Apple Pushes Another Automatic Mac Software Update to Address Further Zoom-Related Vulnerabilities

Apple today pushed a second silent security update to Macs to address further vulnerabilities related to the Zoom video conferencing app for macOS, reports The Verge.

Apple removed software that was installed by RingCentral and Zhumu, two video conferencing apps that relied on technology from Zoom and were also found to have the same vulnerabilities as Zoom earlier this week.


These two apps installed software able to respond to commands that could potentially allow websites to open up your webcam during a video conference without permission. Removing the apps did not remove the secondary software that was vulnerable to exploitation, which is also how Zoom worked.

Discovered last week, the Zoom vulnerability let a website forcibly initiate a video call on a Mac with the Zoom app installed, due to a web server that Zoom installed in the background.

When the vulnerability was first discovered, Zoom said that it used a local web server as a workaround to Safari changes that Apple introduced in Safari 12, calling it a "legitimate solution" to an otherwise "poor user experience" that allowed users to access "seamless, one-click-to-join meetings."

At issue was a new popup Apple implemented to require user approval when launching a third-party app, which Zoom wanted to avoid. Zoom did so through the aforementioned web server, which was designed to wait for calls to open up Zoom conferences automatically.

Zoom eventually released a patch to address the issue, and Apple also took the step of removing web server software that was not initially removed from the Mac when uninstalling the Zoom app. Zoom has since made it so uninstalling the Zoom app will remove the web server, and has made other changes.

Installing Zoom no longer installs a local web server on Mac devices, and there is a new setting to save the "Always turn off my video" preference that disables video in Zoom by default until it is manually enabled.

As with the original Zoom patch, the new patch for RingCentral and Zhumu is deployed automatically so that users are not required to apply it manually for it to take effect. Apple told The Verge that it plans to fix the vulnerability for all of Zoom's partner apps.

Tag: Zoom

Top Rated Comments

(View all)
Avatar
16 months ago
NO

It was NOT discovered last week.

ZOOM was informed months ago, decided not to fix the patch because it would lower their value proposition and product strategy. Again, they chose to leave the security hole open for their business gain.

Two weeks ago was when the researcher got fed up and disclosed it to the public. Only then did Zoom jump into PR mode and fox the problem.

Apple, god bless them, learned of this and shut the exploit down. No point waiting for an unethical company. What else does Zoom know about they still haven’t disclosed?

MacRumors writers, do your job. Don’t let unethical companies spin or this behavior will never go away.
Score: 28 Votes (Like | Disagree)
Avatar
16 months ago
Even if you discount the security issues... thanks companies for installing a 24x7 service consuming resources just to avoid a potential CLICK.

Good on Apple for pushing out the updates to help mitigate the stupidity of these companies.
Score: 13 Votes (Like | Disagree)
Avatar
16 months ago

Any chance you’re willing to share your script? :) It’s a shame that you’d even need to make something like that, especially having to run regularly.

Here it is, warts and all (replace "{username1}, {username2}, etc. with actual user accounts of course).

* There should really be some error checking added to this, for example it shouldn't try to move the files if it's unable to create the "-unused" directories.
* Released under the "you break it, you get to keep both pieces" license


#!/bin/bash -f

#
# Cleans out all the cruft that Adobe, Microsoft, and Google try to hide
# in the Launch* directories. This script works from the command line, but
# it's mainly intended for use as a cron job.
#
# Needs to be run with sudo, or as root
#
#
# Changelog: Added Skype to the list 2018-12-03 TLS
#
# Initial script written 2018-08-15 TLS
#

if [ $USER != "root" ] ; then
echo "Error - needs to be run with root permissions (you are $USER). Please use sudo."
exit 1;
fi

DIRECTORY_LIST=(
"/Library/LaunchAgents"
"/Library/LaunchDaemons"
"/Users/{username1}/Library/LaunchAgents"
"/Users/{username2}/Library/LaunchAgents"
)
UNWANTED_LAUNCHERS_LIST=(
"com.adobe.*"
"com.citrix.*"
"com.google.*"
"com.lifescan.*"
"com.microsoft.*"
"com.skype.*"
)

for THIS_DIR in ${DIRECTORY_LIST* } ; do
if [ ! -d $THIS_DIR ] ; then
continue
fi
STORAGE_DIR="$THIS_DIR-unused"
if [ ! -d $STORAGE_DIR ] ; then
mkdir $STORAGE_DIR
fi
for THIS_GLOB in ${UNWANTED_LAUNCHERS_LIST* } ; do
find $THIS_DIR -maxdepth 1 -type f -iname $THIS_GLOB -exec mv \{\} $STORAGE_DIR \;
done
done
Score: 12 Votes (Like | Disagree)
Avatar
16 months ago

Even if you discount the security issues... thanks companies for installing a 24x7 service consuming resources just to avoid a potential CLICK.

Yeah, this is a problem - even setting aside security concerns. All sorts of companies add superfluous scripts to our system's LaunchAgents and LaunchDaemons folders, usually for no good reason. Adobe, Citrix, Google, Microsoft, etc. Maybe each one doesn't normally chew up much memory, but the effect is cumulative... and sometimes those processes run away.

I actually have a "cleanup unwanted launchers" bash script running as a cron job on all my Macs. It runs each hour and moves the cruft any of these companies (and a couple others) placed into the various LaunchAgents and LaunchDaemons folders into LaunchAgents-unused and LaunchDaemons-unused, respectively.
Score: 8 Votes (Like | Disagree)
Avatar
16 months ago
Good!

I have ZERO issue with these silent updates
Score: 7 Votes (Like | Disagree)
Avatar
16 months ago

Regardless of what security implications it resolves, I 100% want to be in charge of my computer. I want to see it in an update fix that I can choose to install, if I so choose. I vehemently disagree with the idea I can get updates pushed without my consent. How can you trust a company that much it can actually do that? If any other software did that on your computer, you would be ups and arms about it. Why does Apple get a free pass then?

You ARE 100% in charge of your computer. Apple do not need a free pass, because Apple have already given you what you want.

If you don’t want Apple to automatically install security updates, simply go to System Preferences : Software Updates : Advanced and uncheck the box to automatically “Install system data files and security updates.” Apple have provided users with this choice for several years.
Score: 6 Votes (Like | Disagree)

Top Stories

Leaker: 'iPhone 12 mini' and iPhone 12 Storage Capacities Start at 64GB, Pro Models at 128GB

Tuesday September 29, 2020 2:31 am PDT by
Rumors suggest Apple's iPhone 12 launch event will be held on October 13, with the more affordable 5.4 and 6.1-inch devices set to ship out ahead of the more expensive 6.1-inch and 6.7-inch Pro devices, and this morning hit-and-miss leaker Jon Prosser has further committed to that date by providing alleged details on Apple's first shipment of finalized iPhone 12 units. Prosser claims the...

Hands-On With iOS 14.2's New Shazam Music Recognition Toggle in Control Center

Monday September 28, 2020 2:35 pm PDT by
Shortly after launching iOS 14, Apple introduced an upcoming iOS 14.2 update, which is now available to developers and public beta testers ahead of a public release that could come at some point in October. Subscribe to the MacRumors YouTube channel for more videos. The iOS 14.2 update mainly focuses on the Control Center, introducing a new Music Recognition toggle that deepens the Shazam...

Top Stories: iOS 14 Feature Tour, 'iPhone 12 mini' Rumors, Apple Watch Band Controversy

Saturday September 26, 2020 6:00 am PDT by
Things started to calm down a bit this week following last week's rush of media event, Apple Watch and iPad launches, and the release of iOS 14 and other operating updates. But that doesn't mean there wasn't still a lot of news, from digging deeper into iOS 14 to more iPhone 12 rumors to the uproar over trying to exchange band sizes on the new Apple Watch. On top of all of that, we heard...

DigiTimes: 12.9-inch Mini-LED iPad Pro Arriving Early 2021, Mini-LED MacBook Coming Later

Tuesday September 29, 2020 4:18 am PDT by
Apple will launch a 12.9-inch mini LED-backlit iPad Pro in early 2021 and a mini LED-backlit MacBook in the second-half of next year, according to DigiTimes. The Taiwan-based industry publication claims Epistar will supply the over-10,000 mini LEDs used in each iPad Pro tablet. Meanwhile, Apple is expected to recruit Osram Opto as another supplier of mini LEDs for use in a new "high-end"...

iPhone 12 May Launch Earlier Than Usual in South Korea

Monday September 28, 2020 5:24 am PDT by
The upcoming iPhone 12 lineup may launch earlier than usual in South Korea, reports The Korea Herald. South Korean telecoms firms speaking to The Korea Herald have said that the iPhone 12 lineup will launch ahead of its usual schedule. Normally, the release of new iPhones in South Korea comes about one month after launch in the United States. Last year, the iPhone 11 arrived in South Korea ...

iOS 14: 'Phoenix 2' Space Shooter Delivers Playable Demo via App Clips

Saturday September 26, 2020 2:08 pm PDT by
One of the new features that arrived in iOS 14 is called App Clips. App Clips is described by Apple to be a "small part of your app" that can be available to users at just the right moment.App Clips focus on finishing one task quickly. An ideal App Clip experience allows users to open and complete a task in seconds. Instead of requiring an App Store download, they can be loaded and run via...

Epic Games Unlikely to Win Injunction in Ongoing Fortnite Battle With Apple, Jury Trial Possible

Monday September 28, 2020 1:14 pm PDT by
The ongoing legal dispute between Apple and Epic Games continued on today, with a preliminary injunction hearing taking place this morning. We're still waiting to hear the judge's official ruling, but it looks like Epic is not going to be granted an injunction to allow Fortnite back into the App Store as the case unfolds. Many of the arguments that lawyers for Apple and Epic Games made were...

iPhone 12 Production Lines at Foxconn's Zhengzhou Factory in China Running '24 Hours a Day'

Tuesday September 29, 2020 3:38 am PDT by
Apple contract manufacturer Foxconn is running its massive Zhengzhou factory in China 24 hours a day to produce the new iPhone 12, according to Chinese media reports. Apple's main iPhone manufacturer in China is said to be cancelling workers' holidays and introducing mandatory overtime with additional bonuses for longer-serving staff, according to information garnered from employees,...

'iPhone 12 mini' Name Reappears in Leaked Apple iPhone 12 Case Stickers

Friday September 25, 2020 1:58 am PDT by
Earlier this week a proven leaker claimed that the iPhone 12 lineup would be named "iPhone 12 mini," "iPhone 12," "iPhone 12 Pro," and "iPhone 12 Pro Max," and today the same nomenclature has appeared again in a photo depicting alleged stickers from unreleased Silicone iPhone cases originating from Apple's international distribution center in Ireland. The photo shows three stickers with the...

Apple Releases iOS 14.0.1 With Fix for Bug That Resets Default Apps After Rebooting

Thursday September 24, 2020 10:12 am PDT by
Apple today released iOS 14.0.1, the first update to the iOS 14 operating system that was released on September 16. Today's update is a bug fix update addressing issues that weren't able to be fixed in the initial iOS 14 launch. The iOS 14.0.1 update is available on all eligible devices over-the-air in the Settings app. To access the new software, go to Settings > General > Software Update. ...