I'm guessing it's an antivirus/anti-malware operation.
macOS is background scanning and following downloaded QR codes?
11–20 of 95 posts
Re: macOS is background scanning and following downloaded QR codes?
#12I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor opening it Preview, nor scanning it with my iPhone, the only thing that caused a request was cl…
I will try it, I will leave a tcpdump running in the background. The tweet is not very helpful giving information on how it was detected, or how to reproduce it.
Re: macOS is background scanning and following downloaded QR codes?
#13Apple should be proxying and caching these results to avoid the risk of exposing client devices, prevent incidental DDOS, as well as the obvious privacy issues.
Re: macOS is background scanning and following downloaded QR codes?
#14I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor opening it Preview, nor scanning it with my iPhone, the only thing that caused a request was cl…
They may have received it through iMessage, which will hit a url and grab the 'opengraph' meta tags to generate a preview.
Re: macOS is background scanning and following downloaded QR codes?
#15Quoted post unavailable.
No post body was provided.
Re: macOS is background scanning and following downloaded QR codes?
#16Quoted post unavailable.
This doesn't have to anything nefarious. It could be an unfortunate combination of code reuse and feature creep.
Probably the QR scanner written for the iOS camera has an option to present URLs nicely (by fetching them), and some other OS component for image indexing reused the QR scanner without realizing it comes with side effects.
Re: macOS is background scanning and following downloaded QR codes?
#17"Background scanning" sounds more nefarious than what's probably really going on -- which is probably either generating thumbnail previews (for Finder) or indexing (for Spotlight), both of which are desired. Or maybe malware scanning to put files in quarantine if they point to dangerous content? macOS is also becoming more intelligent about text in images, e.g. it OCR's images so you can select text. I don't know if…
I feel like there are better ways to do this, to the point that this 'feature' actually looks really out-of-place. Why wouldn't you get these thumbnail previews when you actually scan the QR Code? You're going to be fetching/caching the favicon and framebuffer for the page anyways, there's literally no reason not to get that data at runtime rather than 3 hours later. It's not exactly malicious, but weird "we know bet…
There is absolutely nothing malicious that has been shown.
Re: macOS is background scanning and following downloaded QR codes?
#18Earlier quoted context omitted.
I feel like there are better ways to do this, to the point that this 'feature' actually looks really out-of-place. Why wouldn't you get these thumbnail previews when you actually scan the QR Code? You're going to be fetching/caching the favicon and framebuffer for the page anyways, there's literally no reason not to get that data at runtime rather than 3 hours later. It's not exactly malicious, but weird "we know bet…
There is absolutely nothing malicious that has been shown.
Scanning your images and followong links in them without user consent is pretty malicious.
Re: macOS is background scanning and following downloaded QR codes?
#19Re: macOS is background scanning and following downloaded QR codes?
#20Earlier quoted context omitted.
There is absolutely nothing malicious that has been shown.
Scanning your images and followong links in them without user consent is pretty malicious.
What are you talking about? It sounds like you don’t understand what is going on here. Perhaps you think some data is going to Apple?