macOS is background scanning and following downloaded QR codes? • Hacker News Board

Re: macOS is background scanning and following downloaded QR codes?

#41

Post by vorpalhex » Wed, Oct 05, 2022, 4:48 PM UTC

grooot wrote: post #24

vorpalhex wrote: post #22

Earlier quoted context omitted.

Having read the article I entirely understand what is going on here. Do you expect your images to be scanned on disk and the links in them to be opened, leaking your ip? What if you do something as simple as screenshot an address bar in a browser? Save a menu QR code? Now you are sending out traffic, accidentally, with your full ip to random places due to a service Apple inserted that you have no knowledge of.

Do you seriously believe that your IP is private? Do you know every site that has received your ip address? I think the honest answer to both of these questions has to be no.

http://letstrack.you/?id=grooot

Throw that to disk for me so I can map where you are, where you go, when your machine is up and how often your search indexing runs.

Re: macOS is background scanning and following downloaded QR codes?

#42

Post by lapcat » Wed, Oct 05, 2022, 4:48 PM UTC

sleepybrett wrote: post #28

Liquid_Fire wrote: post #6

Earlier quoted context omitted.

The Twitter thread says it was created "a few days ago" and was hit "this morning" so I'm guessing 10 minutes might not be enough (if it is even something time-based).

I'm willing to bet that if you triggered a spotlight database rebuild that it would be triggered in that process. My guess is that spotlight sees an image to index, ocrs all the text and adds it to the index. It probably also detects qr codes and generates a 'preview' of their content by following the link. Possible it may also do that if you were to take a picture of a url clearly enough that it could be OCRed.

You can use the mdimport command-line tool to manually index individual files.

Re: macOS is background scanning and following downloaded QR codes?

#43

Post by lilyball » Wed, Oct 05, 2022, 4:48 PM UTC

paxys wrote: post #23

So, if I send you a QR code via iMessage the URL in it will automatically be hit, using your IP address and browser/OS details . Wow that's quite an attack vector.

Nobody said that.

Re: macOS is background scanning and following downloaded QR codes?

#44

Post by grooot » Wed, Oct 05, 2022, 4:50 PM UTC

vorpalhex wrote: post #41

grooot wrote: post #24

Earlier quoted context omitted.

Do you seriously believe that your IP is private? Do you know every site that has received your ip address? I think the honest answer to both of these questions has to be no.

http://letstrack.you/?id=grooot Throw that to disk for me so I can map where you are, where you go, when your machine is up and how often your search indexing runs.

No post body was provided.

Re: macOS is background scanning and following downloaded QR codes?

#45

Post by [deleted] » Wed, Oct 05, 2022, 4:51 PM UTC

grooot wrote: post #20

vorpalhex wrote: post #18

Earlier quoted context omitted.

Scanning your images and followong links in them without user consent is pretty malicious.

What are you talking about? It sounds like you don’t understand what is going on here. Perhaps you think some data is going to Apple?

[deleted]

Re: macOS is background scanning and following downloaded QR codes?

#46

Post by fishywang » Wed, Oct 05, 2022, 4:51 PM UTC

grooot wrote: post #40

fishywang wrote: post #37

Earlier quoted context omitted.

>It's not so different from when you text someone a URL in Messages, it automatically shows a title and thumbnail to both parties. And that's how the pegasus/etc. pwned iPhones

It was before the zero day was closed.

so you are saying apple is doing something they already knew is a bad idea?

Re: macOS is background scanning and following downloaded QR codes?

#47

Post by grooot » Wed, Oct 05, 2022, 4:52 PM UTC

fishywang wrote: post #46

grooot wrote: post #40

Earlier quoted context omitted.

It was before the zero day was closed.

so you are saying apple is doing something they already knew is a bad idea?

No. I’m saying your information is outdated and wrong.

Re: macOS is background scanning and following downloaded QR codes?

#48

Post by LeifCarrotson » Wed, Oct 05, 2022, 4:52 PM UTC

smoldesu wrote: post #9

crazygringo wrote: post #4

"Background scanning" sounds more nefarious than what's probably really going on -- which is probably either generating thumbnail previews (for Finder) or indexing (for Spotlight), both of which are desired. Or maybe malware scanning to put files in quarantine if they point to dangerous content? macOS is also becoming more intelligent about text in images, e.g. it OCR's images so you can select text. I don't know if…

I feel like there are better ways to do this, to the point that this 'feature' actually looks really out-of-place. Why wouldn't you get these thumbnail previews when you actually scan the QR Code? You're going to be fetching/caching the favicon and framebuffer for the page anyways, there's literally no reason not to get that data at runtime rather than 3 hours later. It's not exactly malicious, but weird "we know bet…

> Why wouldn't you get these thumbnail previews when you actually scan the QR Code?

These aren't scanned, they're located inside .png image files you can download or generate locally on your computer.

> You're going to be fetching/caching the favicon and framebuffer for the page anyways, there's literally no reason not to get that data at runtime rather than 3 hours later.

No one asked the OS to fetch the favicon/framebuffer. Also, I would prefer the favicon of an image containing a QR code to be a thumbnail of the QR code, not the page it points to. I expect this delay is not a nefarious Little Snitch bypassing tool but a search cache update process that only runs when the computer is very idle. Better to run background tasks lazily than every time you commit an image that might contain a QR code to the filesystem.

Re: macOS is background scanning and following downloaded QR codes?

#49

Post by grooot » Wed, Oct 05, 2022, 4:53 PM UTC

smoldesu wrote: post #35

grooot wrote: post #17

Earlier quoted context omitted.

There is absolutely nothing malicious that has been shown.

I agree. The problem is that it's rather annoying, and there are many such behaviors on MacOS (many of which you can't disable). Stuff like this is another good example of esoteric, almost curious behavior taking place without any input or prompt from the user. It's really absurd stuff.

No post body was provided.

Re: macOS is background scanning and following downloaded QR codes?

#50

Post by crazygringo » Wed, Oct 05, 2022, 4:58 PM UTC

paxys wrote: post #23

So, if I send you a QR code via iMessage the URL in it will automatically be hit, using your IP address and browser/OS details . Wow that's quite an attack vector.

If you send me the URL directly it will be hit. A QR code wouldn't even add anything. And it's worked that way for many years, iMessage showing link previews.