The Zoom installer let a researcher hack his way to root access on macOS (theverge.com)

Article summary

A security researcher has found a vulnerability in the Zoom installer for macOS that could allow an attacker to gain root access to the system. The vulnerability is due to a bug in the installer's auto-update function, which can be exploited to run malicious code with elevated privileges. Zoom has issued a patch, but the researcher says it is incomplete and the vulnerability is still exploitable. The researcher reported the vulnerability to Zoom in December, but the company took several months to issue a fix.

Main themes

• Zoom security vulnerability
• macOS security
• auto-update risks
• root access exploitation
• Secure Enclave and YubiKey
• SSH key management
• Company security response
• System Integrity Protection

What commenters say

• The vulnerability is a result of a trivial mistake in the cryptography check, which is inexcusable for a company like Zoom.
• The delay in fixing the vulnerability is a sign of carelessness or incompetence on the part of Zoom.
• Even with root access, an attacker's abilities are limited on modern macOS systems with System Integrity Protection enabled.
• Storing sensitive data like SSH keys in a secure location, such as a YubiKey or the Mac's Secure Enclave, can help mitigate the risk of unauthorized access.
• A password-protected SSH key can provide some protection against an attacker with access to the user's .ssh directory.
• The vulnerability highlights the need for companies to prioritize security and respond quickly to reported vulnerabilities.
• The use of auto-updaters can introduce security risks if not properly implemented and validated.
• Some commenters believe that the vulnerability is likely a result of intentional design or negligence rather than an accidental mistake.