Quoted post unavailable.
Or an "influencer" with many followers could post the barcode and create a DDoS attack.
Only if the followers “save” the image into their photos, no?
QR code images in macOS are silently executed in the background hours/days later
21–30 of 111 posts
Re: QR code images in macOS are silently executed in the background hours/days later
#22Earlier quoted context omitted.
Or an "influencer" with many followers could post the barcode and create a DDoS attack.
Only if the followers “save” the image into their photos, no?
Ah, looks like I misunderstood. I thought that it was just seeing it in the web browser, period. So this is some kind of thumbnail gneration thing.
Re: QR code images in macOS are silently executed in the background hours/days later
#23It could be an AV engine doing it. Some phishing attacks have switched to using QR codes instead of links as an evasion technique in the last couple of years, so the anti-evasion to that is decode it and browse the link to see if it's malicious.
“This link might be dangerous - better click on it!”
I’d suspect it’s indexing for search rather than a security protocol - i feel like anybody security minded would have approached this differently
Re: QR code images in macOS are silently executed in the background hours/days later
#24Quoted post unavailable.
Well the scanning is supposed to be local. It's not uploading your photos or anything. You can turn it off in System Preferences -> Spotlight -> Privacy. Or go further and remove Spotlight https://cleanmymac.com/faq/how-to-turn-off-spotlight-search-... Not positive this works on the latest hardware.
Which results in that NOTHING works anymore.
File search, email search. Literally nothing will work anymore.
Re: QR code images in macOS are silently executed in the background hours/days later
#25Earlier quoted context omitted.
Well the scanning is supposed to be local. It's not uploading your photos or anything. You can turn it off in System Preferences -> Spotlight -> Privacy. Or go further and remove Spotlight https://cleanmymac.com/faq/how-to-turn-off-spotlight-search-... Not positive this works on the latest hardware.
Which results in that NOTHING works anymore. File search, email search. Literally nothing will work anymore.
Yes, good disclaimer. That's what happens when you turn off local scanning.
Re: QR code images in macOS are silently executed in the background hours/days later
#26Quoted post unavailable.
No post body was provided.
Re: QR code images in macOS are silently executed in the background hours/days later
#27Other thread on this: https://news.ycombinator.com/item?id=33095608
My comment from there:
I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor opening it Preview, nor scanning it with my iPhone, the only thing that caused a request was clicking on the detected link in my iPhone camera app. Obviously if this is a background daemon that runs periodically then my test wouldn't catch it (unless I got "lucky") and for a longer-term test I'd probably want to use something other than request bin. That said request bin says it keeps bins for 48 hours so that might be enough time.
Re: QR code images in macOS are silently executed in the background hours/days later
#28Earlier quoted context omitted.
I am more worried about browsing Reddit, and steganography has put that horrible things into it, so I am looking at a picture of a tree and something horrible is in it. Seriously, imagine a tree being 'bound' to evil. A high school friend Bruce told me about that and I flipped the fuck out. That guy told me that and I went what the fuck is wrong with people. I want to browse a decent godddamn internet. It should have…
> The US government isn't that fucked up Well, as it is worth remembering, we killed 286,000 (mostly innocent) people in 3 days to win a war... > Cops just sprinkle crack on people. I wouldn't blame cops - I'd blame the FBI. If they planted it, and said you had it because they investigate that kind of thing (and they have tons of examples for material), you're screwed. Very convenient way to silence a dissident and s…
[deleted]
Re: QR code images in macOS are silently executed in the background hours/days later
#29Earlier quoted context omitted.
Only if the followers “save” the image into their photos, no?
Ah, looks like I misunderstood. I thought that it was just seeing it in the web browser, period. So this is some kind of thumbnail gneration thing.
Might be cached though. Who knows if that could be picked up.
Re: QR code images in macOS are silently executed in the background hours/days later
#30Other thread on this: https://news.ycombinator.com/item?id=33095608 My comment from there: I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor open…
The original twitter threads talks about "a couple of days ago".. so that it didn't do it in 10 minutes, is not that surprising. Also not sure if your 48 hours will be enough if I go from the original thread from the person who found the issue.