Apple Pushes Another Automatic Mac Software Update to Address Further Zoom-Related Vulnerabilities

by

Apple today pushed a second silent security update to Macs to address further vulnerabilities related to the Zoom video conferencing app for macOS, reports The Verge.

Apple removed software that was installed by RingCentral and Zhumu, two video conferencing apps that relied on technology from Zoom and were also found to have the same vulnerabilities as Zoom earlier this week.

zoom logo
These two apps installed software able to respond to commands that could potentially allow websites to open up your webcam during a video conference without permission. Removing the apps did not remove the secondary software that was vulnerable to exploitation, which is also how Zoom worked.

Discovered last week, the Zoom vulnerability let a website forcibly initiate a video call on a Mac with the Zoom app installed, due to a web server that Zoom installed in the background.

When the vulnerability was first discovered, Zoom said that it used a local web server as a workaround to Safari changes that Apple introduced in Safari 12, calling it a "legitimate solution" to an otherwise "poor user experience" that allowed users to access "seamless, one-click-to-join meetings."

At issue was a new popup Apple implemented to require user approval when launching a third-party app, which Zoom wanted to avoid. Zoom did so through the aforementioned web server, which was designed to wait for calls to open up Zoom conferences automatically.

Zoom eventually released a patch to address the issue, and Apple also took the step of removing web server software that was not initially removed from the Mac when uninstalling the Zoom app. Zoom has since made it so uninstalling the Zoom app will remove the web server, and has made other changes.

Installing Zoom no longer installs a local web server on Mac devices, and there is a new setting to save the "Always turn off my video" preference that disables video in Zoom by default until it is manually enabled.

As with the original Zoom patch, the new patch for RingCentral and Zhumu is deployed automatically so that users are not required to apply it manually for it to take effect. Apple told The Verge that it plans to fix the vulnerability for all of Zoom's partner apps.

Tag: Zoom

Popular Stories

space black mbp

Apple Potentially Facing Worst Leak Since iPhone 4 Was Left in a Bar

Monday October 7, 2024 3:03 pm PDT by
Alleged photos and videos of an unannounced 14-inch MacBook Pro with an M4 chip continue to surface on social media, in what could be the worst product leak for Apple since an employee accidentally left an iPhone 4 prototype at a bar in California in 2010. The latest video of what could be a next-generation MacBook Pro was shared on YouTube Shorts today by Russian channel Romancev768, just...
Read Full Article • 170 comments
Alleged M4 MacBook Pro Leak Video

Alleged M4 MacBook Pro Unboxing Video Reveals These Four Upgrades

Sunday October 6, 2024 6:10 pm PDT by
An alleged unboxing video for an unannounced 14-inch MacBook Pro with the M4 chip was uploaded to YouTube today by Russian channel Wylsacom. The video was later linked to on social media platform X by Bloomberg's Mark Gurman. It is possible that this is the same MacBook Pro box shown in photos that were shared by leaker ShrimpApplePro in late September, as he claimed that this MacBook Pro...
Read Full Article • 287 comments
watchos 11 vitals

Apple Watch Users Report Vitals App Detecting Illness Before Symptoms Appear

Monday October 7, 2024 5:34 am PDT by
Apple's new Vitals app for watchOS 11 appears to be impressing some users with its ability to detect potential illness days before symptoms manifest, according to recent reports on Reddit. The Apple Watch app, which analyzes key health metrics measured during sleep over the last seven days, appears to be providing early warnings of impending sickness for at least some Apple Watch wearers...
Read Full Article • 93 comments
iPad mini review thumb

iPad Mini 7 Coming Next Month: What to Expect

Tuesday October 8, 2024 6:16 am PDT by
Rumors strongly suggest Apple will release the seventh-generation iPad mini in November, nearly three years after the last refresh. Here's a roundup of what we're expecting from the next version of Apple's small form factor tablet, based on the latest rumors and reports. Design and Display The new iPad mini is likely to retain its compact 8.3-inch display and overall design introduced with...
Read Full Article • 110 comments
iPhone 17 Slim Feature Single Camera 2

10 Reasons to Wait for Next Year's iPhone 17

Tuesday October 8, 2024 5:45 am PDT by
Apple's iPhone development roadmap runs several years into the future and the company is continually working with suppliers on several successive iPhone models simultaneously, which is why we sometimes get rumored feature leaks so far ahead of launch. The iPhone 17 series is no different – already we have some idea of what to expect from Apple's 2025 smartphone lineup. If you plan to skip...
Read Full Article • 299 comments
Generic iOS 18

Everything New in iOS 18.1 Beta 6

Monday October 7, 2024 4:27 pm PDT by
We're nearing the end of the iOS 18.1 beta testing process, but Apple is continuing to make tweaks to refine built-in features ahead of when the software launches. With testing winding down, there are fewer new additions, but Apple has made changes worth noting. The new beta is available for both developers and public beta testers. Control Center In the Control Center, Apple has added new...
Read Full Article • 44 comments
M4 Real Feature Red

Gurman: Apple to Launch First M4 Macs and Potentially iPad Mini 7 on November 1

Sunday October 6, 2024 6:40 am PDT by
Apple will announce several new M4 Mac models around the end of October, with the company planning to launch at least some of them as soon as Friday, November 1, according to Bloomberg's Mark Gurman. Writing in his latest Power On newsletter, Gurman said that Apple will launch a new M4 version of its low-end 14-inch MacBook Pro, as well as higher-end 14-inch and 16-inch MacBook Pro models...
Read Full Article • 141 comments
apple tv 4k yellow bg feature

Waiting for a New Apple TV? Here's What the Latest Rumors Say

Tuesday October 8, 2024 8:57 am PDT by
The current Apple TV was released two years ago this month, so you may be wondering when the next model will be released. Below, we recap rumors about a next-generation Apple TV. In January 2023, Bloomberg's Mark Gurman reported that a new Apple TV was planned for release in the first half of 2024:Beyond the future smart displays and new speaker, Apple is working on revamping its TV box....
Read Full Article • 104 comments

Top Rated Comments

BWhaler Avatar
BWhaler
68 months ago
NO

It was NOT discovered last week.

ZOOM was informed months ago, decided not to fix the patch because it would lower their value proposition and product strategy. Again, they chose to leave the security hole open for their business gain.

Two weeks ago was when the researcher got fed up and disclosed it to the public. Only then did Zoom jump into PR mode and fox the problem.

Apple, god bless them, learned of this and shut the exploit down. No point waiting for an unethical company. What else does Zoom know about they still haven’t disclosed?

MacRumors writers, do your job. Don’t let unethical companies spin or this behavior will never go away.
Score: 30 Votes (Like | Disagree)
arkmannj Avatar
arkmannj
68 months ago
Even if you discount the security issues... thanks companies for installing a 24x7 service consuming resources just to avoid a potential CLICK.

Good on Apple for pushing out the updates to help mitigate the stupidity of these companies.
Score: 14 Votes (Like | Disagree)
Westside guy Avatar
Westside guy
68 months ago
Any chance you’re willing to share your script? :) It’s a shame that you’d even need to make something like that, especially having to run regularly.
Here it is, warts and all (replace "{username1}, {username2}, etc. with actual user accounts of course).

* There should really be some error checking added to this, for example it shouldn't try to move the files if it's unable to create the "-unused" directories.
* Released under the "you break it, you get to keep both pieces" license


#!/bin/bash -f

#
# Cleans out all the cruft that Adobe, Microsoft, and Google try to hide
# in the Launch* directories. This script works from the command line, but
# it's mainly intended for use as a cron job.
#
# Needs to be run with sudo, or as root
#
#
# Changelog: Added Skype to the list 2018-12-03 TLS
#
# Initial script written 2018-08-15 TLS
#

if [ $USER != "root" ] ; then
echo "Error - needs to be run with root permissions (you are $USER). Please use sudo."
exit 1;
fi

DIRECTORY_LIST=(
"/Library/LaunchAgents"
"/Library/LaunchDaemons"
"/Users/{username1}/Library/LaunchAgents"
"/Users/{username2}/Library/LaunchAgents"
)
UNWANTED_LAUNCHERS_LIST=(
"com.adobe.*"
"com.citrix.*"
"com.google.*"
"com.lifescan.*"
"com.microsoft.*"
"com.skype.*"
)

for THIS_DIR in ${DIRECTORY_LIST* } ; do
if [ ! -d $THIS_DIR ] ; then
continue
fi
STORAGE_DIR="$THIS_DIR-unused"
if [ ! -d $STORAGE_DIR ] ; then
mkdir $STORAGE_DIR
fi
for THIS_GLOB in ${UNWANTED_LAUNCHERS_LIST* } ; do
find $THIS_DIR -maxdepth 1 -type f -iname $THIS_GLOB -exec mv \{\} $STORAGE_DIR \;
done
done
Score: 12 Votes (Like | Disagree)
Westside guy Avatar
Westside guy
68 months ago
Even if you discount the security issues... thanks companies for installing a 24x7 service consuming resources just to avoid a potential CLICK.
Yeah, this is a problem - even setting aside security concerns. All sorts of companies add superfluous scripts to our system's LaunchAgents and LaunchDaemons folders, usually for no good reason. Adobe, Citrix, Google, Microsoft, etc. Maybe each one doesn't normally chew up much memory, but the effect is cumulative... and sometimes those processes run away.

I actually have a "cleanup unwanted launchers" bash script running as a cron job on all my Macs. It runs each hour and moves the cruft any of these companies (and a couple others) placed into the various LaunchAgents and LaunchDaemons folders into LaunchAgents-unused and LaunchDaemons-unused, respectively.
Score: 8 Votes (Like | Disagree)
Kaibelf Avatar
Kaibelf
68 months ago
Automatic silent OS updates huh? Sounds like some Google privacy invading stuff to me.
Howso? By making sure people can NOT access your camera and mic without your knowledge in a way that was designed to sidestep basic OS protections, now it's invading your privacy?
Score: 7 Votes (Like | Disagree)
iGeneo Avatar
iGeneo
68 months ago
Good!

I have ZERO issue with these silent updates
Score: 7 Votes (Like | Disagree)
Read All Comments