News for hackers. Stuff that matters.
Re:Ask HN: Why does Zoom Desktop examine all processes and a... by cranekam on Tuesday August 17, 2021 @05:41PM (#28215204)
There’s nothing in /proc/PID/cmdline etc that would definitely confirm an app has a GUI. The two concepts are at very different layers of the stack — to the OS the GUI is just another app on top of the kernel. Mayyyyyybe Zoom could be doing some crude pattern matching on process name or environment variables of a given process (though it’d only be able to read data of processes running as the same user) but it’s a long shot.

Personally I’d guess it is either some other library Zoom uses or some kind of debug info capturing system. But I don’t know work at Zoom so who knows.

Re:Ask HN: Why does Zoom Desktop examine all processes and a... by woodruffw on Tuesday August 17, 2021 @05:48PM (#28215260)
This is an unlikely stretch, but it looks like they're also attempting to read `/proc/PID/exe` -- they could be doing something (extremely) cursed like attempting to parse the program linkages and filtering by programs that link to `libX11`. But that's me straining to explain this in the context of the GP's hypothesis.
Re:Ask HN: Why does Zoom Desktop examine all processes and a... by dathinab on Tuesday August 17, 2021 @09:04PM (#28216616)
Why would you implement such a overly complex and unreliable thing when:

1. The windows manager can provide you with a list of open windows.

2. Screensharing including only sharing specific windows is a feature provided by the windows manager over standardized protocols.

3. Even knowing the processes which do have a GUI doesn't allow you to share that GUI, at least not without going through roughly the same mechanisms as mentioned in 2nd.

Re:Ask HN: Why does Zoom Desktop examine all processes and a... by stinos on Wednesday August 18, 2021 @04:41AM (#28218902)
The windows manager can provide you with a list of open windows.

But that needs a unified way for this across window managers, does that exist?

Re:Ask HN: Why does Zoom Desktop examine all processes and a... by account42 on Thursday August 19, 2021 @04:01AM (#28231478)
Re:Ask HN: Why does Zoom Desktop examine all processes and a... by numpad0 on Wednesday August 18, 2021 @05:14AM (#28219073)
I don’t know but xkill works across WM
Re:Ask HN: Why does Zoom Desktop examine all processes and a... by woodruffw on Tuesday August 17, 2021 @10:09PM (#28217064)
Hence “unlikely stretch.”
Re:Ask HN: Why does Zoom Desktop examine all processes and a... by inter_netuser on Wednesday August 18, 2021 @02:39AM (#28218268)
Let's just say the quiet part outloud: they sell that data.
Re:Ask HN: Why does Zoom Desktop examine all processes and a... by woodruffw on Wednesday August 18, 2021 @11:46AM (#28222902)
They probably don't. The list of programs running on a random Linux box probably isn't especially valuable.
Re:Ask HN: Why does Zoom Desktop examine all processes and a... by failuser on Wednesday August 18, 2021 @02:59PM (#28225676)
That machine can be in a Russian or Iranian nuclear physics or bioweapon lab and run very specific software. E.g. you can be looking for some project code names.
Re:Ask HN: Why does Zoom Desktop examine all processes and a... by woodruffw on Wednesday August 18, 2021 @05:30PM (#28227432)
Sure. But that's a very distinct task vs. the implication that Zoom is somehow making ad revenue off of Linux process names. The latter strikes me as not very likely because there's no money in it; the former is well outside of anything I feel qualified to opine on.
Re:Ask HN: Why does Zoom Desktop examine all processes and a... by inter_netuser on Wednesday August 18, 2021 @07:42PM (#28228623)
You'd be surprised about how weird things can get sometimes.

Here is a company that does censorship-resistant P2P networking...and also....Nuclear Material Detection?

Obviously very closely related things?

https://www.clostra.com/newnode-mesh-network https://www.clostra.com/nuclear-detection-snm

Re:Ask HN: Why does Zoom Desktop examine all processes and a... by Spooky23 on Friday August 20, 2021 @01:38PM (#28248972)
A company in my hometown makes parts for defense aerospace, the oil industry, private military contractors, and hyperscale data centers.

Are they spying on your Azure servers? Unlikely, they make hose reels and related round metal things.

Sometimes little (or big) companies like that get involved in weird lines of business because they buy other companies for the contracts.

Re:Ask HN: Why does Zoom Desktop examine all processes and a... by woodruffw on Wednesday August 18, 2021 @09:25PM (#28229307)
Looks like a defense contractor to me. If you pulled two random things out of my company's roster, you could probably spin an equally suspicious narrative.
Re:Ask HN: Why does Zoom Desktop examine all processes and a... by cranekam on Wednesday August 18, 2021 @07:18AM (#28219731)
Haha. What possible market is there for knowing which other binaries Zoom (desktop) users run? OMG Zoom users also run Chrome, cat, and init! That'll be $10k please.
Re:Ask HN: Why does Zoom Desktop examine all processes and a... by gmueckl on Tuesday August 17, 2021 @06:16PM (#28215452)
Nah, the readlink on exe looks like it's simply to query the real name of the executable, so that's pretty benign.
Re:Ask HN: Why does Zoom Desktop examine all processes and a... by nonameiguess on Tuesday August 17, 2021 @07:19PM (#28215900)
I believe they mean grab the absolute path to the real executable, run ldd against it, and parse that output to see if it links against libX11. That doesn't tell you a program is really using X11, though, as plenty have some sort of no-gui option to launch without a window. You can always cat /proc/{PID}/maps to see if libx11 is actually loaded into the process' address space, and just use readlink on exe to figure out the application name.

That's a really stupid way to figure out if a program has a window, though, compared to just using the X11 API directly.

Re:Ask HN: Why does Zoom Desktop examine all processes and a... by gmueckl on Tuesday August 17, 2021 @08:18PM (#28216320)
Do you have evidence of old being executed or similar? The posted strace log section is fairly benign and shows no hints of what you insinuate.
Re:Ask HN: Why does Zoom Desktop examine all processes and a... by nonameiguess on Wednesday August 18, 2021 @08:27AM (#28220159)
Nope, and I'm not going to run zoom to find out. To be perfectly clear, I'm not at all trying to say I have evidence that this is what zoom is actually doing. I'm trying to say I believe this is what the upper-level post was suggesting zoom is doing.
Re:Ask HN: Why does Zoom Desktop examine all processes and a... by woodruffw on Tuesday August 17, 2021 @10:17PM (#28217112)
You wouldn’t actually need to execute `ldd` to get this information: you could parse the ELF entirely in user space. That, in turn, wouldn’t show up in the `strace` logs, since there would be no syscalls. I think that’s extremely unlikely, but it’s certainly possible.
Re:Ask HN: Why does Zoom Desktop examine all processes and a... by IgorPartola on Wednesday August 18, 2021 @12:38AM (#28217831)
Reading the file would show up as syscalls.
Re:Ask HN: Why does Zoom Desktop examine all processes and a... by woodruffw on Wednesday August 18, 2021 @11:20AM (#28222385)
Sure, but you could minimize it to just two: the `open` that we already see here, and an `mmap` that maps the entire thing in. The rest could be in userspace (at least in terms of effects). We only have an excerpt of the syscall trace, so it's possible that happens.

But again: extraordinarily unlikely.

Re:Ask HN: Why does Zoom Desktop examine all processes and a... by thrower123 on Tuesday August 17, 2021 @06:01PM (#28215372)
Never attribute to malice what is adequately explained by laziness.

I can easily believe somebody just wrote a chunk of naive code that grabbed all the running processes, and it worked, and they moved on.

Re:Ask HN: Why does Zoom Desktop examine all processes and a... by MereInterest on Tuesday August 17, 2021 @07:18PM (#28215892)
I can easily believe either. However, while the default assumption of laziness/incompetence works well for good faith discussions, it also provides cover for malicious actors. At some point, even though any given actor is likely to be non-malicious, there is no way to distinguish them from the malicious actors.
Re:Ask HN: Why does Zoom Desktop examine all processes and a... by heavyset_go on Tuesday August 17, 2021 @07:36PM (#28216033)
Hanlon's razor is a great principle to apply to personal relationships, but it falls apart in these situations.

You can explain away any deliberate malice or negligence using it, even when there are clear incentives to enage is such behavior, unless there's absolute evidence of malice. By then it's too late because you've already been swindled, and the principle ignores the lengths organizations will go to cover that evidence up.

Re:Ask HN: Why does Zoom Desktop examine all processes and a... by TeMPOraL on Wednesday August 18, 2021 @05:30AM (#28219149)
If you're dealing with bigger threats, you need a more powerful weapon. Sheathe the Hanlon's razor, and unholster the Hanlon's handgun: "Never attribute to stupidity that which can be adequately explained by systemic incentives promoting malice."

https://news.ycombinator.com/item?id=21691282

Re:Ask HN: Why does Zoom Desktop examine all processes and a... by addicted on Wednesday August 18, 2021 @02:26AM (#28218219)
I’d argue that laziness is worse in security/privacy situations than malicious intent. At least malicious intent only exposes me to Zoom and whoever they answer to. Their laziness, however, which would probably also reflect itself in other security situations, exposes me to them as well as basically the entire world of black hat hackers.
Re:Ask HN: Why does Zoom Desktop examine all processes and a... by propogandist on Tuesday August 17, 2021 @06:30PM (#28215538)
or it’s spyware, maybe not as bad as a keylogger, but it can be mining your active usage behavior
Re:Ask HN: Why does Zoom Desktop examine all processes and a... by reilly3000 on Tuesday August 17, 2021 @06:51PM (#28215692)
This could be verified by inspecting their analytics requests. If I have time I may take a peek at those later.
Re:Ask HN: Why does Zoom Desktop examine all processes and a... by reilly3000 on Wednesday August 18, 2021 @05:46AM (#28219215)
I wasn't able to find much of interest from their desktop client, as all of the data is encrypted and I'm not sure how to grab an SSL key from a desktop app for use in Wireshark decryption. If somebody clever wants to help, please let me know.

I did take at their privacy policy and didn't see anything that explicitly states they are collecting info about running applications. "and other" leaves room for interpretation... Regardless, my main concern after viewing this isn't that they are snooping my running processes and sending that back to home base. Its that they are openly keylogging and tracking everything under the sun, and can view every aspect of the meeting's content (audio, video, text, etc) and share it with 3rd parties like law enforcement and others.

Source: https://zoom.us/privacy#_qhklx843v2zq

> Device Information: Information about the computers, phones, and other devices people use when interacting with Zoom Products, which may include information about the speakers, microphone, camera, OS version, hard disk ID, PC name, MAC address, IP address (which may be used to infer general location at a city or country level), device attributes (like operating system version and battery level), WiFi information, and other device information (like Bluetooth signals).

> Meeting, Webinar, and Messaging Content and Context: Content generated in meetings, webinars, or messages that are hosted on Zoom Products, which may include audio, video, in-meeting messages, chat messaging content, transcriptions, written feedback, responses to polls and Q&A, and files, as well as related context, such as invitation details, meeting or chat name, or meeting agenda. Content may contain your voice and image, depending on the account owner’s settings, what you choose to share, your settings, and what you do on Zoom Products.

> Product and Website Usage: Information about how people and their devices interact with Zoom Products, such as: when participants join and leave a meeting; whether participants sent messages and who they message with; performance data; mouse movements, clicks, keystrokes or actions (such as mute/unmute or video on/off), and other user inputs that help Zoom to understand feature usage, improve product design, and suggest features; which third-party apps users add to a meeting or other Product and what information and actions the app is authorized to access and perform; features used (such as screen sharing, emojis, or filters); and other usage information and metrics. This also includes information about when and how people visit and interact with Zoom’s websites, including what pages they accessed, their interaction with the website features, and whether or not they signed up for a Zoom Product.

Re:Ask HN: Why does Zoom Desktop examine all processes and a... by propogandist on Tuesday August 17, 2021 @06:55PM (#28215725)
whoever does the analysis may also become a whistleblower.
Re:Ask HN: Why does Zoom Desktop examine all processes and a... by dylan604 on Tuesday August 17, 2021 @07:28PM (#28215976)
Does "whistleblower" apply to people not working directly for the company being reported? I've always understood it to be employee reporting against the employer. I could totally be limiting it from what other people use it though.
Re:Ask HN: Why does Zoom Desktop examine all processes and a... by stjohnswarts on Tuesday August 17, 2021 @08:24PM (#28216353)
I think it's a generic definition for someone closely associated with the company to out them out something that they would like to keep secret because it would embarrass them or lead to legal redress.