Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

QR code images in macOS are silently executed in the background hours/days later

twitter.com

Post reply on HN
Print view View original

61–70 of 111 posts

Re: QR code images in macOS are silently executed in the background hours/days later

#61

Post by jcynix »

Spivak wrote: post #13
dtx1 wrote: post #7

Quoted post unavailable.

How are you going to send it to them in such a way that it wouldn’t be glaringly obvious to a court that they were sent it unsolicited? If your threat model is the government fabricating evidence then why even bother, just arrest them, “collect” a USB drive at their house with CP and lie. I mean hell why even bother with the song and dance, just send them the link and iMessage preview will do it too.

If it's sitting in your browser's cache, how do you determine wether it's there unsolicited or not? That's the problem already with real-time ad brokering. And it's easy to set any images to "display: none" with CSS, but they would still be loaded in the background. Now explain that to a court.

Re: QR code images in macOS are silently executed in the background hours/days later

#62

Post by captainmuon »

joshstrange wrote: post #27

Other thread on this: https://news.ycombinator.com/item?id=33095608 My comment from there: I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor open…

My M1 Mac does OCR on images. You can select text in bitmaps, look up words, and it highlights phone numbers and dates. Maybe this feature is related? Try highlighting the file using finder or viewing with quickview. Maybe you have to be on M1, too.

Re: QR code images in macOS are silently executed in the background hours/days later

#63

Post by lazide »

grooot wrote: post #58
matt-attack wrote: post #56

Earlier quoted context omitted.

Prefetching is usually a function of a web-browser in response to navigating to a page which contains links. I think the concern is that Safari is not involved at all here. This is the OS doing the prefetch by examining just a file saved to the filesystem.

Sure but as has been pointed out, the likely explanation is that this is a function being performed locally for indexing or thumb nail generation. Nobody has come close to showing anything malicious or that data is being exfiltrated, so why is this a problem?

Calling the URL is a form of data leakage and exfiltration

QR codes often include marketing trackers, for one really common examples.

Re: QR code images in macOS are silently executed in the background hours/days later

#64

Post by haswell »

grooot wrote: post #58
matt-attack wrote: post #56

Earlier quoted context omitted.

Prefetching is usually a function of a web-browser in response to navigating to a page which contains links. I think the concern is that Safari is not involved at all here. This is the OS doing the prefetch by examining just a file saved to the filesystem.

Sure but as has been pointed out, the likely explanation is that this is a function being performed locally for indexing or thumb nail generation. Nobody has come close to showing anything malicious or that data is being exfiltrated, so why is this a problem?

“Downloading image causes outbound http requests against arbitrary endpoints”

Pair this with a zero-day in the HTTP request library and an image becomes the initiation of an attack that leads to a vulnerable client connecting to a malicious endpoint.

Could also easily be used to track users in new ways.

Just two scenarios that immediately comes to mind.

Re: QR code images in macOS are silently executed in the background hours/days later

#65

Post by jdminhbg »

jabbany wrote: post #59
grooot wrote: post #50

Earlier quoted context omitted.

Isn’t this just URL prefetching extended to QR codes? I don’t see what the fuss is about, unless there is some innuendo that data is being sent to Apple.

Similar privacy issues of URL prefetching aside, this is actually not exactly the same. URL prefetching is usually only expected to happen "on demand" while you're using stuff (e.g. generating link previews when they appear). What's described here seems to imply it is preemptively happening to files "at rest". Also, automatic prefetching can be turned off in most places that have it, so ideally the user should be abl…

> URL prefetching is usually only expected to happen "on demand" while you're using stuff

I don't think this is my expectation. When I receive messages overnight, I want URLs in those messages prefetched, for example. The whole point is that when I open my mail or messages the previews are already available, instead of waiting.

Re: QR code images in macOS are silently executed in the background hours/days later

#66

Post by joshstrange »

captainmuon wrote: post #62
joshstrange wrote: post #27

Other thread on this: https://news.ycombinator.com/item?id=33095608 My comment from there: I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor open…

My M1 Mac does OCR on images. You can select text in bitmaps, look up words, and it highlights phone numbers and dates. Maybe this feature is related? Try highlighting the file using finder or viewing with quickview. Maybe you have to be on M1, too.

I'm on an M1 Max, I tried QL and opening it preview but it didn't trigger anything. I also tried scanning the QR from my iPhone and nothing came through until I clicked on the link.

Re: QR code images in macOS are silently executed in the background hours/days later

#67

Post by rhd »

grooot wrote: post #50
f1shy wrote: post #42

Earlier quoted context omitted.

I've just reproduced it. Went to a qr-code generator online, generated a code with an url http://xxx.xxx.xxx.xxx In a terminal i did "sudo tcpdump ip host xxx.xxx.xxx.xxx" Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. uname -a: Darwin Kernel Version 21.6.0: Mon Aug 22 20:17:10 PDT 2022; root:xnu-8020.140.49~2/RELEASE_X86_64 x86_64 Really shitty idea from apple..…

Isn’t this just URL prefetching extended to QR codes? I don’t see what the fuss is about, unless there is some innuendo that data is being sent to Apple.

There could be privacy concerns where Apple isn't the party using the data, but has allowed a third party access unintentionally.

I don't know if this would be possible given the limited information currently available, but an example may be:

User attempts to browse anonymously through the use of A VPN, obscuring their residential IP. Website, or third party analytics on a website generate unique links and embed them in QR codes hidden on the page. A twist on tracking pixels. Browser requests, and caches image containing QR code on disk. Later, after user has disconnected from VPN their OS indexes images on the filesystem (for search purposes, or whatever, parses the QR code and requests the url contained. Malicious site/analytics firm now has additional data point (residential IP, not obscured by VPN) to correlate against.

There's also the remote potential that the QR code parsing/request functionality could have vulnerabilities. The behavior known doesn't indicate that, but it might result in exploitation with less human interaction if they are found.

Re: QR code images in macOS are silently executed in the background hours/days later

#68

Post by mixmastamyk »

rgovostes wrote: post #46
f1shy wrote: post #42

Earlier quoted context omitted.

I've just reproduced it. Went to a qr-code generator online, generated a code with an url http://xxx.xxx.xxx.xxx In a terminal i did "sudo tcpdump ip host xxx.xxx.xxx.xxx" Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. uname -a: Darwin Kernel Version 21.6.0: Mon Aug 22 20:17:10 PDT 2022; root:xnu-8020.140.49~2/RELEASE_X86_64 x86_64 Really shitty idea from apple..…

Counterpoint: I did the same thing and used Little Snitch to try to catch a request, and did not see one. If there had been one, it would have attributed it to a particular process.

Hours/days later.

Re: QR code images in macOS are silently executed in the background hours/days later

#69

Post by jabbany »

grooot wrote: post #58
matt-attack wrote: post #56

Earlier quoted context omitted.

Prefetching is usually a function of a web-browser in response to navigating to a page which contains links. I think the concern is that Safari is not involved at all here. This is the OS doing the prefetch by examining just a file saved to the filesystem.

Sure but as has been pointed out, the likely explanation is that this is a function being performed locally for indexing or thumb nail generation. Nobody has come close to showing anything malicious or that data is being exfiltrated, so why is this a problem?

> that data is being exfiltrated

Multiple bits of information are exfiltrated actually, and to a 3rd party (if it turns out the behavior is as described). The obvious one is your IP, which allows for some coarse geolocation. Also implicitly they would know you're running macOS.

The main thing this breaks down is that it assumes that if you have a QR code with a URL saved, then you must trust the target enough to let them see your IP. However, clearly not everyone agrees.

Re: QR code images in macOS are silently executed in the background hours/days later

#70

Post by joshstrange »

mixmastamyk wrote: post #68
rgovostes wrote: post #46

Earlier quoted context omitted.

Counterpoint: I did the same thing and used Little Snitch to try to catch a request, and did not see one. If there had been one, it would have attributed it to a particular process.

Hours/days later.

> Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip.

The person they are replying to said it happened instantly in their test.

Post reply on HN