Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

QR code images in macOS are silently executed in the background hours/days later

twitter.com

Post reply on HN
Print view View original

81–90 of 111 posts

Re: QR code images in macOS are silently executed in the background hours/days later

#81

Post by DigiDigiorno »

navigate8310 wrote: post #51
bfgoodrich wrote: post #26

Earlier quoted context omitted.

Quoted post unavailable.

Sometimes, I believe HN is becoming Reddit albeit a very slow process, but it will happen eventually.

As voting based social communities become more popular, the more nuanced commentary get's drowned out by the popular viewpoint. The issue isn't the site being "too mainstream", the issue is that the nuance gets lost amongst the noise with social voting. I'm not sure if it is because of the appeal of the popular viewpoint itself, or if it is because of the amount of posts containing it.

Reddit 10+ years ago had, what I consider, great commentary on the default subs/frontpage—it was very different than the Reddit of today.

"Good" social voting sites get more popular with time; I agree with you and think it's almost inevitable that HackerNews will too. My philosophy on this is to just enjoy the site while it's in the state of popularity you like, and try to find a new one when it happens. Yearning for yesteryear isn't exactly productive. ('Better to have loved and lost than never to have loved at all'?)

My take: HackerNews is still quite niche in comparison. I'd estimate the comment volume is one or two orders of magnitude away from the point where it becomes too noisy to find the nuance.

Re: QR code images in macOS are silently executed in the background hours/days later

#82

Post by f1shy »

zimpenfish wrote: post #52
f1shy wrote: post #42

Earlier quoted context omitted.

I've just reproduced it. Went to a qr-code generator online, generated a code with an url http://xxx.xxx.xxx.xxx In a terminal i did "sudo tcpdump ip host xxx.xxx.xxx.xxx" Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. uname -a: Darwin Kernel Version 21.6.0: Mon Aug 22 20:17:10 PDT 2022; root:xnu-8020.140.49~2/RELEASE_X86_64 x86_64 Really shitty idea from apple..…

I generated a QR code locally, saved it to Downloads; created a QR code online, downloaded it to Downloads; created a QR code online, downloaded it, added it to Photos, deleted it from Downloads immediately. Thus far, after 20 minutes, of those 3 QR codes with distinct URLs, not one has been hit by anything. Will keep monitoring though.

mmmm now I'm trying again, but does not work... I will keep trying. For the record, before I did it 3 times in a row to be sure. But now it does not happen :S

Re: QR code images in macOS are silently executed in the background hours/days later

#83

Post by amtamt »

QR code scanner should be passing and opening the url with the default url handlar, http/ sms/ deeplink to app within phone. This can be a pretty scary attack vector where a popular compromised QR code scanner is used with images sent in SPAM folders, which are processed offline, possibility sending out everything a user id has access to.

Re: QR code images in macOS are silently executed in the background hours/days later

#84

Post by f1shy »

joshstrange wrote: post #47
f1shy wrote: post #42

Earlier quoted context omitted.

I've just reproduced it. Went to a qr-code generator online, generated a code with an url http://xxx.xxx.xxx.xxx In a terminal i did "sudo tcpdump ip host xxx.xxx.xxx.xxx" Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. uname -a: Darwin Kernel Version 21.6.0: Mon Aug 22 20:17:10 PDT 2022; root:xnu-8020.140.49~2/RELEASE_X86_64 x86_64 Really shitty idea from apple..…

I'm not saying it's not happening but I just did this (with both a public and private IP) and was unable to produce. For reference I used the following: * https://www.the-qrcode-generator.com/ - for the QR Code * http://10.0.1.202 and http://8.8.8.8 - for the urls * Command + Shift + 4 - To select the area of the screen with the QR code (using the native screenshot tool, I disabled CleanShotX)

My bad. Sorry, look edit.

Re: QR code images in macOS are silently executed in the background hours/days later

#85

Post by daneel_w »

jbverschoor wrote: post #24
sp332 wrote: post #20

Earlier quoted context omitted.

Well the scanning is supposed to be local. It's not uploading your photos or anything. You can turn it off in System Preferences -> Spotlight -> Privacy. Or go further and remove Spotlight https://cleanmymac.com/faq/how-to-turn-off-spotlight-search-... Not positive this works on the latest hardware.

Which results in that NOTHING works anymore. File search, email search. Literally nothing will work anymore.

"NOTHING, literally nothing works anymore" is an alarmist exaggeration, even if you would do the ham-fisted thing of adding your entire home directory to Spotlight's exclusion list. The sane and logical option is to add only your Pictures directory (or whatever folders you keep images in) to the exclusion list.

Re: QR code images in macOS are silently executed in the background hours/days later

#86

Post by woojoo666 »

rhd wrote: post #67
grooot wrote: post #50

Earlier quoted context omitted.

Isn’t this just URL prefetching extended to QR codes? I don’t see what the fuss is about, unless there is some innuendo that data is being sent to Apple.

There could be privacy concerns where Apple isn't the party using the data, but has allowed a third party access unintentionally. I don't know if this would be possible given the limited information currently available, but an example may be: User attempts to browse anonymously through the use of A VPN, obscuring their residential IP. Website, or third party analytics on a website generate unique links and embed them…

Wow, yes this does seem like a potential tracking use case. Especially if the user is rotating VPN servers to anonymize further, the cached QR code could be used as a persistent identifier

Re: QR code images in macOS are silently executed in the background hours/days later

#87

Post by mixmastamyk »

joshstrange wrote: post #70
mixmastamyk wrote: post #68

Earlier quoted context omitted.

Hours/days later.

> Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. The person they are replying to said it happened instantly in their test.

But not necessarily.

Re: QR code images in macOS are silently executed in the background hours/days later

#88

Post by hamasho »

grooot wrote: post #50
f1shy wrote: post #42

Earlier quoted context omitted.

I've just reproduced it. Went to a qr-code generator online, generated a code with an url http://xxx.xxx.xxx.xxx In a terminal i did "sudo tcpdump ip host xxx.xxx.xxx.xxx" Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. uname -a: Darwin Kernel Version 21.6.0: Mon Aug 22 20:17:10 PDT 2022; root:xnu-8020.140.49~2/RELEASE_X86_64 x86_64 Really shitty idea from apple..…

Isn’t this just URL prefetching extended to QR codes? I don’t see what the fuss is about, unless there is some innuendo that data is being sent to Apple.

One way to exploit this is to send the QR code through email or messaging app. When I open the email or see the message, the image may be downloaded, scan starts, and it makes requests which expose my information, including IP, without realizing it.

Re: QR code images in macOS are silently executed in the background hours/days later

#89

Post by kennywinker »

matai_kolila wrote: post #60
kennywinker wrote: post #23

Earlier quoted context omitted.

“This link might be dangerous - better click on it!” I’d suspect it’s indexing for search rather than a security protocol - i feel like anybody security minded would have approached this differently

The language used throughout this thread is terrible; "better click on it" you think an AV is literally loading up a full browser and forcing it to navigate to a random link it finds in a QR code on an image? Even the title uses the word "executed" as if a QR code is "runnable" in some way; it's not. QR code related hacks are not some magical "scan this image and get pwnd", they're related to browser exploits and oth…

No, I don't think it's loading up a full browser - I think it's sending an HTTP request and then parsing the results to some degree. To whatever extent the HTTP request mechanism is secure, and the parsing mechanism is secure, it's secure. But you don't need a browser to have security holes - anything parsing random data from the internet could be a vector.

That said, I agree - parsing the QR code itself isn't really a vector I'd worry much about.

Re: QR code images in macOS are silently executed in the background hours/days later

#90

Post by zimpenfish »

_visgean wrote: post #75
zimpenfish wrote: post #52

Earlier quoted context omitted.

I generated a QR code locally, saved it to Downloads; created a QR code online, downloaded it to Downloads; created a QR code online, downloaded it, added it to Photos, deleted it from Downloads immediately. Thus far, after 20 minutes, of those 3 QR codes with distinct URLs, not one has been hit by anything. Will keep monitoring though.

did you keep leave your computer idle? Afaik most of the photos functionality executes when the computer is plugged in and is not executing anything else..

It was just plugged in and idle for 60 minutes. Still no URL activity but the QR code I saved to Photos has been synced to my iPhone and iPad (indicating that Photos scanning and syncing has, to some extent, happened.)
Post reply on HN