Quoted post unavailable.
None of this is confirmed, just a single person was able to reproduce that.
QR code images in macOS are silently executed in the background hours/days later
41–50 of 111 posts
Re: QR code images in macOS are silently executed in the background hours/days later
#42Other thread on this: https://news.ycombinator.com/item?id=33095608 My comment from there: I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor open…
I've just reproduced it.
Went to a qr-code generator online, generated a code with an url http://xxx.xxx.xxx.xxx
In a terminal i did "sudo tcpdump ip host xxx.xxx.xxx.xxx"
Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip.
uname -a: Darwin Kernel Version 21.6.0: Mon Aug 22 20:17:10 PDT 2022; root:xnu-8020.140.49~2/RELEASE_X86_64 x86_64
Really shitty idea from apple...
EDIT!!!
Sorry, I think I know where the problem was: I was testing with a site I visited in safari already. It happens that after you type a couple of characters in safari address bar, and you have a cache hit in your history, safari already loads the site. While doing the experiment I visited sites which triggered hits in the history with my test site... so no. I could not really reproduce it. Maybe original tweet comes from similar error.
Re: QR code images in macOS are silently executed in the background hours/days later
#43It could be an AV engine doing it. Some phishing attacks have switched to using QR codes instead of links as an evasion technique in the last couple of years, so the anti-evasion to that is decode it and browse the link to see if it's malicious.
“This link might be dangerous - better click on it!” I’d suspect it’s indexing for search rather than a security protocol - i feel like anybody security minded would have approached this differently
> I’d suspect it’s indexing for search rather than a security protocol - i feel like anybody security minded would have approached this differently
So it’s exploding the QR to see where the link goes?
Re: QR code images in macOS are silently executed in the background hours/days later
#44Quoted post unavailable.
No post body was provided.
Re: QR code images in macOS are silently executed in the background hours/days later
#45Earlier quoted context omitted.
Ubuntu and Windows also scan your filesystem to build search indexes. That's how search indexes work.
They wont generally visit the urls you list in your files though, that's not what a search index is.
Yes, that part is different. It's a misguided feature but not too crazy of an idea. Link previews are a common feature in many applications, and this is likely just the search index equivalent of that.
Re: QR code images in macOS are silently executed in the background hours/days later
#46Other thread on this: https://news.ycombinator.com/item?id=33095608 My comment from there: I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor open…
I've just reproduced it. Went to a qr-code generator online, generated a code with an url http://xxx.xxx.xxx.xxx In a terminal i did "sudo tcpdump ip host xxx.xxx.xxx.xxx" Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. uname -a: Darwin Kernel Version 21.6.0: Mon Aug 22 20:17:10 PDT 2022; root:xnu-8020.140.49~2/RELEASE_X86_64 x86_64 Really shitty idea from apple..…
Counterpoint: I did the same thing and used Little Snitch to try to catch a request, and did not see one. If there had been one, it would have attributed it to a particular process.
Re: QR code images in macOS are silently executed in the background hours/days later
#47Other thread on this: https://news.ycombinator.com/item?id=33095608 My comment from there: I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor open…
I've just reproduced it. Went to a qr-code generator online, generated a code with an url http://xxx.xxx.xxx.xxx In a terminal i did "sudo tcpdump ip host xxx.xxx.xxx.xxx" Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. uname -a: Darwin Kernel Version 21.6.0: Mon Aug 22 20:17:10 PDT 2022; root:xnu-8020.140.49~2/RELEASE_X86_64 x86_64 Really shitty idea from apple..…
I'm not saying it's not happening but I just did this (with both a public and private IP) and was unable to produce. For reference I used the following:
* https://www.the-qrcode-generator.com/ - for the QR Code
* http://10.0.1.202 and http://8.8.8.8 - for the urls
* Command + Shift + 4 - To select the area of the screen with the QR code (using the native screenshot tool, I disabled CleanShotX)
Re: QR code images in macOS are silently executed in the background hours/days later
#48Discussion on the original tweet: https://news.ycombinator.com/item?id=33095608
@Dang, should these threads be merged?
Re: QR code images in macOS are silently executed in the background hours/days later
#49If, as he suggests, it may be happening on iOS as well then it would offer third parties the interesting possibility of "probing" some locations for iPhone photo events, especially if the background requests and their headers can be distinguished from intentional requests.
Say you own a bar, nightclub, popular tourist location, or whatever. Place specific QR codes at locations of encoding URLs pointing to a server you own, and you will be able to count how many times an iPhone user took a photo that included said QR code (or, if background scanning is active even before the picture is taken, how many times an iPhone was pointed towards it).
Not that this would likely provide any valuable information for a malicious actor, nor could it really be done covertly. It's more of a thought experiment.
Re: QR code images in macOS are silently executed in the background hours/days later
#50Other thread on this: https://news.ycombinator.com/item?id=33095608 My comment from there: I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor open…
I've just reproduced it. Went to a qr-code generator online, generated a code with an url http://xxx.xxx.xxx.xxx In a terminal i did "sudo tcpdump ip host xxx.xxx.xxx.xxx" Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. uname -a: Darwin Kernel Version 21.6.0: Mon Aug 22 20:17:10 PDT 2022; root:xnu-8020.140.49~2/RELEASE_X86_64 x86_64 Really shitty idea from apple..…
Isn’t this just URL prefetching extended to QR codes?
I don’t see what the fuss is about, unless there is some innuendo that data is being sent to Apple.