Apple rolls out a silent Mac update that removes Zoom’s local web server

sotck photo of Macbook Pro
A security researcher recently discovered that the Zoom app has a pretty troubling security flaw for those who use the app on Macs. According to a Medium post published on Monday, July 8, by security researcher Jonathan Leitschuh, the Mac version of the Zoom app has a vulnerability that lets websites launch video calls (and turn on your webcam) without your permission.
But as of Wednesday, July 10, Apple decided to address Zoom’s security issue with a solution of its own: A silent Mac update that removes a problematic localhost web server that comes with the Mac version of the popular video conferencing app, TechCrunch reports.
Zoom is well-known and used by countless companies precisely because of its ease of use. (Users can join video calls with just a shared link and a click.) But it turns out that that particular easy-to-use feature is the source of the vulnerability. According to Leitschuh’s post, the installation of the Zoom client for Mac doesn’t just come with the video calling app itself; it also comes with a localhost web server that is also installed. This local server is what allows Mac users to have one-click access to a Zoom video call. But as Leitschuh notes, the local server feature “really hadn’t been implemented securely.”
In fact, the server is so vulnerable that it allows other, potentially malicious websites, access to Mac webcams to “forcibly join a user to a Zoom call” and turn on their webcams without permission. In addition, the server’s security flaw (for older versions of Zoom) also would have let websites complete a DoS (Denial of Service) attack on Macs “by repeatedly joining a user to an invalid call.” Leitschuh also noted that the DoS security flaw was patched in version 4.4.2 of the Zoom client.
Users can’t just uninstall Zoom to fix the problem either. Leitschuh’s report also mentioned that the local web server stays on your Mac even after uninstalling Zoom. Plus, that server can still reinstall Zoom without your permission. And it appears, at least according to Leitschuh’s version of events, that Zoom, while aware of the flaw, hadn’t fully fixed the security issue at the time.
Zoom initially said it wouldn’t fix the issue, but eventually said it would release a patch Tuesday that would eliminate the bug, according to Wired.
Despite Zoom’s newly released patch, Apple has now provided its own fix for Zoom’s webcam security issue. According to TechCrunch, the (automatic) silent Mac update is expected to remove the local server that had been installed along with Zoom’s video conferencing app. The silent update will also contain a feature that asks Mac users if they want to open the Zoom app, instead of just opening the app automatically.
Apple shed a little light on the reasoning behind the creation of this silent Mac update and telling TechCrunch that the update was intended to help protect past and present users of the Zoom app for Mac from the app’s vulnerability while preserving the functionality of the app.
Updated on July 11, 2019: Apple released a Mac update that removes Zoom’s local web server.

Comments

Post a Comment

Popular posts from this blog

Linktree’s free workaround lets you add multiple links to your Instagram bio

Image
Instagram only gives you one opportunity to link to outside resources inside its photo sharing platform. This might not be a problem for a majority of the users, but for those wanting a little more customization and even more options, it leaves much to be desired. Enter  Linktree , a free tool for Instagram designed to improve traffic to your outside link, be it a blog, portfolio, or store. How it works is fairly straightforward. After connecting Linktree to your Instagram profile, you’ll receive a single link to place in your Instagram bio. Once that link in place, you can customize what it’s linked to within your browser, be it a single website, or a collection of sites you’re looking to direct followers to Say you’re a photographer who’s using Instagram as a marketing tool for your wedding photography. Using Linktree, you can direct Instagram followers to your blog, your portfolio site, and even your other social media accounts. Until now, you would’ve been stuck c...
Read more

EVERYTHING WE KNOW ABOUT THE PIXEL 4, THE MOST-LEAKED PHONE EVER

Image
Google’s  Pixel 3 might have been the  most-leaked phone in history . Long before its unveiling, we knew practically everything about it from unboxing videos, photo comparisons, even a full review of the device. Surely, for the Pixel 4, Google would clamp down on leaks to leave some surprises for its debut on  October 15th , right? Let’s just say, if that was the plan, it didn’t exactly work out. We’ve now seen the Pixel 4 XL from every angle and in three different colors. At least seven different sources have touched this phone, many of them confirming the same specs. We not only know which cameras it’ll have, but also what they may be capable of, including air gestures (go figure). That doesn’t even count information Google has already shared  on purpose. So if you want to know almost everything about the Pixel 4 nearly a month before it’s announced, buckle up. We’ve sifted through all of the rumors and information we can find to compile everything we know —...
Read more

Stable Android 10 starts hitting the Galaxy Note10 and Note10+ (Update: Canada)

Image
UPDATE  1 : 2019/12/16 4:35AM PST Previous rollouts UPDATE  2 : 2020/01/06 2:15AM PST Canada Two weeks after the  Galaxy S10 line received its stable One UI 2.0 build , it’s time for the Galaxy Note10 and Note10+ to get the latest Android flavor. According to a report by  SamMobile , the two late-2019 Samsung flagships are receiving the Android 10 update in Germany, although the rollout is limited to a small group of beta testers. This stable release follows a  five-round beta testing  that concluded just a couple of days ago. Samsung is rolling out the stable build only to its beta testers in Germany to possibly look out for any major bug. Besides SamMobile, the confirmation also comes from  some Redditors  who got the update in Germany just a few hours back. The same Reddit users also mention that Google Pay remains broken even after installing this final Android 10 firmware, although it wasn’t immediately clear how widespread t...
Read more