Zoom Update Bypasses Security

Topic

New Reply

Greetings All-

I’m not sure if this is the right place to post this or not.  After downloading and installing the ZOOM teleconferencing software, I participated in a Zoom conference session.  After I exited the conference, there was a message on my desktop saying there was an update to the Zoom program.  I clicked on the install button and the program completed its update without any further intervention on my part.

This was done on a standard user account.  I was expecting at some point that I would be asked for the admin password. This did not happen.  Every other program I’ve updated demands a password at some point.  I don’t understand how this update was allowed to install without it.  It would seem that Zoom somehow managed to bypass normal Security measures.

Operating system is the latest version of WIN 10 Pro 1909.  Any insights would be appreciated.  Thanks.

Casey H.

1 user thanked author for this post.

jburk07

Reply | Quote

Replies

Casey H wrote:

It would seem that Zoom somehow managed to bypass normal Security measures.

Yes, it does.

See https://www.askwoody.com/forums/topic/patch-lady-should-we-be-concerned-about-zoom/#post-2232057

3 users thanked author for this post.

Mr. Austin, jburk07, Casey H

Reply | Quote

A lot of applications nowadays install into the user’s AppData folder to bypass the need for admin rights. I don’t know if it’s the case for Zoom (I’ve never used it) but definitely for Teams, and Chrome used to do it in its early days.

2 users thanked author for this post.

jburk07, Casey H

Reply | Quote

steeviebops wrote:

I don’t know if it’s the case for Zoom

It is. (For the Windows version at least.)

And somehow this is a “feature” that some people consider a good thing, too.

Linux version (checked .deb 64bit) does at least something right in that most of the stuff goes under /opt… and needs admin rights for installing … but then again it includes its own copies of lots of libraries in there, and with their track record I’m not particularly confident about the quality of those copies.

1 user thanked author for this post.

jburk07

Reply | Quote

Thanks all.  Interesting stuff.  I had been thinking that privacy issues weren’t an issue for my use.  Although our meeting content at times can be highly personal, it’s not really what you would call sensitive.  The ability to install stuff without my specific consent is another matter.  I think I’ll try something else.

Casey H.

Reply | Quote

if you download the web installer *.exe as it will allow updates (it used to auto update).  We deploy it with the *.msi to the AppData folder and adjust settings to prevent automatic/user involved updates.  This method supports CM.

1 user thanked author for this post.

Mr. Austin

Reply | Quote