←back to thread

How the Zoom macOS installer does its job without you clicking ‘install’

(twitter.com)
796 points _Microft | 3 comments | 31 Mar 20 11:41 UTC | HN request time: 0.001s | source
Show context
manigandham ◴[31 Mar 20 14:48 UTC] No.22738023[source]▶
1) If Zoom can do this then it's a MacOS security bug.

2) UX matters. Users don't care about the technical details, they want a smooth experience and that can be the difference between a billion-dollar business or a failed startup. And yes the desktop version is more stable than the web-based UI.

3) Malware is defined by what it does, not how it's installed.

replies(3): >>22738241 #>>22738342 #>>22741312 #
thaumasiotes ◴[31 Mar 20 19:15 UTC] No.22741312[source]▶
> 3) Malware is defined by what it does, not how it's installed.

Well, from the tweet thread:

> If the App is already installed but the current user is not admin, they use a helper tool called "zoomAutenticationTool" [sic] and the AuthorizationExecuteWithPrivileges API to spawn a password prompt identifying as "System" (!!) to gain root (including a typo).

replies(2): >>22743374 #>>22744950 #
1. manigandham ◴[31 Mar 20 22:23 UTC] No.22743374[source]▶
It's not malicious, and you have to give it permissions somehow to finish the install.

Dropbox (used to?) patch system files to integrate with Office better, and that wasn't considered malware either.

replies(2): >>22743442 #>>22744426 #
2. thaumasiotes ◴[31 Mar 20 22:30 UTC] No.22743442[source]▶
> It's not malicious

By the time you're lying to the user, you are malicious.

3. 9935c101ab17a66 ◴[01 Apr 20 00:36 UTC] No.22744426[source]▶
Malicious behaviour does not inherently make something malware. That said, The work arounds Dropbox used in the past should also be considered shady or malicious, and do not serve as a convincing defense in any way.

Yes, zoom does need the user’s password to complete the install in the scenario described. So why isn’t there a proper installer that behaves like installers on macOS should. Why do they ask for the users password on the behalf of ‘system’?

Oh, and zoom was just busted for sending user data to Facebook (regardless of whether or not you had a Facebook account and without disclosure AFAIK) so I reverse my previous statement. It is malware.