Use Zoom on a Mac? You might want to check your microphone usage

Apple Mac users running the Zoom meetings app are reporting that it's seemingly keeping their computer's microphone on when they aren't using it. The issue appears to affect the native app running on the latest macOS release, Monterey, in which Apple has implemented a visual cue to alert users that an application or device is …

[Pascal Monett]

"it looks like it's safest to only run Zoom while on active calls"

Wow. People have had to actually been surprised to come to this conclusion.

I must really be a cave troll. I only activate mobile data when I decide I need it. I only activate WiFi at home. I only activate BluTooth when I'm driving.

That means that I shut down mobile data when I'm done. I shut down Wifi when I'm done with it. I shut down BluTooth when I park the car.

Do these people ever turn off the lights ?

[andy 103]

Re: "it looks like it's safest to only run Zoom while on active calls"

I'm not sure whether this was sarcasm but most people leave everything "on" permanently.

See also: people who blindly accept T+C's for services and the moan when they find their data has been passed to a third party, even though they agreed to it.

[Potemkine!]

Re: "it looks like it's safest to only run Zoom while on active calls"

In their dischage, T+C's for services are obscure, long and changing many times to discourage most to read them in full.

[Blazde]

Re: "it looks like it's safest to only run Zoom while on active calls"

"Do these people ever turn off the lights ?"

If you mean the little standby LED on the TV, nope. Almost nobody turns that thing off at all ever. Probably a good proxy for how many turn off random unused apps on a Mac. Martin Lewis should do a campaign.

[NATTtrash]

Re: "it looks like it's safest to only run Zoom while on active calls"

If you mean the little standby LED on the TV, nope.

When have you shopped last time for a new TV? If it has been a while, just do so, you know, for fun. And keep a list of how many you find where the manufacturer took the effort to supply you with a real physical ON/ OFF button. One of those old fashioned concepts, common in the last century which sets power usage to 0W.

Spoiler alert: make sure you can reach that power plug easily...

[Evil Scot]

Re: "it looks like it's safest to only run Zoom while on active calls"

I have a smart socket for this purpose.

Although admittedly turning this off will "Un Plug" my AV Receiver. Switch off any lights on in my home. Turn down the radiators in the bedroom and the main thermostat.

Yes it is complicated. But this is due to my Thermostat not supporting Geofencing.

OH! They will tell me that I have left home and should use their app to turn down the heating. But do it automatically why would a company that sells gas do that?

ICON Yeah lets keep the boiler on!!!!!!!

[Anonymous Coward]

Re: "it looks like it's safest to only run Zoom while on active calls"

But then it's your smart socket... and the thermostat/boiler controller... that's wasting the power!

[Martin an gof]

Re: "it looks like it's safest to only run Zoom while on active calls"

Typical TV in standby theae days is using under 5W, probably under 1W (depends on smarts - sometimes there is an 'Eco' option for standby mode). Smart socket will (if internet connected) be using similar. Switch off a light bulb - even the dimmest LED units are 4 - 6W.

Switch off your PVR - 10W+? (Rather prevents timer recordings though)

Switch off your WiFi access points. (Umm..)

Switch off the outside light that illuminates every cat that walks past.

Turn down the thermostat when you are out but don't switch the heating right off

Spend a few minutes less in the shower

Insulate!

Crumbs, just switching the TV into standby instead of leaving it burbling in the background when you are in the other room will save more energy in half an hour than unplugging it overnight, though if it is as annoying as ours to switch back on again...

And don't get me started on unplugging phone chargers - with 'standby' consumption too low to measure with kit typically available domestically.

If you really want to use no power when out, flip the Big Red Switch in the consumer unit :-)

M.

[Martin an gof]

Re: "it looks like it's safest to only run Zoom while on active calls"

And don't get me started on unplugging phone chargers - with 'standby' consumption too low to measure with kit typically available domestically.

Probably ought to clarify what I'm moaning about there.

If you have finished charging the phone, unplug the charger. No question. Daft not to.

However there are some people who seem to think that global warming is caused by people leaving chargers plugged in. Daft.

Even saw an example recently where under "how we can all do our bit to save energy" someone suggested deleting old emails. Erm. Not sure about that one.

M.

[Blazde]

Re: "it looks like it's safest to only run Zoom while on active calls"

"keep a list of how many you find where the manufacturer took the effort to supply you with a real physical ON/ OFF button. One of those old fashioned concepts, common in the last century which sets power usage to 0W.

Spoiler alert: make sure you can reach that power plug easily..."

The problem nowadays is that the switch needs to be on the wall side of the transformer, typically dangling awkwardly in the middle of the power cord, and by the time you're there it's often easier to go for the wall.

Presumably somewhere there are power outlets with their own standby circuits that can be turned off over the cloud by a smartphone app... to save you the trip to the wall. A new LED to rage against.

[Primus Secundus Tertius]

Re: "it looks like it's safest to only run Zoom while on active calls"

I even log out and shut down after using the computer, rather than just closing the lid.

[Anonymous Coward]

Re: "it looks like it's safest to only run Zoom while on active calls"

That's a good idea, also because it properly locks FileVault (on suspend it's kept open).

[chivo243]

Re: "it looks like it's safest to only run Zoom while on active calls"

I have a powerstrip with a main toggle off for all non-essential systems in almost every room, the nightly stroll through the house flicking all of these switches definitely saved me cash over the years. Not to mention the occasional night spent of the sofa/couch with all the "All Seeing Eyes of Sauron" of each system on standby burning brightly! Flick! and the ring has been dropped into Mt. Doom!

[Snake]

Re: "run Zoom while on active calls"

"Do these people ever turn off the lights ?"

Joe Average's "lights" have been 'off' for quite a while now. Sadly.

The average moron keep programs running indefinitely under the assumption that it is OK. I even remember reading an article or comment that everyone has enough memory and resources now that shutting applications down is 'so old fashioned'.

So, the cynical me: Spied on? Serves you right.

[Anonymous Coward]

Re: "run Zoom while on active calls"

Well, no.

From a security perspective I'd call most users innocent, not ignorant. Criminals would think of all these things, but because the majority of them are not they don't think that way and need some help.

[tip pc]

Re: "it looks like it's safest to only run Zoom while on active calls"

soft toggle buttons.

on a recent (mine is 5+ years) iPhone, turning off wifi effectively just disconnects from the current wifi net for 24hrs, it'll still connect to other wifi nets and self activate after 24hrs.

same story with bluetooth.

there where some stories I think from Snowden that microphones etc would still activate when handsets where off, many derided those stories but we now know these devices don't actually do what they we expect or they are telling us they are doing.

treat turning things to off as the os telling you its off but it in fact it's still on.

[A random security guy]

Most of their Engineering still is

The last report said90% of engineering was in China. The other 10 % could be support engineers.

Privacy is not a concern in China.

So all those businesses talking to each other over zoom?

Guess what. Just the meta information of who is talking to whom at what frequency and time is good enough.

[gratou]

Re: Most of their Engineering still is

It's not metadata despite what the NSA says. It's data. Just like the contents is data, so is the time, duration, origin, destination, etc. All data.

Don't help spread the lie.

[chivo243]

Zoom was a children's show from Boston, Ma in the early 70s. I watched it on PBS. Not sure how the Chinese managed that!

Well, it's true!

[Anonymous Coward]

Fun fact: we also do a lot of work with US GOV (defence) clients.

Our EU clients mostly use Teams.

Our US clients overwhelmingly use Zoom (there seems to be a special GOV subscription plan? It shows a special GOV notation and icon during the call...)

So I suppose it wasn't put in the Huawei box on the other side of the pond?

Then again, my experiences might be skewed...

[b0llchit]

Watching the watchers watch the watchers watch

In the meantime, if you'd like to know if apps are snooping on you, there are various third-party products such as Micro Snitch or OverSight to help you to monitor who's monitoring you.

Ehm,... you have to install a program to tell if a program is telling another program what you are doing? Maybe you should not install any of those (potentially) dangerous programs? Kind of who watches the watcher problem here. Just most of it is automated.

Is it just me, or does it sound absurd that we actually are in a situation where we are compounding programs to watch programs that watch other programs that watch us? And that is for commercial gain of who exactly? To push more adverts to the users?

[John Brown (no body)]

Re: Watching the watchers watch the watchers watch

"Maybe you should not install any of those (potentially) dangerous programs?"

All programs are potentially dangerous. Users have to judge whether there is actual danger and balance that with their needs, wants and convenience. For most users, obviously convenience is weighted very heavily and all other concerns are weighted very low if not actually into negative weightings otherwise we'd not be in the situation of even the OS snooping on you these days, never mind all the 3rd party stuff. If people were really concerned, or informed enough that they have the choice to be concerned, snoopy programs would not have the success they currently enjoy.

[Martin an gof]

Re: Watching the watchers watch the watchers watch

If people were really concerned, or informed enough that they have the choice to be concerned, snoopy programs would not have the success they currently enjoy.

Since you bring it up, there is the small matter of lack of choice.

If Joe Bloggs wants to buy a phone or a tablet he has the choice of Android or iOS, both of which (though one vastly more than the other apparently) collect and use personal data for their own purposes. And with Android you get all the manufacturer and carrier cruft on to

If Jane Bloggs wants to buy a computer she has the choice of Windows, OSX or Chrome*, all of which (though one possibly less so than the others) collect personal information for their own purposes.

For your average person-on-the-street, there is no 'take my money then leave me alone' option. The option not to be tracked and profiled simply doesn't exist. Yes, some things do less of it than others, and yes there are options to tone it down (partly dependent on where in the world you live) but turn it off altogether? Not a hope.

M.

*I was tempted to put Chromebooks in with phones and tablets, but online Office (etc.) is big on 'proper' computers now, too, so I think they live in that category

[John Brown (no body)]

Re: Watching the watchers watch the watchers watch

Yes, you are correct and are describing the situation we are in now. My point was that we[*] should have been objecting tp this years ago so as not to have reached this point.

* By "we", I mean everyone, not just those us in the industry who have been watching this slow, step-by-steo sleep-walk into the surveillance society.

[Anonymous Coward]

Re: Watching the watchers watch the watchers watch

Why do you have everyone looking at one watch?

Just curious :).

[SCP]

Re: Watching the watchers watch the watchers watch

The watchers might well have a watch (as might the watcher's watchers), but these watches might not be the watches that the watcher's watchers are watching. The watchers are also on watch (watching what watchers watch) and it is this watch that the watcher's watchers are watching on their watch. Smart watches might also need a watcher and a watcher's watcher who, on their respective watches, will watch what the watch and the watcher does to see if anything is watching what they should not be watching. So I suppose a watcher's watcher could be watching a watcher's watch on the watcher's watch using the watcher's watcher's watch when they are on their watch.

I hope that has helped clarify things.

[John Brown (no body)]

Re: Watching the watchers watch the watchers watch

I watched what you did there :-)

[The Sprocket]

Re: Watching the watchers watch the watchers watch

They are useful.

As soon as you’re connected to the Internet, applications can potentially send whatever they want to wherever they want. Most often they do this to your benefit. But sometimes, like in case of tracking software, trojans or other malware, they don’t. But you don’t notice anything, because all of this happens invisibly under the hood.. While this may edge into the tin-foil hat crew, it's not a bad idea if one is concerned to that degree. I've been thinking myself of installing Li'l Snitch for the last 20 years. I'm still thinking about it, but I'm a cheap SOB yet I could afford it easily. And as we know, these programs like Li'l Snitch can turn off the offending programs ability to 'call home'.

Personally, I don't see them as absurd as you do. To each his own.

[Anonymous Coward]

Zoom.....

The security gift (gaff) that keeps on giving :-(

[Charlie Clark]

Re: Zoom.....

To be fair, this could be said about most video conferencing clients. I can't think of many that haven't been riddled with bugs. But I'm still suspicipus about Zoom's business model, so I've deleted it and only use the browser now.

[Fred Daggy]

Re: Zoom.....

Agreed, Zoom haven't worked out the business model. They see the lovely revenue from snooping and measuring users that the big boys rake in. "How can we monetise this user?" Oh, simple, keep listening.

Never put down to malice what can be put down to incompetence, BUT always follow the money.

Sadly, my company has chosen to use Zoom for telephony and is in the process of rolling it out. Over the objections of the people that knew what they are doing (eg, Technicians, Legal, Compliance, Lower level managers). I know that it will be restricted to a VM on my desktop. 99% of the time I'll still be using TEAMs internally, plus a mobile.

[EnviableOne]

Re: Zoom.....

the difference with Zoom, is unlike the others they CLAIM to be secure

WebEx, Teams(Lync), Vidyo, Scopia, etc. made no such claims

The problem is not that Zoom isn't secure, its that it constantly claims to be secure where it blatantly isnt

[Dr Paul Taylor]

Also no audio on Ubuntu Snap Zoom-client

I "went" to an online seminar on 24 Jan and Zoom worked fine. When I "went" to another one on 31 Jan there was no audio. Now it denies that I have either a mic or a speaker.

Apparently the Ubuntu "Snap" for zoom-client was automatically updated and there is no previous version available to which ti revert.

Does nobody test these things?

[Neil Barnes]

Re: Also no audio on Ubuntu Snap Zoom-client

Tested or not, I won't install Zoom client software on any machine. It can run in a separate browser window, thank you, and be closed when the call is finished.

[JassMan]

Re: Also no audio on Ubuntu Snap Zoom-client

I have resurrected an old laptop for use with zoom and teams. Clean install with no useful data, contacts lists or calendars or even apps (unused) other than the minimum install. Anyone wants to zoom me they send an email with plenty of notice and I open the laptop as required then download all latest patches before connecting. Call me paranoid, but I would rather go for a sanitary laptop than trust to a tinfoil hat.

[Grey_Kiwi]

Re: Also no audio on Ubuntu Snap Zoom-client

Thanks for reminding me

Time to "patch Tuesday" the Zoom laptop

[Tom 7]

Re: Also no audio on Ubuntu Snap Zoom-client

I have a dedicated user login for it. And not on the computer I use most which is a laptop. The machine I do Zoom on has decent sound setup and a moveable camera and is in the DMZ.

[usbac]

Re: Also no audio on Ubuntu Snap Zoom-client

Yes, we all test this stuff. After all, we (users) are all unpaid beta testers.

Oh, you meant that software companies should test software? The bean counters got rid of all of those expensive employees many years ago.

We don't even test the software that controls jet airliners, with hundreds of human lives at stake, why would you think anyone would test video chat software?

[Roland6]

Re: Also no audio on Ubuntu Snap Zoom-client

>"Yes, we all test this stuff. After all, we (users) are all unpaid beta testers.

Oh, you meant that software companies should test software?"

Love it, that many here are software developers, working for software companies. I expect there are many who have delivered something without sufficient testing - leaving it to the customers....

[Ian Johnston]

Re: Also no audio on Ubuntu Snap Zoom-client

The combination of Zoom and Ubuntu is a bit weird for audio. As far as I can tell, when Zoom turns your video camera on, the system default microphone becomes the video camera (if it has a microphone) so if you set and tested "System default" microphone in video setup, it changes as soon as you start your call.

Or at least, that was the problem which baffled me for a bit.

I stick to 18.04, by the way, because I will not have snaps or flatpaks on my system.

[Anonymous Coward]

Just looking in

My desk phone has now been replaced by the Zoom app. Stop laughing at the back there, you'll confuse the spies!

I have stuck a bit of cardboard over the webcam, so they aren't embarrassed by any unscheduled wardrobe malfunctions, but they'll have to put up with the belching, sighing and swearing at Excel moments.

AC cause I don't want you all peering at me.

[ShadowSystems]

Re: Just looking in

I'd suggest that anyone on a desktop resort to using a USB-attached webcam+mic device for their video chat needs so that, once the chat is over, physicly unplug the device & thwart any attempts to use said devices for evesdropping.

If you're using a SmartPhone to do it, you're pretty much screwed. =-J

[Anonymous Coward]

Re: Just looking in

All devices that have a camera or microphone and any kind of communication capability must satisfy one of two requirements to be used anywhere on my property:

* The camera/mic are mechanically detachable and have no independent energy source, to be detached when not in use, or

* All hardware and software is open source, the manufacturing process verifiable, and no covert surveillance functionality exists

Both together are preferred, but there is practically nothing on the market that satisfies the second. If a device satisfies neither, it goes in the waterproof metal bin (Faraday cage) next to the gate at the end of my lane. You may retrieve it when you leave. Yes, I'm serious.

[Alumoi]

Re: Just looking in

You have no phone, no computer, no electronic device which uses a micrporcessor, no family and no friends. Hello, Adam.

[Down not across]

Re: Just looking in

You're Edward Lyle and I claim my £5

[Ian Johnston]

Re: Just looking in

All hardware and software is open source

Been away for a few years have we, sir?

[Dr. Ellen]

Re: Just looking in

That is exactly what I do. Not that I say anything controversial or business-related, bu that's this week. Who knows what will be controversial next week? And I usually have all external connections on my smartphone turned off -- the battery lasts longer that way. I only turn them on when I am making a call, or expecting one.

[Anonymous Coward]

Re: Just looking in

Yes, cheap-o usb webcam is fine on my mini. Also Oversight utility warns every time mic and/or cam wants to launch.

[AJ MacLeod]

What a surprise

Even joining a Zoom meeting in a private browsing window makes me a bit uneasy, there's no way on Earth I'd actually install their software on any of my computers. It's not so easy if you're hosting a meeting though, not all the features are available in a browser session.

[chivo243]

Re: What a surprise

Soo... you'd rather let your browser handle this traffic. Where's the sieve icon?

[AJ MacLeod]

Re: What a surprise

Yes, I'd rather my browser (which is open source and sandboxed to a reasonable extent) handle this traffic, rather than granting their known to be dodgy software carte blanche access to my entire PC. I'd rather not use Zoom at all of course (and generally don't), but one doesn't always have much option.

[tekHedd]

Always broadcasting

In an earlier version of Zoom, when trying to get it running in a browser I noticed that even though the meeting hadn't started and Zoom showed us as "waiting for host", the video and audio streams from the host were running, showing her setting up and stuff, unaware that the camera was on. You just had to know where the hidden, muted browser widget that displayed the stream was in the CSS stack. I suspect that they would keep the streams running so that "mute person" and "start meeting" are instantaneous in the client. It would not surprise me if it still did this.

[Anonymous Coward]

Re: Always broadcasting

It probably still does do it.

Not sure if there's a new API (it's been ~7yrs), but most (all?) these chat apps use WebRTC and multiplexing in say a black/null, silent stream into an already established connection isn't an out-of-the-box feature. FFMPEG can do this. One way is essentially using 2 named pipes... 1 to stream the A/V into and 1 to overwrite/replace that stream with black+silence until desired, but that's not WebRTC and it's also not a native feature either (I look at it as, if FFMPEG can't do it, WebRTC most definitely doesn't).

Odds are that if you find a exploit/weakness with WebRTC, it's going to be there a while.

FWIW, *if* these were _NOT_ embedded cameras and microphones on laptops, phones, etc... you could use a $10 A/V splitter and simply press the button to physically drop the streams, just like in broadcasting (but since they are embedded :-/ ).

[TaabuTheCat]

Oh, you're so clever.

"resolved an issue regarding the microphone light indicator being triggered when not in a meeting."

No. You resolved an issue where you were leaving the microphone on when not in a meeting.

What a bunch of disingenuous assholes.

[Richard 12]

Re: Oh, you're so clever.

One might even think Zoom were trying to keep the microphone on and just hide the macOS indicator.

Oh, hang on. I do think that.

[Anonymous Coward]

Re: Oh, you're so clever.

""resolved an issue regarding the microphone light indicator being triggered when not in a meeting."

No. You resolved an issue where you were leaving the microphone on when not in a meeting."

No. They slipped the truth, literally.

The problem was that light indicator was on (because microphone was on) and they fixed that. Recording obviously continues, just now without light, because they fixed it. Duh.

[The Empress]

99% of all users pay no attention to any settings

Not security settings, not privacy, not device configuration, nothing. All they care about is does it work. And even if you pointed it out what to do they wouldn't care because adding one step or one button would be too hard for them.

[Marty McFly]

Re: 99% of all users pay no attention to any settings

The longer I am in IT, the more disconnected I want to become.

Recently I helped my neighbor hook up her new HP printer which she got 'for a good price'. Why in the hell does a PRINTER need me to agree to a EULA, AND need full time access to the Internet to be able to print?

My neighbor... "Oh, but look at all the pretty colors!"

Yeah, I am keeping my vintage HP LaserJet with parallel port connection.

[Anonymous Coward]

Scum

It's worth remembering that Zoom have the distinction of being the only company where Apple felt the need to issue a specific security patch to remove its software, putting Zoom into the same category as malware.

https://www.theregister.com/2019/07/09/zoom_mac_webcam_security_patch/

And another gem from that linked article:

Zoom responded by changing the host's ability to choose whether the camera is enabled – but the fix regressed

In other words: thanks for reporting that bug but actually it's deliberate. We'll pretend it's a bug for now, hope you take our bug bounty payoff (with obligatory attached non-disclosure agreement) and then we'll reinstate the bug but you can't then complain without breaking the NDA - sucker.

[icon- why does the spawn of satan icon look so cheery?]

[DS999]

The little dot Apple added is showing its worth

If it wasn't for that, how long would it take before people realized the microphone had been left on by Zoom?

[Len]

Is the LED hardwired?

All the MacBooks from 2009 onward have the camera LED hardwired to the camera's power lead. This means that whenever a process switches the camera on the LED must come on too. That is also why that iSeeYou hack to trick the camera LED only worked on older MacBooks.

Is anything known about whether that orange LED for the microphone works the same way?

[Anonymous Coward]

Re: Is the LED hardwired?

It's no longer an LED, it's a screen dot. Green for camera, orange for anything that has access to any audio input/output (yes, both). AFAIK the same is true for iOS/iPadOS.

[Anonymous Coward]

Re: Is the LED hardwired?

Screen dot means 100% programmable.

I'll bet some API has tools to turn it off even if mic/camera is open. Or, a hack which doesn't even need the API.

[Roland6]

Expect its a bug in the client

Bet the issue is simply a poorly thought out routine that simply doesn't release the microphone when a meeting isn't in session.

[Anonymous Coward]

Re: Expect its a bug in the client

Their past endeavours (the hidden web server) do not exactly entitle them to the assumption of this being an innocent mistake. Notoriously aloof Apple issueing a patch specifically to remove software from your company is not a good sign.

[Anonymous Coward]

Re: Expect its a bug in the client

Notoriously aloof Apple issueing a patch specifically to remove software from your company is not a good sign.

Don;t they do that all the time if they think you're making money theu want?

[Anonymous Coward]

Re: Expect its a bug in the client

No, they're not Microsoft, although I think they did just that to Tile with their air tag thingies.

I guess there's a first for everything.

[Anonymous Coward]

Re: Expect its a bug in the client

".. simply doesn't release the microphone when a meeting isn't in session."

--- but continues to record. Right. That's what it does, on purpose. It *is* Zoom, not just any program. Chinese spyware.

[Roland6]

Re: Expect its a bug in the client

>--- but continues to record. Right. That's what it does

No evidence that Zoom is actually doing anything with the open mic.

Suspect it is doing the equivalent of a landline phone off the receiver - it will show as phone/line in use.

[The Sprocket]

I can see this as a real concern for businesses who blindly trust Zoom as they discuss confidential matters.

But for myself, who is retired, all Zoom will be getting is mindless rabble from a bunch of p!ssed up old yobs who periodically group for a virtual pub night and yak on endlessly about our favourite 80's bands (LOL!!)