So the CVE-2020-11470 is back.<p>“This effectively disables code signature verification for its dynamic libraries and enables a code injection attack that Wardle calls "dylib proxying". It's not clear why Zoom uses this exception since its own libraries appear to be properly signed.”<p><a href="https://www.csoonline.com/article/3535789/weakness-in-zoom-for-macos-allows-local-attackers-to-hijack-camera-and-microphone.amp.html" rel="nofollow">https://www.csoonline.com/article/3535789/weakness-in-zoom-f...</a><p>Check latest pkg with Suspicious Package [0] analyzer.<p>[0] <a href="https://www.mothersruin.com/software/SuspiciousPackage/" rel="nofollow">https://www.mothersruin.com/software/SuspiciousPackage/</a>
Big thread the other day:<p><a href="https://news.ycombinator.com/item?id=32447339" rel="nofollow">https://news.ycombinator.com/item?id=32447339</a>
Copying back the removed comment:<p>“The appeal of injection a library into Zoom, revolves around its (user-granted) access to the mic and camera. Once our malicious library is loaded into Zoom’s process/address space, the library will automatically inherit any/all of Zooms access rights/permissions!<p>This means that if the user as given Zoom access to the mic and camera (a more than likely scenario), our injected library can equally access those devices.”<p><a href="https://objective-see.org/blog/blog_0x56.html" rel="nofollow">https://objective-see.org/blog/blog_0x56.html</a>
There's an even more ubiquitous app that also usually has mic and camera permissions and suffers from a similar (but technically unrelated) local code injection issue: Chrome. The bug is described here [0] and was closed as WontFix because "if your machine is compromised, it's beyond the scope of anything Chrome can do about it".<p>Even if you don't use Chrome, you probably have at least a few Electron apps installed; they all suffer from the same issue.<p>The only logical conclusion is the macOS privacy model, TCC, is doomed. There's always an app that has non-default TCC permissions and is vulnerable to some type of local code injection, and at that point any malicious app can also access those TCC-protected features.<p>[0] <a href="https://crbug.com/1300121" rel="nofollow">https://crbug.com/1300121</a>