“We have already resolved these security issues,” a Zoom spokesperson told WIRED in a statement. In other words, Wardle found that he could change the name of the software he was trying to sneak through to contain the markers Zoom was broadly looking for and get the malicious package past Zoom’s signature check. Zoom’s signature check was essentially looking at everything on the table and accepting the random birthday card signature instead of actually checking whether the signature was in the right place on the right document. Imagine that you carefully sign a legal document and then put the piece of paper facedown on a table next to a birthday card that you signed more casually for your sister. Ultimately, he realized that Zoom’s check could be defeated. (It’s a sort of wax-seal check to confirm the integrity and provenance of software.) Wardle knew from past research and his own software development that it can be difficult to truly validate signatures in the types of conditions Zoom had set up. UserAgent='Mozilla/5.0 (Macintosh Intel Mac OS X $Įxit code it does work but I would like to ad PackageRecommend into the mix so the user's can toggle it after the no facebook settings.The first vulnerability Wardle found, though, was in the cryptographic signature check. # Set the User Agent string for use with curl

OSvers_URL=$( sw_vers -productVersion | sed 's//_/g' ) # Get OS version and adjust for use with the URL string Logfile='/Library/Logs/ZoomInstallScript.log'

# CHECK TO SEE IF A VALUE WAS PASSED IN PARAMETER 1 AND, IF SO, ASSIGN TO 'lang' # (Adapted from the FirefoxInstall.sh script by Joe Farage, ) # ZoomInstall.sh - Installs or updates Zoom Adapted it a little from original to quit out of zoom if it is open.

Zoom install mac os