Source: @c1truz
What you need to know
- A malware expert has revealed that video-conferencing app Zoom has "very shady" installation protocols.
- Zoom uses preinstallation scripts to bypass macOS security.
- The finder notes that it's the same trick being used by macOS malware.
In another damning indictment on Zoom's privacy and security practices, a malware expert has revealed that Zoom's macOS installation protocol is "very shady".
In a tweet posted March 30, Twitter user @c1truz_ stated:
Ever wondered how the @zoom_us macOS installer does it's job without you ever clicking install? Turns out they (ab)use preinstallation scripts, manually unpack the app using a bundled 7zip and install it to /Applications if the current user is in the admin group (no root needed).
This is not strictly malicious but very shady and definitely leaves a bitter aftertaste. The application is installed without the user giving his final consent and a highly misleading prompt is used to gain root privileges. The same tricks that are being used by macOS malware.
The revelation is another mark of Zoom's apparently lax privacy and security practices. The app has risen to prominence following global lockdown and social-distancing measures that have forced many organizations to resort to remote working. Last week it emerged that Zoom was sending data to Facebook even if users didn't have a Facebook account, a problem that has now been fixed.
More recently, it emerged that Zoom calls are not end-to-end encrypted despite claims to the contrary. From that report:
In several instances within Zoom's security white paper, it mentions E2E encryption, and when you enable E2E, you can hover over the green padlock in the top left corner of a meeting and see the popup "Zoom is using an end to end encrypted connection." However, The Intercept claims that when it reached out to Zoom for comment a spokesperson stated:
"Currently, it is not possible to enable E2E encryption for Zoom video meetings. Zoom video meetings use a combination of TCP and UDP. TCP connections are made using TLS and UDP connections are encrypted with AES using a key negotiated over a TLS connection."
'South of the Circle,' a narrative adventure, coming soon to Apple Arcade
The game, a "narrative adventure game about memory, survival, and the consequences of not dealing with the past," launches soon.
Apple Card users can see their annual spending with iOS 14.2 beta 2
Apple Card users with iOS 14.2 beta 2 installed have noticed that they can now see their annual spending for the first time.
You can use a Wii Nunchuck to play iPhone games. But you shouldn't.
The sheer number of things that you can plug into an iPhone will never cease to amaze. But did you ever expect someone to play iPhone games with a Wii Nunchuck?
Automate your home with the best HomeKit smart plugs around
If you're new to home automation, a smart plug is a great first step in building out your connected home with its simple plug and play design. Here's our guide to the best smart plugs for HomeKit that you can buy.