Quoted post unavailable.
Quoted post unavailable.
Sometimes, I believe HN is becoming Reddit albeit a very slow process, but it will happen eventually.
QR code images in macOS are silently executed in the background hours/days later
51–60 of 111 posts
Re: QR code images in macOS are silently executed in the background hours/days later
#52Other thread on this: https://news.ycombinator.com/item?id=33095608 My comment from there: I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor open…
I've just reproduced it. Went to a qr-code generator online, generated a code with an url http://xxx.xxx.xxx.xxx In a terminal i did "sudo tcpdump ip host xxx.xxx.xxx.xxx" Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. uname -a: Darwin Kernel Version 21.6.0: Mon Aug 22 20:17:10 PDT 2022; root:xnu-8020.140.49~2/RELEASE_X86_64 x86_64 Really shitty idea from apple..…
I generated a QR code locally, saved it to Downloads; created a QR code online, downloaded it to Downloads; created a QR code online, downloaded it, added it to Photos, deleted it from Downloads immediately. Thus far, after 20 minutes, of those 3 QR codes with distinct URLs, not one has been hit by anything. Will keep monitoring though.
Re: QR code images in macOS are silently executed in the background hours/days later
#53Earlier quoted context omitted.
I've just reproduced it. Went to a qr-code generator online, generated a code with an url http://xxx.xxx.xxx.xxx In a terminal i did "sudo tcpdump ip host xxx.xxx.xxx.xxx" Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. uname -a: Darwin Kernel Version 21.6.0: Mon Aug 22 20:17:10 PDT 2022; root:xnu-8020.140.49~2/RELEASE_X86_64 x86_64 Really shitty idea from apple..…
Counterpoint: I did the same thing and used Little Snitch to try to catch a request, and did not see one. If there had been one, it would have attributed it to a particular process.
[deleted]
Re: QR code images in macOS are silently executed in the background hours/days later
#54It could be an AV engine doing it. Some phishing attacks have switched to using QR codes instead of links as an evasion technique in the last couple of years, so the anti-evasion to that is decode it and browse the link to see if it's malicious.
“This link might be dangerous - better click on it!” I’d suspect it’s indexing for search rather than a security protocol - i feel like anybody security minded would have approached this differently
running it and seeing what it does is the most practical way of identifying malware these days. Heuristics are too easy to stay ahead of.
Re: QR code images in macOS are silently executed in the background hours/days later
#55Other thread on this: https://news.ycombinator.com/item?id=33095608 My comment from there: I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor open…
I've just reproduced it. Went to a qr-code generator online, generated a code with an url http://xxx.xxx.xxx.xxx In a terminal i did "sudo tcpdump ip host xxx.xxx.xxx.xxx" Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. uname -a: Darwin Kernel Version 21.6.0: Mon Aug 22 20:17:10 PDT 2022; root:xnu-8020.140.49~2/RELEASE_X86_64 x86_64 Really shitty idea from apple..…
Data point: I did the exact same procedure on the exact same kernel version and did not see a hit.
I'm wondering if there is some setting in Spotlight or Finder that is required to see this behavior.
Re: QR code images in macOS are silently executed in the background hours/days later
#56Earlier quoted context omitted.
I've just reproduced it. Went to a qr-code generator online, generated a code with an url http://xxx.xxx.xxx.xxx In a terminal i did "sudo tcpdump ip host xxx.xxx.xxx.xxx" Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. uname -a: Darwin Kernel Version 21.6.0: Mon Aug 22 20:17:10 PDT 2022; root:xnu-8020.140.49~2/RELEASE_X86_64 x86_64 Really shitty idea from apple..…
Isn’t this just URL prefetching extended to QR codes? I don’t see what the fuss is about, unless there is some innuendo that data is being sent to Apple.
Prefetching is usually a function of a web-browser in response to navigating to a page which contains links. I think the concern is that Safari is not involved at all here. This is the OS doing the prefetch by examining just a file saved to the filesystem.
Re: QR code images in macOS are silently executed in the background hours/days later
#57Other thread on this: https://news.ycombinator.com/item?id=33095608 My comment from there: I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor open…
I've just reproduced it. Went to a qr-code generator online, generated a code with an url http://xxx.xxx.xxx.xxx In a terminal i did "sudo tcpdump ip host xxx.xxx.xxx.xxx" Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. uname -a: Darwin Kernel Version 21.6.0: Mon Aug 22 20:17:10 PDT 2022; root:xnu-8020.140.49~2/RELEASE_X86_64 x86_64 Really shitty idea from apple..…
I'm also unable to reproduce this. I saw no activity whatsoever in Little Snitch Network Monitor.
Re: QR code images in macOS are silently executed in the background hours/days later
#58Earlier quoted context omitted.
Isn’t this just URL prefetching extended to QR codes? I don’t see what the fuss is about, unless there is some innuendo that data is being sent to Apple.
Prefetching is usually a function of a web-browser in response to navigating to a page which contains links. I think the concern is that Safari is not involved at all here. This is the OS doing the prefetch by examining just a file saved to the filesystem.
Sure but as has been pointed out, the likely explanation is that this is a function being performed locally for indexing or thumb nail generation.
Nobody has come close to showing anything malicious or that data is being exfiltrated, so why is this a problem?
Re: QR code images in macOS are silently executed in the background hours/days later
#59Earlier quoted context omitted.
I've just reproduced it. Went to a qr-code generator online, generated a code with an url http://xxx.xxx.xxx.xxx In a terminal i did "sudo tcpdump ip host xxx.xxx.xxx.xxx" Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. uname -a: Darwin Kernel Version 21.6.0: Mon Aug 22 20:17:10 PDT 2022; root:xnu-8020.140.49~2/RELEASE_X86_64 x86_64 Really shitty idea from apple..…
Isn’t this just URL prefetching extended to QR codes? I don’t see what the fuss is about, unless there is some innuendo that data is being sent to Apple.
Similar privacy issues of URL prefetching aside, this is actually not exactly the same.
URL prefetching is usually only expected to happen "on demand" while you're using stuff (e.g. generating link previews when they appear). What's described here seems to imply it is preemptively happening to files "at rest".
Also, automatic prefetching can be turned off in most places that have it, so ideally the user should be able to configure a setting to disable loading those URLs.
Re: QR code images in macOS are silently executed in the background hours/days later
#60It could be an AV engine doing it. Some phishing attacks have switched to using QR codes instead of links as an evasion technique in the last couple of years, so the anti-evasion to that is decode it and browse the link to see if it's malicious.
“This link might be dangerous - better click on it!” I’d suspect it’s indexing for search rather than a security protocol - i feel like anybody security minded would have approached this differently
The language used throughout this thread is terrible; "better click on it" you think an AV is literally loading up a full browser and forcing it to navigate to a random link it finds in a QR code on an image?
Even the title uses the word "executed" as if a QR code is "runnable" in some way; it's not. QR code related hacks are not some magical "scan this image and get pwnd", they're related to browser exploits and other methods of forcing code execution by way of the browser.
To my knowledge there have never been any "offline" QR code hacks, where simply scanning the QR code itself has ever lead to an exploit. AV is generally dumb, but simply converting a QR code itself is harmless.