes me more comfortable that I use Apple products because Apple reacted swiftly.
 

Westside guy

macrumors 603
Oct 15, 2003
6,333
4,152
The soggy side of the Pacific NW
Any chance you’re willing to share your script? :) It’s a shame that you’d even need to make something like that, especially having to run regularly.

Here it is, warts and all (replace "{username1}, {username2}, etc. with actual user accounts of course).

* There should really be some error checking added to this, for example it shouldn't try to move the files if it's unable to create the "-unused" directories.
* Released under the "you break it, you get to keep both pieces" license

Code:
#!/bin/bash -f

#
#   Cleans out all the cruft that Adobe, Microsoft, and Google try to hide
#   in the Launch* directories. This script works from the command line, but
#   it's mainly intended for use as a cron job.
#
#   Needs to be run with sudo, or as root
#
#
#   Changelog: Added Skype to the list  2018-12-03 TLS
#
#              Initial script written  2018-08-15 TLS
#

if [ $USER != "root" ] ; then
   echo "Error - needs to be run with root permissions (you are $USER). Please use sudo."
   exit 1;
fi

DIRECTORY_LIST=(
	"/Library/LaunchAgents"
	"/Library/LaunchDaemons"
	"/Users/{username1}/Library/LaunchAgents"
	"/Users/{username2}/Library/LaunchAgents"
	)
UNWANTED_LAUNCHERS_LIST=(
	"com.adobe.*"
	"com.citrix.*"
	"com.google.*"
	"com.lifescan.*"
	"com.microsoft.*"
	"com.skype.*"
	)

for THIS_DIR in ${DIRECTORY_LIST[*]} ; do
	if [ ! -d $THIS_DIR ] ; then
		continue
	fi
	STORAGE_DIR="$THIS_DIR-unused"
	if [ ! -d $STORAGE_DIR ] ; then
		mkdir $STORAGE_DIR
	fi
	for THIS_GLOB in ${UNWANTED_LAUNCHERS_LIST[*]} ; do
		find $THIS_DIR -maxdepth 1 -type f -iname $THIS_GLOB -exec mv \{\} $STORAGE_DIR \;
	done
done
 

hourglass111

macrumors member
Jan 26, 2017
45
117
Mid Ohio Valley
Automatic silent OS updates huh? Sounds like some Google privacy invading stuff to me.

This was a blatant disregard for user consent and an invasion of privacy and security.

Google is the one that doesn’t force updates when such things are discovered, and even builds them in!

As a Zoom user who finds their actions, coverup, and coming-clean sort of insulting, I’m glad I use a Mac and not a Chromebook.
 
  • Like
Reactions: Sasparilla

konqerror

macrumors 68020
Dec 31, 2013
2,298
3,700
Zoom ruined their platform in exactly one action. Already had this scenario last week: big organization A has to use Zoom because it was evaluated for one division that needs HIPAA. Big organization B banned all forms of Zoom, rightly, due to security. Hilarity ensued.
 

peteyD

macrumors member
Nov 9, 2009
95
82
Regardless of what security implications it resolves, I 100% want to be in charge of my computer. I want to see it in an update fix that I can choose to install, if I so choose. I vehemently disagree with the idea I can get updates pushed without my consent. How can you trust a company that much it can actually do that? If any other software did that on your computer, you would be ups and arms about it. Why does Apple get a free pass then?

Almost all anti-malware products update their signatures automatically and without your approval. You may still disagree with the idea, but this isn’t just an Apple thing.
 

arkmannj

macrumors 68000
Oct 1, 2003
1,723
505
UT
Here it is, warts and all (replace "{username1}, {username2}, etc. with actual user accounts of course).

* There should really be some error checking added to this, for example it shouldn't try to move the files if it's unable to create the "-unused" directories.
* Released under the "you break it, you get to keep both pieces" license

Code:
#!/bin/bash -f

#
#   Cleans out all the cruft that Adobe, Microsoft, and Google try to hide
#   in the Launch* directories. This script works from the command line, but
#   it's mainly intended for use as a cron job.
#
#   Needs to be run with sudo, or as root
#
#
#   Changelog: Added Skype to the list  2018-12-03 TLS
#
#              Initial script written  2018-08-15 TLS
#

if [ $USER != "root" ] ; then
   echo "Error - needs to be run with root permissions (you are $USER). Please use sudo."
   exit 1;
fi

DIRECTORY_LIST=(
    "/Library/LaunchAgents"
    "/Library/LaunchDaemons"
    "/Users/{username1}/Library/LaunchAgents"
    "/Users/{username2}/Library/LaunchAgents"
    )
UNWANTED_LAUNCHERS_LIST=(
    "com.adobe.*"
    "com.citrix.*"
    "com.google.*"
    "com.lifescan.*"
    "com.microsoft.*"
    "com.skype.*"
    )

for THIS_DIR in ${DIRECTORY_LIST[*]} ; do
    if [ ! -d $THIS_DIR ] ; then
        continue
    fi
    STORAGE_DIR="$THIS_DIR-unused"
    if [ ! -d $STORAGE_DIR ] ; then
        mkdir $STORAGE_DIR
    fi
    for THIS_GLOB in ${UNWANTED_LAUNCHERS_LIST[*]} ; do
        find $THIS_DIR -maxdepth 1 -type f -iname $THIS_GLOB -exec mv \{\} $STORAGE_DIR \;
    done
done
Thanks!
no judgment here, scripts/apps I make for myself are always more haphazard than for professional work :)
thanks for sharing !
 

NMBob

macrumors 68000
Sep 18, 2007
1,893
2,398
New Mexico
If you don't have the 'install security updates' button checked do you get a notification that there is one? I'd at least like to know that it is happening. That would be the civilized thing to do. It might keep me from saying a lot of bad words about slowness when all that is happening is that they are installing stuff.
 
  • Like
Reactions: motulist

zorinlynx

macrumors G3
May 31, 2007
8,133
17,434
Florida, USA
By the way, for those who feel "Apple is forcing these updates on us!", they're not. It is possible to disable these security updates. I won't say how here because nobody should, but they ARE optional when it comes down to it.

So far Apple has only done good things with these updates.
 

iGeneo

macrumors demi-god
Jul 3, 2010
1,381
2,573
Regardless of what security implications it resolves, I 100% want to be in charge of my computer. I want to see it in an update fix that I can choose to install, if I so choose. I vehemently disagree with the idea I can get updates pushed without my consent. How can you trust a company that much it can actually do that? If any other software did that on your computer, you would be ups and arms about it. Why does Apple get a free pass then?

Perhaps it is time you sell your Mac and move along. Linux perhaps?
 
  • Disagree
Reactions: foliovision

Colonel Blimp

macrumors 6502
Dec 1, 2016
424
507
Regardless of what security implications it resolves, I 100% want to be in charge of my computer. I want to see it in an update fix that I can choose to install, if I so choose. I vehemently disagree with the idea I can get updates pushed without my consent. How can you trust a company that much it can actually do that? If any other software did that on your computer, you would be ups and arms about it. Why does Apple get a free pass then?
You ARE 100% in charge of your computer. Apple do not need a free pass, because Apple have already given you what you want.

If you don’t want Apple to automatically install security updates, simply go to System Preferences : Software Updates : Advanced and uncheck the box to automatically “Install system data files and security updates.” Apple have provided users with this choice for several years.
 
Last edited:

konqerror

macrumors 68020
Dec 31, 2013
2,298
3,700
If any other software did that on your computer, you would be ups and arms about it. Why does Apple get a free pass then?

Nobody has been up in arms about Adobe Reader/Acrobat, Google Chrome, Slack (non-app store client), Microsoft Teams, OneDrive (sync engine), Microsoft Windows (emergency/servicing stack updates, Defender antimalware definitions, Malicious Software Removal Tool). All of those push updates silently.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.