Skip to main content

Zoom’s one-click installation on Mac was always too good to be true

With so many people stuck at home due to the coronavirus pandemic, videoconferencing app Zoom has become immensely popular.

For many people (ourselves included), its best feature on the Mac was its incredibly simple one-click installation. Now, that’s gone. And while that’s a good thing for us, it’s not great for Zoom.

Recommended Videos

The prerequirement script

As it turns out, Zoom was doing something rather shady during the installation process. As documented by Felix Seele, technical lead at tech security firm VMRay, Zoom’s installer was abusing the MacOS installation process to bypass user consent. In some cases, it was even masquerading as the operating system in order to trick the user. It’s not the first time Zoom has been caught doing something dubious, and comes hot on the heels of news that Zoom’s privacy policy is highly questionable, which led to the company freezing development until it can sort itself out.

Please enable Javascript to view this content

Here’s how the MacOS installation process normally works. You download the installer file — usually a DMG or PKG file — and double-click it to get started. In many cases, you’ll go straight to the installer, which presents a few pages giving you various installation options. Sometimes, though, you’ll see a dialog box explaining that the installer needs to determine if the app can run on your system. This is called a “prerequirement script.” Once it’s finished, the regular installation process begins.

Ever wondered how the @zoom_us macOS installer does it’s job without you ever clicking install? Turns out they (ab)use preinstallation scripts, manually unpack the app using a bundled 7zip and install it to /Applications if the current user is in the admin group (no root needed). pic.twitter.com/qgQ1XdU11M

— Felix (@c1truz_) March 30, 2020

Zoom’s installer abused this prerequirement script to bypass the regular installation process — and your consent. When Zoom told you it was running a prerequirement script and doing a few tests, it was actually installing the app without your knowledge. That’s what made the whole process so quick.

As Seele pointed out on Twitter, while this behavior is “not strictly malicious,” it is “very shady and definitely leaves a bitter aftertaste.” Apps that try to circumvent Apple’s processes and bypass user consent don’t exactly inspire confidence, after all.

But wait, there’s more

Zoom would adopt this shifty approach if it detected that you did not already have Zoom installed on your Mac. But if you did have it installed but didn’t have appropriate permissions to update it (say, if your Mac is part of your employer’s network and so has certain restrictions), Zoom would do something downright suspicious.

As Seele noted, in this situation, Zoom would launch something called “zoomAutenticationTool” (complete with typo), which was bundled into the PKG installer. This would spawn a prompt asking for the admin username and password.

However, not only did this make use of a deprecated (and notorious) API that was often abused to grant root privileges, but it did so by impersonating MacOS itself. Instead of being honest and telling the user that Zoom needed the admin password, the popup message would read: “System need your privilege to change” (again, with typos). The intention, apparently, was to trick the user into thinking their computer was asking for the password.

Needless to say, this is not exactly upright behavior. As Seele pointed out, it’s a tactic used by malware to fool people into installing things they shouldn’t. After he exposed these underhanded measures, Zoom apparently moved quickly to remove them. Try installing Zoom on a Mac now and you get the regular installation process.

On Windows? Zoom still has that one-click installer. While that’s great for convenience, given the debacle on Mac, we can’t help but wonder how long that will last.

Alex Blake
Alex Blake has been working with Digital Trends since 2019, where he spends most of his time writing about Mac computers…
Is the M4 Mac mini Apple’s first true gaming PC?
Mac Mini with M4

The M4 Mac mini made its big splash last week. Among the normal Apple marketing content, however, I noticed something I'd never seen before. It's the image above that I'm talking about -- and by now, you've probably noticed the same thing that caught my eye. The PS5 controller.

Sure, you've always been able to connect up a game controller and use it for Mac gaming, but never have I seen it promoted by Apple itself. By putting this so forward in the marketing materials, Apple is not-so-subtly implying that these are PCs that are at least to some degree built for gaming. Is this Apple's first true attempt at taking a real step into the world of PC gaming? There's more evidence than you might think.
Building momentum

Read more
One more year of the iMac Pro being missing in action
Apple iMac Pro News

This week, Apple announced a new M4 iMac. It got some upgrades that help make it more appealing to creatives and pros, such as the more powerful M4 chip, Thunderbolt 4, upgraded camera, and nano-texture display.

But an iMac Pro, this is not.

Read more
I tested the most popular free antivirus apps for Mac. Here are the very best
A MacBook Air is shown with the Bitdefender for Mac dashboard open.

The best free antivirus software for your Mac offers robust protection without breaking the bank. Although macOS was once an unlikely target for hackers, that's changing. As Apple computers become more popular, malware prevention is increasingly important to safeguard your personal and financial data.
Finding the best antivirus software can be challenging. While subscription prices are affordable, your budget might already be tight. Thankfully, there are several good, free malware solutions for macOS. Here are our top picks for free antivirus software for Mac, with each specially tailored to protect your Apple computer. If you use Windows, we also have a list of free antivirus software for PC.
Avast One Basic

While Avast One Basic is free and shows no ads, this powerful antivirus software still protects your Mac from malware infections, and blocks new threats before they become a problem. Perhaps more impressive is the Web Shield feature that identifies malicious downloads and prevents access to hazardous websites, halting phishing attempts and other online dangers.

Read more