Apple Pushes Automatic Mac Software Update to Remove Vulnerable Zoom Web Server

Discussion in ' News Discussion' started by MacRumors, Jul 10, 2019.

  1. MacRumors macrumors bot


    Apr 12, 2001

    Earlier this week, a serious vulnerability with the Zoom video conferencing app for macOS was disclosed, with attackers potentially able to hijack users' webcams.


    The vulnerability was particularly notable because Zoom had installed a hidden web server on users' computers in order to allow for automatic answering of incoming calls, and that web server was not only the weak point that could be exploited, but it also was not removed upon deletion of the app. As a result, users who had previously deleted Zoom might not even realize they were vulnerable to this potential attack.

    After initially defending the decision to install a web server on users' machines to work around changes in Safari 12 that would have required users to click to accept incoming calls, Zoom later backtracked and released a patch to remove the web server from users' computers.

    Apple has now taken things one step further and pushed out a silent macOS update that removes the web server, reports TechCrunch. The update is deployed automatically, so users don't have to manually apply it in order for it to take effect.
    Zoom told TechCrunch it was "happy to have worked with Apple on testing this update" and that it should resolve all issues with the web server.

    In a blog post, Zoom says it will take further action this weekend by automatically having first-time users who select "Always turn off my video" default to having video off for all future meetings. In addition, Zoom will be improving its bug bounty program and security-related issue escalation process.

    Article Link: Apple Pushes Automatic Mac Software Update to Remove Vulnerable Zoom Web Server
  2. dannyyankou macrumors G3


    Mar 2, 2012
    Scarsdale, NY
    Um wait, this is an issue? Isn’t that how things should be? Lol.
  3. macfacts macrumors 68040


    Oct 7, 2012
  4. Snownoob macrumors newbie


    May 30, 2018
    Is it? I can't find the Zoom app in the Mac App Store. I think you have to download it from their website.
  5. NickName99 macrumors regular


    Nov 8, 2018
    If I didn’t trust Apple as much as I do, this kind of power would make me uncomfortable. They’re truly the benevolent dictator of their ecosystem.
  6. dannyyankou macrumors G3


    Mar 2, 2012
    Scarsdale, NY
    Well considering the app isn’t on the Mac App Store and you have you go on Zoom’s website to download and install it, this point is invalid.
  7. BWhaler macrumors 68030


    Jan 8, 2003
    Yes. Well done Apple. Very well done.

    This is a disaster for Zoom. They had one of the best brands in the comms space, and they are destroying it with this “feature”’ which makes Macs vulnerable and then trying to pass this off like it’s no big deal. It’s breathtaking how tone deaf they are.

    It’s despicable, and Zoom better act fast before they are dead to enterprises. No CIO/CTO will risk their career because a vendor has a slightly easier user experience.

    This is company destroying stupidity and Zoom better act while they still can. Otherwise, they will be a business school case study of what not to do in a crisis.
  8. roguedaemon macrumors newbie


    Apr 16, 2015
    Absolutely shocking practice from Zoom. How dare they. Good on Apple for moving on this.
    This is the kind of practice that seperates Mac from Windows.
  9. smithrh macrumors 68020


    Feb 28, 2009
    This is very interesting - something has gone wrong with my Mac in the last day and I've been unsuccessful at finding the issue - I was wondering what could have changed as I haven't changed a thing. Lots of troubleshooting to no avail.

    Now this story about a silent OS update. Extremely interesting timing for sure.
  10. buran-energia macrumors regular

    Oct 9, 2017
    So, Apple can install an update (essentially any code) without user's approval or notification? Not good.
  11. rk-apple macrumors newbie


    May 4, 2015
    I'm not sure I'm comfortable with Apple pushing out silent updates. There should be an option to be notified about them (maybe there is and I'm not aware?). I do trust Apple, but I like to know what updates are coming my way.
  12. ipponrg macrumors 65816

    Oct 15, 2008
    They will be fine. The difference is they were intentional with this feature as oppose to being unaware (looking at you FaceTime).

    The funny part about this is you have to click a zoom link. It’s as much a security loophole just like how people have to execute an app to install a virus.
  13. Feenician macrumors 603


    Jun 13, 2016
    My guess (and it is a guess, since I can't find details here or on techcrunch) would be that this was an update to Xprotect signatures. I don't think people generally review every signature update to antivirus software.
  14. InuNacho macrumors 65816


    Apr 24, 2008
    In that one place
    A "silent" Mac OS update sounds like Google Play Services.
    Isn't this the company that prides itself on privacy and whatnot?
  15. macduke macrumors G4


    Jun 27, 2007
    Central U.S.
    I suggest you guys research XProtect. This has been on the Mac for many years and silently updates to prevent malware, like Zoom (that’s essentially what it is, no sugar coating it), from affecting user’s systems once it is found out. For legit developers, even third party, they can also revoke their certificate which means that most users won’t be able to open the app unless they change it to the most wide open setting, which I don’t believe is the default. Only shady companies don’t get signed certs through Apple. I guarantee you Apple threatened to revoke their certs which is why they had a sudden change of heart. Apple could have just nuked the app completely, and I think they have the right in their terms and conditions for the Xcode/macOS license agreement.

    I love it when Apple does this. They keep developers in check, like they did recently with Facebook. They also have a protection mechanism built into iOS that can remotely wipe rogue apps off every person’s device in the world. They’re the only company with the balls to do it and the security and privacy mindset to pull it off. May security and privacy forever be their #1 goal. Seriously, bless those beautiful engineers. They’re far from perfect, but among the best there is.
  16. smithrh macrumors 68020


    Feb 28, 2009
    From what I'm reading elsewhere, you can turn off these silent updates in the Advanced part of Software Update, which I had done, so my issue is not related to this update...

    Unsure if that's good or bad... now worrying that I have a sick MBP...
  17. Feenician macrumors 603


    Jun 13, 2016
    You literally turned off anti-virus/anti-malware updates. Though neither are exactly prevalent on macOS you should probably be grateful that it took until today for your MBP to be "sick"
  18. pika2000, Jul 10, 2019
    Last edited by a moderator: Jul 11, 2019

    pika2000 macrumors 603

    Jun 22, 2007
    You comment fail. The app is provided directly by Zoom, and you download it from their website.

    --- Post Merged, Jul 10, 2019 ---
    Not that "shocking" tbh. Silicon Valley reeks of these kind of things. Apple seems to be the exception.
  19. JetTester macrumors 6502

    Feb 12, 2014
    Good for Apple! Bad for Zoom. Bad behavior gets smacked down, again.
  20. Mascots macrumors 68000


    Sep 5, 2009
    This is absolutely not what XProtect is - what is updated is a list of application definitions that the previous quarantine system can use to prevent malicious software from running. There is literally no code being installed in this process.
  21. trusso Suspended

    Oct 4, 2003
    This month it's Zoom. Next month it's someone else. To paraphrase John Adams, our principle should be to trust no man living with power. To believe otherwise - to believe that any particular party is capable of doing no wrong - is to be deluded, or worse.

    Quite right. As much as I might appreciate Apple "looking out" for its users, I would much rather suffer the odds that something happens to my machine - I consider myself a rather intelligent person, anyhow - than be beholden to the mothership. As with our governments' security apparati, it may be benevolent for a time, but once the system is in place, all it takes is a proverbial "flip of the switch."
  22. Feenician macrumors 603


    Jun 13, 2016
    As already pointed out a number of times in the thread there was no code deployed. Absolutely no-one (sane) looks through their anti-virus update definitions to see which malware they'd like to keep running. Trying to imply a slippery slope for a timely and successful removal of dangerous software is laughable.
  23. goobot macrumors 603


    Jun 26, 2009
    long island NY
    This isn’t a software update as far as I can tell. They just sent a string of text telling the system not to run this garbage that’s it. Apple doesn’t just send out silent updates.
  24. emersive macrumors newbie

    Aug 25, 2010
    This is 100% Zoom's fault not Apple. Zoom decided that they knew better than Apple and bypassed their safeguards to save their users a click. It was completely irresponsible. It really pisses me off that they would do this! GoToMeeting will be getting my money in the future!
    --- Post Merged, Jul 10, 2019 ---
    I believe people should vote with their wallet and go somewhere else... but they probably will forget about this tomorrow. I feel like people don't realize how big of no-no this was. Zoom deliberately made a really poor choice.
  25. ulyssesric macrumors regular


    Oct 7, 2006
    Wrong. It is NOT a "software update" like MR or TC had hinted. It's a blacklist of software signatures that tells the launcher not to load automatically. It works exactly the same way as any modern web browser's phishing site warning, the ad-blocker, and the RFC-5280 Certificate Revocation List (CRL) of SSL.

    It's 2019 now, not 1989. All the data are rapidly changing and you can't just do everything manually. Your computer is also consistently updating hostname resolution list (a.k.a. DNS) without noticing you; is that 'Not good' either ?

Share This Page

114 July 10, 2019