Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

QR code images in macOS are silently executed in the background hours/days later

twitter.com

Post reply on HN
Print view View original

71–80 of 111 posts

Re: QR code images in macOS are silently executed in the background hours/days later

#71

Post by grooot »

haswell wrote: post #64
grooot wrote: post #58

Earlier quoted context omitted.

Sure but as has been pointed out, the likely explanation is that this is a function being performed locally for indexing or thumb nail generation. Nobody has come close to showing anything malicious or that data is being exfiltrated, so why is this a problem?

“Downloading image causes outbound http requests against arbitrary endpoints” Pair this with a zero-day in the HTTP request library and an image becomes the initiation of an attack that leads to a vulnerable client connecting to a malicious endpoint. Could also easily be used to track users in new ways. Just two scenarios that immediately comes to mind.

No post body was provided.

Re: QR code images in macOS are silently executed in the background hours/days later

#72

Post by reaperducer »

bfgoodrich wrote: post #26
xnickb wrote: post #9

Quoted post unavailable.

Quoted post unavailable.

The appearance of the word "fanboy" in a comment virtually guarantees that the speaker is a moron saying nothing of value.

Also the presence of "lol" in a comment, which is has recently become very common on HN.

Re: QR code images in macOS are silently executed in the background hours/days later

#73

Post by jabbany »

jdminhbg wrote: post #65
jabbany wrote: post #59

Earlier quoted context omitted.

Similar privacy issues of URL prefetching aside, this is actually not exactly the same. URL prefetching is usually only expected to happen "on demand" while you're using stuff (e.g. generating link previews when they appear). What's described here seems to imply it is preemptively happening to files "at rest". Also, automatic prefetching can be turned off in most places that have it, so ideally the user should be abl…

> URL prefetching is usually only expected to happen "on demand" while you're using stuff I don't think this is my expectation. When I receive messages overnight, I want URLs in those messages prefetched, for example. The whole point is that when I open my mail or messages the previews are already available, instead of waiting.

That still implies that you are actively "using" the messaging application. Just because it is listening to messages in this case doesn't mean it's inactive, you still expect it to push stuff to you.

However in the case of the QR code, just because you "have" the QR code on your disk, doesn't imply you have an intent to visit a link it. That would be like if you had a .txt file with a string that looked like a URL inside and somehow the system while indexing the body also somehow visits the supposed URL despite it not even being a real link.

Like imagine you download a restaurant menu to check out the food and they provided it as an image (pretty standard). As a part of that image is a QR code to their Facebook page (also usually benign). In this case, let's say you are uninterested in sharing your (or specifically your IP's) interest in that restaurant with Facebook, this feature as described would share the info for you without consent.

Re: QR code images in macOS are silently executed in the background hours/days later

#74

Post by sp332 »

jeromegv wrote: post #41
lizardactivist wrote: post #14

Quoted post unavailable.

None of this is confirmed, just a single person was able to reproduce that.

You can make your own canary tokens for free using https://canarytokens.org/generate

Re: QR code images in macOS are silently executed in the background hours/days later

#75

Post by _visgean »

zimpenfish wrote: post #52
f1shy wrote: post #42

Earlier quoted context omitted.

I've just reproduced it. Went to a qr-code generator online, generated a code with an url http://xxx.xxx.xxx.xxx In a terminal i did "sudo tcpdump ip host xxx.xxx.xxx.xxx" Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. uname -a: Darwin Kernel Version 21.6.0: Mon Aug 22 20:17:10 PDT 2022; root:xnu-8020.140.49~2/RELEASE_X86_64 x86_64 Really shitty idea from apple..…

I generated a QR code locally, saved it to Downloads; created a QR code online, downloaded it to Downloads; created a QR code online, downloaded it, added it to Photos, deleted it from Downloads immediately. Thus far, after 20 minutes, of those 3 QR codes with distinct URLs, not one has been hit by anything. Will keep monitoring though.

did you keep leave your computer idle? Afaik most of the photos functionality executes when the computer is plugged in and is not executing anything else..

Re: QR code images in macOS are silently executed in the background hours/days later

#76

Post by sleepybrett »

zimpenfish wrote: post #52
f1shy wrote: post #42

Earlier quoted context omitted.

I've just reproduced it. Went to a qr-code generator online, generated a code with an url http://xxx.xxx.xxx.xxx In a terminal i did "sudo tcpdump ip host xxx.xxx.xxx.xxx" Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. uname -a: Darwin Kernel Version 21.6.0: Mon Aug 22 20:17:10 PDT 2022; root:xnu-8020.140.49~2/RELEASE_X86_64 x86_64 Really shitty idea from apple..…

I generated a QR code locally, saved it to Downloads; created a QR code online, downloaded it to Downloads; created a QR code online, downloaded it, added it to Photos, deleted it from Downloads immediately. Thus far, after 20 minutes, of those 3 QR codes with distinct URLs, not one has been hit by anything. Will keep monitoring though.

My guess is that it's some part of the spotlight indexing process.

Re: QR code images in macOS are silently executed in the background hours/days later

#77

Post by _visgean »

joshstrange wrote: post #27

Other thread on this: https://news.ycombinator.com/item?id=33095608 My comment from there: I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor open…

most of the photos context scans (face detection etc) occurs when the computer is idle and plugged in.. I am sure this is just another background task..

Re: QR code images in macOS are silently executed in the background hours/days later

#78

Post by sleepybrett »

rgovostes wrote: post #46
f1shy wrote: post #42

Earlier quoted context omitted.

I've just reproduced it. Went to a qr-code generator online, generated a code with an url http://xxx.xxx.xxx.xxx In a terminal i did "sudo tcpdump ip host xxx.xxx.xxx.xxx" Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. uname -a: Darwin Kernel Version 21.6.0: Mon Aug 22 20:17:10 PDT 2022; root:xnu-8020.140.49~2/RELEASE_X86_64 x86_64 Really shitty idea from apple..…

Counterpoint: I did the same thing and used Little Snitch to try to catch a request, and did not see one. If there had been one, it would have attributed it to a particular process.

My understanding is that little snitch doesn't catch some requests by apple owned processes.

Re: QR code images in macOS are silently executed in the background hours/days later

#79

Post by [deleted] »

rgovostes wrote: post #37

I am skeptical. So far there is only a single report of this, triggering at 8:08 am local time (according to OP's bio). If it were the middle of the night, doing some kind of dark wake background scan, it would sound more plausible. During normal user hours? Is it not possible he accidentally triggered it? The user agent is the one used by the Link Presentation framework. It shouldn't be too much to dig through the s…

[deleted]

Re: QR code images in macOS are silently executed in the background hours/days later

#80

Post by Nextgrid »

sleepybrett wrote: post #78
rgovostes wrote: post #46

Earlier quoted context omitted.

Counterpoint: I did the same thing and used Little Snitch to try to catch a request, and did not see one. If there had been one, it would have attributed it to a particular process.

My understanding is that little snitch doesn't catch some requests by apple owned processes.

I believe that's now been rolled back - at least on my machine, LS is indeed catching a lot of Apple processes.
Post reply on HN