You can add location information to your Tweets, such as your city or precise location, from the web and via third-party applications. You always have the option to delete your Tweet location history. Learn more
Ever wondered how the @zoom_us macOS installer does it’s job without you ever clicking install? Turns out they (ab)use preinstallation scripts, manually unpack the app using a bundled 7zip and install it to /Applications if the current user is in the admin group (no root needed).pic.twitter.com/qgQ1XdU11M
If the App is already installed but the current user is not admin, they use a helper tool called “zoomAutenticationTool” and the AuthorizationExecuteWithPrivileges API to spawn a password prompt identifying as “System” (!!) to gain root (including a typo).pic.twitter.com/gp9DVCoVCm
This is not strictly malicious but very shady and definitely leaves a bitter aftertaste. The application is installed without the user giving his final consent and a highly misleading prompt is used to gain root privileges. The same tricks that are being used by macOS malware.
I just published a more detailed blog post about this issue, giving some context and summarizing the security implicationshttps://www.vmray.com/cyber-security-blog/zoom-macos-installer-analysis-good-apps-behaving-badly/ …
Zoom released an updated which fixed the issues I foundhttps://twitter.com/c1truz_/status/1245767226499764225 …
Oh man we had the same thoughts today. You might appreciate this little detail too: https://twitter.com/cabel/status/1244788931427622912?s=21 …https://twitter.com/cabel/status/1244788931427622912 …
From what I can tell, this insane packaging technique has been used for at least a year. I find it somewhat hilarious how many people discovered it at the same time I did.
that’s naughty. The install to /applications part isn’t very special though, non admin users can install to /applications right (or maybe just through MAS?)? (and then can’t delete the app)
No, you will get an authentication prompt if you try to modify /Applications as non-admin. Not sure about MAS atm
Thank you for your feedback! We implemented to balance the number of clicks given the limitations of the standard technology. To join a meeting from a Mac is not easy, that is why this method is used by Zoom and others. Your point is well taken and we will continue to improve.
honest question: why not just distribute through the Mac App Store? (same goes for the Windows equivalent) people are increasingly learning not to trust "non store based" installers, and that's a good thing
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.
