Two more macOS Zoom flaws surface, as lawsuit & government probe loom

2»

Comments

  • Reply 21 of 34
    I saw this petition mentioned on HackerNews and I want to share it with you guys. 

    ronn
  • Reply 22 of 34
    StrangeDaysStrangeDays Posts: 12,877member
    Isn’t the Mac App Store supposed to prevent this bad behavior in app installs?

    Most people must be getting the app from their website...
    Zoom for Mac does not distribute via the MAS. Which is why it is able to do what it is doing.
    ronnwatto_cobra
  • Reply 23 of 34
    GeorgeBMacGeorgeBMac Posts: 11,421member
    This is concerning.   But, like the weather, the most anybody can do is complain about it.
    Under today's circumstances, it pretty much comes down to either accepting the offer to participate in a meeting or event or not.  It's less about which apps you want to use and mostly about which meetings and event you want to participate in.
  • Reply 24 of 34
    StrangeDaysStrangeDays Posts: 12,877member
    BuckDuane said:
    Application developers require revenue to produce support and update their products. These situations will not be resolved until users are willing to pay for security and absence of ads. There is no "Free Lunch".
    Is Zoom not willing to charger its product directly? Why not?
    ronnwatto_cobra
  • Reply 25 of 34
    MplsPMplsP Posts: 3,925member
    BuckDuane said:
    Application developers require revenue to produce support and update their products. These situations will not be resolved until users are willing to pay for security and absence of ads. There is no "Free Lunch".
    Is Zoom not willing to charger its product directly? Why not?
    Zoom charges for the meeting/conference hosts, not the participants. They have a ‘free’ level that allows for smaller meetings up to 40 min and a pro level that allows for longer meetings, more participants, etc. 
  • Reply 26 of 34
    jcs2305jcs2305 Posts: 1,337member
    jimh2 said:
    How do you file a class action suit against a foreign company where our courts have no jurisdiction?


    Headquarters in San Jose, CA


    ronn
  • Reply 27 of 34
    frank777frank777 Posts: 5,839member
    Let's not forget that we're in this situation because Apple either won't make Facetime cross-platform, or get involved with a video-conferencing standard that the rest of the tech world can get behind.

    Imagine for a minute what the world would be like if we all needed to have the same brand of mobile phone to talk to each other.

    Why isn't secure, standards-based video-conferencing baked in at the operating system level?

    People will look back at the 2020 computing era and wonder how we were so dim-witted about personal communications.
    edited April 2020 GeorgeBMac
  • Reply 28 of 34
    GeorgeBMacGeorgeBMac Posts: 11,421member
    frank777 said:
    Let's not forget that we're in this situation because Apple either won't make Facetime cross-platform, or get involved with a video-conferencing standard that the rest of the tech world can get behind.

    Imagine for a minute what the world would be like if we all needed to have the same brand of mobile phone to talk to each other.

    Why isn't secure, standards-based video-conferencing baked in at the operating system level?

    People will look back at the 2020 computing era and wonder how we were so dim-witted about personal communications.

    While I don't agree with Apple making Facetime a freebie to Android users, I get your points and they are good ones.

    I think that this may be just one of the ramifications we see rolling out in the months and years to come from the attack of this virus.  And, video conferencing is just a part of it.   Two big ones will be (hopefully):  a major expansion of telemedicine and a major expansion of cyber learning & teaching -- at least a switch to electronic books, testing and learning aids that can be used both in the classroom as well as at home.
  • Reply 29 of 34
    digitoldigitol Posts: 276member
    The Apple Appstore is surely NOT SAFE!! I downloaded malware hiding in an app from the App Store. Apple simply refunded my purchase. App is still there. Sad. Apple Security is unfortunately not great. Not even good. In fact it's plain weak, and depends greatly on obscurity. Bad practice. 
  • Reply 30 of 34
    mattinozmattinoz Posts: 2,316member
    Why isn't Video chat ubiquitous by now?

    Should be just part of your device you should be able to be on multiple devices with the same ID and it should not matter who makes the device.

    On Apple product, it could still be called Facetime but should be able to chat without 5+ and counting video chats apps so far......

    I'm sure Apple and Google could probably just do this tomorrow if they didn't have their hands tied given both have made public statements about open systems. Wasn't 4G / 5G / LTE standard meant to make this happen years ago?
  • Reply 31 of 34
    Unfortunately EVERYONE is using this, and with the current situation that appears to be the foreseeable future. Both work at home for my job, and distance learning for the kids use it. Since we've made that clear, is there ANY way that we can protect ourselves from this at best malware, and at worst virus???
    watto_cobra
  • Reply 32 of 34
    mdossmdoss Posts: 40member

    Security vulnerabilities

    Patrick Wardle, a macOS security researcher and former hacker for the National Security Agency, has uncovered two new local security vulnerabilities in the latest version of the Mac Zoom client.

    The first flaw relies on the "shady" way that Zoom installs itself on a Mac, which we've previously covered. By taking advantage of the installation process, which is done without user interaction, a user or piece of malware with low-level privileges can gain root access to a computer -- the highest level of privilege.

    The second flaw, which is arguably more concerning, allows a local user or piece of malware to piggyback on Zoom's camera and microphone permissions. An attacker can inject malicious code into Zoom's process space and "inherit" camera and microphone permissions, allowing them to hijack them without a user's knowledge.

    While local exploits like these typically require physical access to a computer, they're usually much more common and difficult to prevent should the rest of the criteria that are needed are fulfilled.

    This isn't Zoom's first security blunder, either. In 2019, a security researcher found a zero-day vulnerability in the app that could have allowed malicious websites to activate and view a Mac webcam without user knowledge.

    Probably a silly question, but please bear with me: What if I enable Guest Mode in my Mac, and "install" and use zoom from there? All installations there are temporary, no root user access needed, and everything gets removed when I log out.  Will that not take care of the latest vulnerability (that Zoom forces root mode etc.)?

    Thank you and cheers
    edited April 2020 watto_cobra
  • Reply 33 of 34
    michelb76michelb76 Posts: 618member
    cpsro said:
    Nice to see AI going after companies with security/privacy issues. Too bad AI doesn't investigate products like Spark before promoting them, not that AI is alone in this. There is simply too much blind promotion (advertising) being done by so-called tech sites.
    I've you're going to be like that and drop this, please read up first.
    https://www.reddit.com/r/apple/comments/adazxk/psa_there_is_nothing_special_about_spark_emails/


    watto_cobra
  • Reply 34 of 34
    blah64blah64 Posts: 993member
    roybatty said:
    Unfortunately EVERYONE is using this, and with the current situation that appears to be the foreseeable future. Both work at home for my job, and distance learning for the kids use it. Since we've made that clear, is there ANY way that we can protect ourselves from this at best malware, and at worst virus???
    Thankfully, NOT everyone is using this. 

    First, your kids should never enable the camera, period.  There's no way that any school or school district can force that upon their students, and if push comes to shove you can say the camera is broken.  No one is going to come to your house and verify that.  Microphone is less bad, but best to disable that as well.  Text chat is available, and even that data is sucked in by zoom, so I wouldn't use it.

    You have great real-world examples to show your company why they should NOT be using it, for example, Elon Musk has banned its use at Space-X and NASA has also banned all of their employees from using it.  That list is growing.

    At the very least you should absolutely never, ever install the app.  If your job requires it to the extent that they're going to fire you if you refuse, then use it in a web browser.  That protects your computer from some of the worst security problems, though it doesn't do much about the privacy issues.

    Don't put any trust in the "backdrop" features that hides your messy room.  It might be hidden from your boss, but it's not hidden from zoom.
    ronnwatto_cobra
Sign In or Register to comment.