Night mode is an automatic setting which takes advantage of the new wide-angle camera that's in the iPhone 11 and 11 Pro models. It's equipped with a larger sensor that is able to let in more light, allowing for brighter photos when the light is low.
macOS Catalina Now Available
Apple Pushes Automatic Mac Software Update to Remove Vulnerable Zoom Web Server
Earlier this week, a serious vulnerability with the Zoom video conferencing app for macOS was disclosed, with attackers potentially able to hijack users' webcams.
The vulnerability was particularly notable because Zoom had installed a hidden web server on users' computers in order to allow for automatic answering of incoming calls, and that web server was not only the weak point that could be exploited, but it also was not removed upon deletion of the app. As a result, users who had previously deleted Zoom might not even realize they were vulnerable to this potential attack.
After initially defending the decision to install a web server on users' machines to work around changes in Safari 12 that would have required users to click to accept incoming calls, Zoom later backtracked and released a patch to remove the web server from users' computers.
Apple has now taken things one step further and pushed out a silent macOS update that removes the web server, reports TechCrunch. The update is deployed automatically, so users don't have to manually apply it in order for it to take effect.
In a blog post, Zoom says it will take further action this weekend by automatically having first-time users who select "Always turn off my video" default to having video off for all future meetings. In addition, Zoom will be improving its bug bounty program and security-related issue escalation process.
The vulnerability was particularly notable because Zoom had installed a hidden web server on users' computers in order to allow for automatic answering of incoming calls, and that web server was not only the weak point that could be exploited, but it also was not removed upon deletion of the app. As a result, users who had previously deleted Zoom might not even realize they were vulnerable to this potential attack.
After initially defending the decision to install a web server on users' machines to work around changes in Safari 12 that would have required users to click to accept incoming calls, Zoom later backtracked and released a patch to remove the web server from users' computers.
Apple has now taken things one step further and pushed out a silent macOS update that removes the web server, reports TechCrunch. The update is deployed automatically, so users don't have to manually apply it in order for it to take effect.
Although Zoom released a fixed app version on Tuesday, Apple said its actions will protect users both past and present from the undocumented web server vulnerability without affecting or hindering the functionality of the Zoom app itself.Zoom told TechCrunch it was "happy to have worked with Apple on testing this update" and that it should resolve all issues with the web server.
The update will now prompt users if they want to open the app, whereas before it would open automatically.
In a blog post, Zoom says it will take further action this weekend by automatically having first-time users who select "Always turn off my video" default to having video off for all future meetings. In addition, Zoom will be improving its bug bounty program and security-related issue escalation process.
Tag: Zoom
[ 115 comments ]
Top Rated Comments
(View all)
15 weeks ago
Apple app aproval process fail.
Is it? I can't find the Zoom app in the Mac App Store. I think you have to download it from their website.
15 weeks ago
Apple app aproval process fail.
Well considering the app isn’t on the Mac App Store and you have you go on Zoom’s website to download and install it, this point is invalid.
15 weeks ago
Well considering the app isn’t on the Mac App Store and you have you go on Zoom’s website to download and install it, this point is invalid.
So, Apple can install an update (essentially any code) without user's approval or notification? Not good.
I'm not sure I'm comfortable with Apple pushing out silent updates. There should be an option to be notified about them (maybe there is and I'm not aware?). I do trust Apple, but I like to know what updates are coming my way.
I suggest you guys research XProtect. This has been on the Mac for many years and silently updates to prevent malware, like Zoom (that’s essentially what it is, no sugar coating it), from affecting user’s systems once it is found out. For legit developers, even third party, they can also revoke their certificate which means that most users won’t be able to open the app unless they change it to the most wide open setting, which I don’t believe is the default. Only shady companies don’t get signed certs through Apple. I guarantee you Apple threatened to revoke their certs which is why they had a sudden change of heart. Apple could have just nuked the app completely, and I think they have the right in their terms and conditions for the Xcode/macOS license agreement.
I love it when Apple does this. They keep developers in check, like they did recently with Facebook. They also have a protection mechanism built into iOS that can remotely wipe rogue apps off every person’s device in the world. They’re the only company with the balls to do it and the security and privacy mindset to pull it off. May security and privacy forever be their #1 goal. Seriously, bless those beautiful engineers. They’re far from perfect, but among the best there is.
15 weeks ago
Yes. Well done Apple. Very well done.
This is a disaster for Zoom. They had one of the best brands in the comms space, and they are destroying it with this “feature”’ which makes Macs vulnerable and then trying to pass this off like it’s no big deal. It’s breathtaking how tone deaf they are.
It’s despicable, and Zoom better act fast before they are dead to enterprises. No CIO/CTO will risk their career because a vendor has a slightly easier user experience.
This is company destroying stupidity and Zoom better act while they still can. Otherwise, they will be a business school case study of what not to do in a crisis.
This is a disaster for Zoom. They had one of the best brands in the comms space, and they are destroying it with this “feature”’ which makes Macs vulnerable and then trying to pass this off like it’s no big deal. It’s breathtaking how tone deaf they are.
It’s despicable, and Zoom better act fast before they are dead to enterprises. No CIO/CTO will risk their career because a vendor has a slightly easier user experience.
This is company destroying stupidity and Zoom better act while they still can. Otherwise, they will be a business school case study of what not to do in a crisis.
15 weeks ago
Apple has now taken things one step further and pushed out a silent macOS update that removes the web server, reports TechCrunch ('https://techcrunch.com/2019/07/10/apple-silent-update-zoom-app/'). The update is deployed automatically, so users don't have to manually apply it in order for it to take effect.
So, Apple can install an update (essentially any code) without user's approval or notification? Not good.
15 weeks ago
So, Apple can install an update (essentially any code) without user's approval or notification? Not good.
This is absolutely not what XProtect is - what is updated is a list of application definitions that the previous quarantine system can use to prevent malicious software from running. There is literally no code being installed in this process.
15 weeks ago
This month it's Zoom. Next month it's someone else. To paraphrase John Adams, our principle should be to trust no man living with power. To believe otherwise - to believe that any particular party is capable of doing no wrong - is to be deluded, or worse.
Quite right. As much as I might appreciate Apple "looking out" for its users, I would much rather suffer the odds that something happens to my machine - I consider myself a rather intelligent person, anyhow - than be beholden to the mothership. As with our governments' security apparati, it may be benevolent for a time, but once the system is in place, all it takes is a proverbial "flip of the switch."
As already pointed out a number of times in the thread there was no code deployed. Absolutely no-one (sane) looks through their anti-virus update definitions to see which malware they'd like to keep running. Trying to imply a slippery slope for a timely and successful removal of dangerous software is laughable.
15 weeks ago
Absolutely shocking practice from Zoom. How dare they. Good on Apple for moving on this.
This is the kind of practice that seperates Mac from Windows.
This is the kind of practice that seperates Mac from Windows.
15 weeks ago
I'm not sure I'm comfortable with Apple pushing out silent updates. There should be an option to be notified about them (maybe there is and I'm not aware?). I do trust Apple, but I like to know what updates are coming my way.
My guess (and it is a guess, since I can't find details here or on techcrunch) would be that this was an update to Xprotect signatures. I don't think people generally review every signature update to antivirus software.
15 weeks ago
I'm not sure I'm comfortable with Apple pushing out silent updates. There should be an option to be notified about them (maybe there is and I'm not aware?). I do trust Apple, but I like to know what updates are coming my way.
[ Read All Comments ]
This week saw a new addition to Apple's Beats headphones lineup, while Apple appears to have leaked images of its upcoming 16-inch MacBook Pro in the new macOS 10.15.1 betas.
Other top...
For this week's giveaway, we've teamed up with Plex to offer MacRumors readers a chance to win a cord-cutting bundle that includes a lifetime Plex Pass, an antenna, and a TV tuner for...
Google Maps for iOS is gaining a new feature today that's designed to allow people to report crashes, speed traps, and traffic slowdowns right from their iPhones.
Reporting traffic accidents...
Apple this week introduced Beats Studio3 Wireless Headphones in a new Camo Collection, available in either Forest Green or Sand Dune.
The Beats Studio3 Wireless Headphones in the Camo Collection...
Apple Arcade gained a batch of new games today for the iPhone, iPad, Apple TV, and Mac.
The latest titles available include real-time player-versus-player baseball game "Ballistic...
Apple today sent out emails for a new Apple Pay promotion, offering a $5 discount on groceries when you spend $35 or more through Instacart. To get the discount, you'll need to use Apple...
Luna Display today introduced a new Mac-to-Mac mode that allows any Mac released within the last decade to be used as a second display for another Mac. This includes any combination of Macs, ranging...
Apple has released a third trailer for the upcoming comedy series "Dickinson" ahead of its November 1 premiere on Apple TV+.
Dickinson is a half-hour comedy series starring...
