Quoted post unavailable.
Ubuntu and Windows also scan your filesystem to build search indexes. That's how search indexes work.
QR code images in macOS are silently executed in the background hours/days later
31–40 of 111 posts
Re: QR code images in macOS are silently executed in the background hours/days later
#32It could be an AV engine doing it. Some phishing attacks have switched to using QR codes instead of links as an evasion technique in the last couple of years, so the anti-evasion to that is decode it and browse the link to see if it's malicious.
“This link might be dangerous - better click on it!” I’d suspect it’s indexing for search rather than a security protocol - i feel like anybody security minded would have approached this differently
Antivirus software isn’t known for being security-minded. Running potential malware in a buggy kernel-space sandbox comes to mind.
Re: QR code images in macOS are silently executed in the background hours/days later
#33Earlier quoted context omitted.
Well the scanning is supposed to be local. It's not uploading your photos or anything. You can turn it off in System Preferences -> Spotlight -> Privacy. Or go further and remove Spotlight https://cleanmymac.com/faq/how-to-turn-off-spotlight-search-... Not positive this works on the latest hardware.
Which results in that NOTHING works anymore. File search, email search. Literally nothing will work anymore.
No post body was provided.
Re: QR code images in macOS are silently executed in the background hours/days later
#34> And sure, just browsing the web "exposes your IP address" so this may not be the most impactful privacy issue, but it's surprising and unexpected behavior
Well, it's certainly fantastic for fingerprinting. You could put some UUID in the QR code and have macOS tell you who the IP address is every few days.
Re: QR code images in macOS are silently executed in the background hours/days later
#35Re: QR code images in macOS are silently executed in the background hours/days later
#36It could be an AV engine doing it. Some phishing attacks have switched to using QR codes instead of links as an evasion technique in the last couple of years, so the anti-evasion to that is decode it and browse the link to see if it's malicious.
“This link might be dangerous - better click on it!” I’d suspect it’s indexing for search rather than a security protocol - i feel like anybody security minded would have approached this differently
If you've ever seen Tavis Ormandy and P0's analysis of AV software, you know this isn't actually far-fetched. A lot of these products have horrifying vulnerabilities.
Re: QR code images in macOS are silently executed in the background hours/days later
#37I am skeptical. So far there is only a single report of this, triggering at 8:08 am local time (according to OP's bio). If it were the middle of the night, doing some kind of dark wake background scan, it would sound more plausible. During normal user hours? Is it not possible he accidentally triggered it?
The user agent is the one used by the Link Presentation framework. It shouldn't be too much to dig through the shared cache for binaries that link to this framework and see if there are any QuickLook ones.
Moreover joshstrange in this thread and others I know from elsewhere aren't able to reproduce. Yet the original unsubstantiated tweet has 500 retweets and will probably reach thousands as the west coast logs in this morning.
Re: QR code images in macOS are silently executed in the background hours/days later
#38> And sure, just browsing the web "exposes your IP address" so this may not be the most impactful privacy issue, but it's surprising and unexpected behavior Well, it's certainly fantastic for fingerprinting. You could put some UUID in the QR code and have macOS tell you who the IP address is every few days.
It also feels like something that would leak across VPN/proxy/ISP changes. "This tracking code was loaded first from this residential IP, then this coffee shop IP, then this VPN IP" tells quite a story!
Re: QR code images in macOS are silently executed in the background hours/days later
#39It could be an AV engine doing it. Some phishing attacks have switched to using QR codes instead of links as an evasion technique in the last couple of years, so the anti-evasion to that is decode it and browse the link to see if it's malicious.
“This link might be dangerous - better click on it!” I’d suspect it’s indexing for search rather than a security protocol - i feel like anybody security minded would have approached this differently
I hate AV scanners, they consume one-time URLs in many cases (Salesforce password resets just don't work for me).
Re: QR code images in macOS are silently executed in the background hours/days later
#40Earlier quoted context omitted.
I am more worried about browsing Reddit, and steganography has put that horrible things into it, so I am looking at a picture of a tree and something horrible is in it. Seriously, imagine a tree being 'bound' to evil. A high school friend Bruce told me about that and I flipped the fuck out. That guy told me that and I went what the fuck is wrong with people. I want to browse a decent godddamn internet. It should have…
> The US government isn't that fucked up Well, as it is worth remembering, we killed 286,000 (mostly innocent) people in 3 days to win a war... > Cops just sprinkle crack on people. I wouldn't blame cops - I'd blame the FBI. If they planted it, and said you had it because they investigate that kind of thing (and they have tons of examples for material), you're screwed. Very convenient way to silence a dissident and s…
I've literally had a cop plant drugs on me, and one of my hometowns recently had a big bombshell where a bunch of cops were indicted for doing the same thing, so I'm not sure you know what you're talking about.