Apple Pushes Automatic Mac Software Update to Remove Vulnerable Zoom Web Server

[Shirasaki]

Your idea about security and privacy is very scary. You would blindly give all your trust regarding security and privacy to a company which you don't own or control. I think when it comes to security and privacy the last say should be from the end user. Whatever company claim about their security and privacy policy is, you should always take it with a grain of salt. In the world of security, there is what they called professional paranoia. Letting Apple "wipe rouge apps" off every persons device is not security, it's control. If that is how iOS/iPhone works, its just like you do not own your iPhone/iPad but Apple just lend it to you because anytime they want they can lock you out from it. You may think you own the hardware however what use will your hardware be if they can lock you out remotely anytime they want.

If I buy a phone or a computer in general, I want to own its hardware and software and use it how I see fit. That's why its called buying.

On the other hand, users give themselves way too much faith in believing they can control their own device and software without screwing things up. Chances are, the opposite happens a lot. By that time, who will come to clear the mess and bring hardware back to working order? Software engineers and mechanisms they implemented inside operating system during each and every development phase. Without those things, Without those mechanisms, users are forced to find the fix themselves.

As for the “owning software” thing, when you buy a hardware with software, you don’t own the software, but rather a license to use it under certain rules and conditions, many of which are without warrant (Or referred to as “provided as-is”, commonly seen on EULA of many free software). Even if you technically own the hardware (for now), you really cannot do a whole lot with the hardware without voiding warranty. In this sense, user don’t even truly “own” hardware anymore, but rather paying a hefty price to sort of “rent” the hardware without actually making payments to manufacturer in exchange for services and repairs. With the introduction of 24-month plan to finance iPhone, many users don’t even own their iPhone anymore, even though many of them have the option to own the iPhone after finishing payment.

So, to summarise, “owning hardware and software” is a hoax and simply not a thing. And letting user to control their software and hardware without check is dangerous.

Spoiler

Back in 1978 - 1995 days when Commodore 64 (and all other commodore computers) was widely popular, users were enjoying hacking and working with the hardware directly, trying to poke around registers and electronic components and see how the computer function. That was ok for both users and companies as those computers were simple enough to understand after spending a couple dozen hours. Nowadays, with the sheer amount of complexity on our devices, even some small random changes can have snowball effect that leads device into an unknown state nobody has any idea about. So, instead of letting users to poke around registers and such, engineers decide to enclose those low level stuff from user, making understanding how to use a computer easier for users without sufficient knowledge.

[doublepost=1562856943][/doublepost]

In the software world reality moves like that are normal. So much of our items that we use are head together with duct tape and coat hangers. Including iOS and the mac OS that we all love.

Pretty much the same thing in other industries too. Duct tape solutions all over the place. No one has the time to actually build a long-lasting device anymore.

 

[trusso]

As already pointed out a number of times in the thread there was no code deployed. Absolutely no-one (sane) looks through their anti-virus update definitions to see which malware they'd like to keep running. Trying to imply a slippery slope for a timely and successful removal of dangerous software is laughable.

I’m happy to have this clarified and be proven wrong. I pick my battles, but I’d rather raise my voice over a little bit of nothing than not raise my voice over a lotta bit of something.

Trust no man with power.... so was Adams advocating rule by children? Or perhaps a gynopoly? Or was he anticipating the invention of AI and welcoming our robotic overlords centuries early?

Sorry, but someone has to be entrusted with a certain amount of power, which is the point of all those checks and balances we keep hearing about, where one official or body or agency checks (meaning halts) the power of another, or balances their attempts to abuse their authority by being able to prevent it indirectly, such as by withholding funding.

The power that we, the People exercise through our government, and such agencies within it as the FTC, the FCC, the SEC, and the CPB, or whatever, plus laws as Congress from time to time enacts, are the checks we have on Apple, and our willingness to stop buying Apple products if they abuse their power is a way in which we can balance their power with our own. It’s similar to how our government was set up with the hope of making trust possible, even beneficial. But if you think you’re pretty smart, and can manage this system you’ve bought all by your lonesome and don’t need the army of software engineers who, unlike you, have access to the source-code and documentation internal to Apple on how the closed-source, proprietary parts of their OS works, then more power to you.

I’m sure anyone who is pretty intelligent can do just as well, even without the benefit of being the people to whom security researchers and white-hat hackers report problems and security holes and flaws to. All those automated crash reports from millions or billions of computers and devices... who needs any of that stuff, right?

Apple should just axe their whole software team and hire a few guys from the internet who think of themselves as pretty smart or intelligent. Think of the savings and corresponding boost in profits that would generate!

LOL

If being a straw man for your retorts makes you happy, feel free to take my words out of context and divine my inner-most thoughts. I don’t mind. Never let the facts get in the way of a clever retort.

 

[CollinH]

So Apple is quietly and without explicit permission installing code on my computer to remedy a situation and protect me from code which Zoom installed quietly and without explicit permission—and I'm being asked to trust both organizations explicitly.

Unless I'm misunderstanding something here, I'm rather uncomfortable with this from all sides.

 

[ignatius345]

Apple app aproval process fail.

Not an app store app.

 

[Feenician]

So Apple is quietly and without explicit permission installing code on my computer

No, as has been explained many times.

Unless I'm misunderstanding something here

You most certainly are but the answers you need are in the thread. Apple updated the antivirus signatures for macOS to remove a specific component of Zoom that had the potential to be misused.

 

[Shirasaki]

So Apple is quietly and without explicit permission installing code on my computer to remedy a situation and protect me from code which Zoom installed quietly and without explicit permission—and I'm being asked to trust both organizations explicitly.

Unless I'm misunderstanding something here, I'm rather uncomfortable with this from all sides.

This incident is a wake up call to users who are thinking they own the software they purchase, which they don’t. And as uncomfortable as it sounds, such auto update is actually good for everybody. Think of it by adding additional garage doors to the main car park entry. It makes entering or exiting car park harder, but this door may block an access point where thieves can easily sneak in.

 

[Feenician]

This incident is a wake up call to users who are thinking they own the software they purchase, which they don’t. And as uncomfortable as it sounds, such auto update is actually good for everybody. Think of it by adding additional garage doors to the main car park entry. It makes entering or exiting car park harder, but this door may block an access point where thieves can easily sneak in.

It shouldn't really be a "wake up call" to anyone since Xprotect has been a component of macOS (nee OS X) for a decade and has been used solely to remove threatening software from Macs.

 

[chrfr]

Honestly Zoom does not have to anything as it is relatively minor issue that was turned on by a setting. The user always had the option not to auto join with video.

There was also a web server left running on the computer even if the user had uninstalled the Zoom client.

 

[aristobrat]

FWIW, looks like another built-in macOS defense tool (MRT) may have been used to clean this up.

https://eclecticlight.co/2019/07/10...ate-to-mrt-to-remove-zooms-hidden-web-server/

 

[ignatius345]

A "silent" Mac OS update sounds like Google Play Services.
Isn't this the company that prides itself on privacy and whatnot?

So uncheck this if an emergency security update bothers you.

 

[sracer]

I had to split the post to vote....

This incident is a wake up call to users who are thinking they own the software they purchase, which they don’t.

And as uncomfortable as it sounds, such auto update is actually good for everybody. Think of it by adding additional garage doors to the main car park entry. It makes entering or exiting car park harder, but this door may block an access point where thieves can easily sneak in.

IMO, auto-update is NOT actually good for everybody... especially when this "feature" is kept hidden from users and no way to opt-out of it. One of the grass-roots reasons for choosing macOS over Windows is because Apple doesn't do what Microsoft does. in the case of auto-updating, Apple might actually be worse than what Microsoft is doing with Win 10.

 

[Feenician]

I had to split the post to vote....


View attachment 847723


View attachment 847724
IMO, auto-update is NOT actually good for everybody... especially when this "feature" is kept hidden from users and no way to opt-out of it. One of the grass-roots reasons for choosing macOS over Windows is because Apple doesn't do what Microsoft does. in the case of auto-updating, Apple might actually be worse than what Microsoft is doing with Win 10.

Does Windows Defender announce every signature update and which specific threatening software it will remove?

 

[ignatius345]

IMO, auto-update is NOT actually good for everybody... especially when this "feature" is kept hidden from users and no way to opt-out of it. One of the grass-roots reasons for choosing macOS over Windows is because Apple doesn't do what Microsoft does. in the case of auto-updating, Apple might actually be worse than what Microsoft is doing with Win 10.

There should be an alert, I'll grant that -- but there absolutely is a way to opt out, unless I'm mistaken:

 

[StralyanPithecus]

People, people. If you want absolute control and privacy return to paper and pencil only. Using electronic devices and asking for absolutely privacy is just an illusion.

 

[konqerror]

IMO, auto-update is NOT actually good for everybody... especially when this "feature" is kept hidden from users and no way to opt-out of it. One of the grass-roots reasons for choosing macOS over Windows is because Apple doesn't do what Microsoft does. in the case of auto-updating, Apple might actually be worse than what Microsoft is doing with Win 10.

The problem is your computer is not alone. It is a member of a global public network. Your computer is on the Internet and also carries other people's private information like e-mails and phone numbers. Your computer also can launch DDoS attacks and spread malware to others.

I demand that your computer to be auto-updated and malware free so it doesn't attack mine. To make a privacy or "control" excuse is being selfish.

If Microsoft and Apple don't enforce safety standards for the community, then the government eventually will. Just like driver's licensing, recalls, mandatory insurance, and safety inspections on cars.

 

[ipponrg]

I asked "Is it not safe to use at all? Is it safe with this update?"

How is asking if some software is safe to use "completely paranoid"?

Maybe take a break from the forums and get some fresh air.

I already got my fresh air. And yeah if you are asking if it’s “safe to use with this update”, it makes you sound paranoid.

If you don’t click on any anonymous Zoom link nor share your unique Zoom ID out to the wild for people to denial of service attack you, you are fine.

 

[Kaibelf]

Apple app aproval process fail.

"Macfacts" and yet your post was patently false. Okay then.
[doublepost=1562866159][/doublepost]

Yes. Well done Apple. Very well done.

This is a disaster for Zoom. They had one of the best brands in the comms space, and they are destroying it with this “feature”’ which makes Macs vulnerable and then trying to pass this off like it’s no big deal. It’s breathtaking how tone deaf they are.

It’s despicable, and Zoom better act fast before they are dead to enterprises. No CIO/CTO will risk their career because a vendor has a slightly easier user experience.

This is company destroying stupidity and Zoom better act while they still can. Otherwise, they will be a business school case study of what not to do in a crisis.

That a heap of hyperbole. This came to light the other day, and the patches are already coming out. Plus, most volume enterprises are still standardized on PCs, so perhaps a little perspective would be in order.

 

[tywebb13]

Thanks, I don't have this update, and doesn't appear when I click 'Check for Updates'

I also have Zoom installed for work, details are pretty sketchy, is it not safe to use at all? Is it safe with this update?

Apple or Zoom need to post a clear guide.

You can check which version of MRT you have with this command in Terminal:

/usr/libexec/PlistBuddy -c "Print CFBundleShortVersionString" /System/Library/CoreServices/MRT.app/Contents/Info.plist

If it is below 1.45 you can get the 1.45 version here and install it manually if it hasn't been automatically installed (and it depends which system you have):

Catalina:
http://swcdn.apple.com/content/down...tyr76mwdtpyp2bbsdcl42/MRTConfigData_10_15.pkg

El Capitan to Mojave:
http://swcdn.apple.com/content/down...7znioombsmslxzvvdn95g/MRTConfigData_10_14.pkg

The reason there are 2 versions is that you need to disable SIP in Catalina before you can manually install it. No need to disable SIP in El Capitan to Mojave however.

 

[StralyanPithecus]

Or you can use LockRattler for it, it’s free.

 

[redheeler]

There should be an alert, I'll grant that -- but there absolutely is a way to opt out, unless I'm mistaken:

View attachment 847728

It would be nice if XProtect updates showed up in Software Update so I could choose to manually install them. But unchecking this box does prevent them from being installed automatically, and some simple research will confirm it.

 

[tywebb13]

It would be nice if XProtect updates showed up in Software Update so I could choose to manually install them. But unchecking this box does prevent them from being installed automatically, and some simple research will confirm it.

Despite the confusion earlier in the thread with people thinking the update is xprotect (thankfully clarified later in the thread to really be mrt, not xprotect) you can nevertheless still check your version of xprotect in terminal with

/usr/libexec/PlistBuddy -c "Print CFBundleShortVersionString" /System/Library/CoreServices/XProtect.bundle/Contents/Info.plist

and if it isn't the latest (2103) then you can get version 2103 here to install manually:

http://swcdn.apple.com/content/down...d5832ivg90gh4xtns/XProtectPlistConfigData.pkg

Note : This applies for Mavericks to Mojave NOT Catalina because despite having a MRT, Catalina has no XProtect.

 

[MrMacintoshBlog]

It would be nice if XProtect updates showed up in Software Update so I could choose to manually install them. But unchecking this box does prevent them from being installed automatically, and some simple research will confirm it.

Hey guys,

I put together a quick post on how to do the following.

1. Check for Xprotect updates using "softwareupdate -l --include-config-data"
2. Download single Xprotect updates including MRTConfigData v1.45
3. Install MRTConfigData v1.45
4. Force kick the MRT Binary to run right now to see if the update actually found zoom and removed it.

https://mrmacintosh.com/how-to-remediate-the-zoom-vulnerability-with-apple-malware-removal-tool/

 

[coolfactor]

If I didn’t trust Apple as much as I do, this kind of power would make me uncomfortable. They’re truly the benevolent dictator of their ecosystem.

It's not clear if this falls under the banner of "Install system data files and security updates", which you DO have control over.

[doublepost=1562871872][/doublepost]MacRumors headline is the main problem here. This is likely more of an XProtect configuration update, not a software update, per-se. The launching of the Zoom app is now included with a firewall provided by XProtect, prompting the user to approve.

Let's be careful how we word things to avoid unfounded accusations against Apple, eh?

 

[Sharewaredemon]

Thus my frequent stating that we’re still living in The Dark Age Of Computing. One core problem is the lack of default security in our programming languages. When we no longer use C and it’s derivatives, we’ll know we’re making progress.

:-D

I agree we live in a Dark Age of computing.
To me, the only way out is to rely on tech as little as possible, from as few vendors as you can manage.

 

[tywebb13]

It's not clear if this falls under the banner of "Install system data files and security updates", which you DO have control over.

View attachment 847750
[doublepost=1562871872][/doublepost]MacRumors headline is the main problem here. This is likely more of an XProtect configuration update, not a software update, per-se. The launching of the Zoom app is now included with a firewall provided by XProtect, prompting the user to approve.

Let's be careful how we word things to avoid unfounded accusations against Apple, eh?

As pointed out before it is a mrt (malware removal tool) update not an xprotect update.

Here are the EXACT dates and times for the release of these updates:

XProtectPlistConfigData.pkg : 2019-05-01T19:55:49Z

MRTConfigData_10_14.pkg : 2019-07-10T21:57:12Z

MRTConfigData_10_15.pkg : 2019-07-10T21:57:12Z

As you can see the current xprotect (version 2103) is more than 2 months older than the current mrt (version 1.45).