It targets the Zoom installer, which the company uses to enable frictionless automatic updates. The application also creates two plist files in ~/Library/Preferences, namely us. by an independent security researcher, Patrick Wardle – whose brother Jeremy invented the popular game Wordle – the vulnerability was first presented at the Def Con hacking conference in Las Vegas last week. That's all the installer does, but when the .app application is first executed, it also creates the folder ~/Library/Application Support/, which holds a database and also a copy of the retina version of the graphics bundle.

On Mac OS X 10.9 and earlier, with the older .app that presumably had the KEXT in it, the KEXT would be copied to the ~/Library/Application Support//Plugins, which it alarmingly makes writable by the 'staff' group - so you'd have been loading a KEXT from a directory in your home folder that is writable to other people on the machine(!!) Perplexingly, this file doesn't actually seem to exist in the current .app iteration (it looks like it has been replaced with a userland audio driver instead).

If you are on macOS 10.10 or above, the script will delete the file 'ZoomAudioDevice.kext' from the .app bundle. If run by an administrator, the script also executes a script as root to change the ownership of .app to root:admin. It also adds Zoom to your Dock automatically, without asking.īizarrely, .app is installed by unzipping a 7-zip archive, then unzipping another 7-zip archive containing graphics and copying that inside the Frameworks folder in the .app bundle.

If they are an administrator, Zoom will delete the ugin from /Library if it's there, but it still installs to ~/Library. If the user opening the package isn't an administrator, it looks like it will install the app in the user's home folder instead. The script appears to install two items, namely: /Applications/.app That's bonkers, and also means that the system won't have a list of the files it installed, because it's doing it using shell script. Rather than actually using the installer to install things, it does everything in the preinstall script. The Zoom install package for macOS is mad.

Zoom app for mac