Apple Pushes Automatic Mac Software Update to Remove Vulnerable Zoom Web Server

Earlier this week, a serious vulnerability with the Zoom video conferencing app for macOS was disclosed, with attackers potentially able to hijack users' webcams.

zoom logo
The vulnerability was particularly notable because Zoom had installed a hidden web server on users' computers in order to allow for automatic answering of incoming calls, and that web server was not only the weak point that could be exploited, but it also was not removed upon deletion of the app. As a result, users who had previously deleted Zoom might not even realize they were vulnerable to this potential attack.

After initially defending the decision to install a web server on users' machines to work around changes in Safari 12 that would have required users to click to accept incoming calls, Zoom later backtracked and released a patch to remove the web server from users' computers.

Apple has now taken things one step further and pushed out a silent macOS update that removes the web server, reports TechCrunch. The update is deployed automatically, so users don't have to manually apply it in order for it to take effect.

Although Zoom released a fixed app version on Tuesday, Apple said its actions will protect users both past and present from the undocumented web server vulnerability without affecting or hindering the functionality of the Zoom app itself.

The update will now prompt users if they want to open the app, whereas before it would open automatically.

Zoom told TechCrunch it was "happy to have worked with Apple on testing this update" and that it should resolve all issues with the web server.

In a blog post, Zoom says it will take further action this weekend by automatically having first-time users who select "Always turn off my video" default to having video off for all future meetings. In addition, Zoom will be improving its bug bounty program and security-related issue escalation process.

Tag: Zoom

Top Rated Comments

Snownoob Avatar
27 months ago
Apple app aproval process fail.
Is it? I can't find the Zoom app in the Mac App Store. I think you have to download it from their website.
Score: 46 Votes (Like | Disagree)
dannyyankou Avatar
27 months ago
Apple app aproval process fail.
Well considering the app isn’t on the Mac App Store and you have you go on Zoom’s website to download and install it, this point is invalid.
Score: 36 Votes (Like | Disagree)
macduke Avatar
27 months ago
Well considering the app isn’t on the Mac App Store and you have you go on Zoom’s website to download and install it, this point is invalid.
So, Apple can install an update (essentially any code) without user's approval or notification? Not good.
I'm not sure I'm comfortable with Apple pushing out silent updates. There should be an option to be notified about them (maybe there is and I'm not aware?). I do trust Apple, but I like to know what updates are coming my way.
I suggest you guys research XProtect. This has been on the Mac for many years and silently updates to prevent malware, like Zoom (that’s essentially what it is, no sugar coating it), from affecting user’s systems once it is found out. For legit developers, even third party, they can also revoke their certificate which means that most users won’t be able to open the app unless they change it to the most wide open setting, which I don’t believe is the default. Only shady companies don’t get signed certs through Apple. I guarantee you Apple threatened to revoke their certs which is why they had a sudden change of heart. Apple could have just nuked the app completely, and I think they have the right in their terms and conditions for the Xcode/macOS license agreement.

I love it when Apple does this. They keep developers in check, like they did recently with Facebook. They also have a protection mechanism built into iOS that can remotely wipe rogue apps off every person’s device in the world. They’re the only company with the balls to do it and the security and privacy mindset to pull it off. May security and privacy forever be their #1 goal. Seriously, bless those beautiful engineers. They’re far from perfect, but among the best there is.
Score: 34 Votes (Like | Disagree)
BWhaler Avatar
27 months ago
Yes. Well done Apple. Very well done.

This is a disaster for Zoom. They had one of the best brands in the comms space, and they are destroying it with this “feature”’ which makes Macs vulnerable and then trying to pass this off like it’s no big deal. It’s breathtaking how tone deaf they are.

It’s despicable, and Zoom better act fast before they are dead to enterprises. No CIO/CTO will risk their career because a vendor has a slightly easier user experience.

This is company destroying stupidity and Zoom better act while they still can. Otherwise, they will be a business school case study of what not to do in a crisis.
Score: 16 Votes (Like | Disagree)
buran-energia Avatar
27 months ago
Apple has now taken things one step further and pushed out a silent macOS update that removes the web server, reports TechCrunch ('https://techcrunch.com/2019/07/10/apple-silent-update-zoom-app/'). The update is deployed automatically, so users don't have to manually apply it in order for it to take effect.
So, Apple can install an update (essentially any code) without user's approval or notification? Not good.
Score: 14 Votes (Like | Disagree)
Mascots Avatar
27 months ago
So, Apple can install an update (essentially any code) without user's approval or notification? Not good.
This is absolutely not what XProtect is - what is updated is a list of application definitions that the previous quarantine system can use to prevent malicious software from running. There is literally no code being installed in this process.
Score: 14 Votes (Like | Disagree)

Top Stories

Flat 2021 MacBook Pro Mockup Feature

Unreleased Apple Macs and Apple Watches Listed in Eurasian Database Ahead of Fall Product Launches

Monday August 2, 2021 9:34 am PDT by
Apple is preparing for a slew of fall product launches according to new filings that showed up today in the Eurasian Economic Commission database. There are listings for new Mac and Apple Watch models, all of which have previously unknown model identifiers that indicate that they're upcoming devices. There are six new Apple Watch identifiers, including A2473, A2474, A2475, A2476, A2477, and...
ifixit iphone12 mini

Apple to Make Space for Larger Batteries in iPhones, iPads, and MacBooks By Adopting Slimmer Peripheral Chips

Monday August 2, 2021 2:12 am PDT by
For future iPhones, iPads, and MacBooks, Apple plans to use smaller internal components in an effort to increase the size of the device's battery, according to DigiTimes. Image Credit: iFixit Specifically, Apple plans to "significantly increase the adoption" of IPDs or integrated passive devices for the peripheral chips in its products. These news chips will be slimmer in size and allow for...
Apple watch series 5 new case material made of titanium 091019

Titanium Apple Watch Series 6 Models Currently Widely Unavailable

Sunday August 1, 2021 6:21 am PDT by
Models of the Apple Watch Series 6 with titanium cases part of the "Apple Watch Edition" collection is currently widely unavailable for pick-up in several of Apple's retail stores in the United States and is unavailable entirely for delivery in major markets. Noted by Bloomberg's Mark Gurman in the latest edition of his "Power On" newsletter, titanium models of the Apple Watch Series 6,...
General Apps Messages

Android iMessage Competitor Puts Pressure on Apple

Friday July 30, 2021 3:15 am PDT by
Google and the three major U.S. carriers, including Verizon, AT&T, and T-Mobile, will all support a new communications protocol on Android smartphones starting in 2022, a move that puts pressure on Apple to adopt a new cross-platform messaging standard and may present a challenge to iMessage. Verizon recently announced that it is planning to adopt Messages by Google as its default messaging...
REC ASA CODE2016 20160601 205816 2745

Elon Musk Reportedly Demanded to Become Apple CEO as Part of Potential Tesla Acquisition [Update: Musk Denies]

Friday July 30, 2021 9:04 am PDT by
Tesla CEO Elon Musk reportedly once demanded that he be made Apple CEO in a brief discussion of a potential acquisition with Apple's current CEO, Tim Cook. The claim comes in a new book titled "Power Play: Tesla, Elon Musk and the Bet of the Century," as reviewed by The Los Angeles Times. According to the book, during a 2016 phone call between Musk and Cook that touched on the possibility of ...
iPhone 13 Wi Fi 6E feature update

Wi-Fi 6E Explained: What It Could Mean for iPhone 13 and Beyond

Monday August 2, 2021 8:00 am PDT by
The iPhone 13 is widely expected to come with Wi-Fi 6E capabilities, and while it may seem rather nuanced to the average consumer, with only improved speeds and being "up to date" in the realm of Wi-Fi technology, it's actually a fairly significant improvement, laying the groundwork for much of what we know the future holds. To truly understand Wi-Fi 6E, MacRumors sat down for an exclusive...
magic keyboard touch id

Apple Makes Magic Keyboard With Touch ID Available for Separate Purchase

Tuesday August 3, 2021 5:22 am PDT by
Apple has made the Magic Keyboard with Touch ID, which previously was only available with the purchase of the new 24-inch iMac, available for purchase individually for $149. Apple also retails the Magic Keyboard with Touch ID and a numeric keypad for $179. A standard Magic Keyboard without Touch ID or a numeric keypad is available for $99, and a new Magic Trackpad for $129. One major...
themorningshowcarrell

Apple Decided Not to Buy Reese Witherspoon's 'Hello Sunshine' Media Company

Monday August 2, 2021 2:02 pm PDT by
Reese Witherspoon's media company "Hello Sunshine" recently courted various buyers, and while Apple was one of parties interested in buying Hello Sunshine, the Cupertino company did not end up going through with the purchase. Hello Sunshine was valued at around $900 million thanks to its involvement in popular series like The Morning Show," "Big Little Lies," and "Little Fires Everywhere,"...
COVID19 Digital Wallet Apple Wallet

Australian Government Now Offering COVID-19 Digital Vaccination Certificates for Apple Wallet

Monday August 2, 2021 12:04 am PDT by
The Australian government has introduced support for adding COVID-19 vaccination digital certificates to Apple Wallet via the Express Plus Medicare app on iOS. Image credit: Tap Down Under As spotted by Tap Down Under, users who have received two doses of either the AstraZeneca or Pfizer vaccine now have access to the digital certificate through their Medicare online account or via the Medica...
mac pro new graphics

Apple Introduces New High-End Graphics Options for Mac Pro

Tuesday August 3, 2021 7:34 am PDT by
Apple today began offering new high-end graphics upgrade options for both the tower and rack versions of the Mac Pro desktop computer. This comes on the same day that Apple started selling the Magic Keyboard with Touch ID on a standalone basis. As noted by CNN Underscored's Jake Krol, the Mac Pro can now be configured with new AMD Radeon Pro W6800X, W6800X Duo, or W6900X graphics when...