9 ms·

macOS is background scanning and following downloaded QR codes?

213 points by mik3y 4y ago

dt3ft 4y ago
Was anyone else able to confirm this?
maxehmookau 4y ago
This happened to me last week and I ignored it thinking maybe I did something wrong and Apple wouldn't be so silly to build in an attack vector like this in to their software. It was between two devices on the same Apple ID though via AirDrop, so maybe it only did it because the device was "trusted".
crazygringo 4y ago
"Background scanning" sounds more nefarious than what's probably really going on -- which is probably either generating thumbnail previews (for Finder) or indexing (for Spotlight), both of which are desired. Or maybe malware scanning to put files in quarantine if they point to dangerous content? macOS is also becoming more intelligent about text in images, e.g. it OCR's images so you can select text. I don't know if it indexes text in images for Spotlight the way Google has already done in Drive for years. But I wouldn't be surprised if it fetches URL's in QR codes in order to index the title text associated with the URL for Spotlight. It's not so different from when you text someone a URL in Messages, it automatically shows a title and thumbnail to both parties. Or, if it's just a shared "preview" library used across thumbnails and iMessage. I'm not sure what to think about it. Previews, smart text, showing URL information on hover, prefetching, indexing, etc. -- it's all pretty standard stuff. On the other hand, it does feel a little weird for previews on a local filesystem to query the internet -- we're totally used to it in e-mail and messaging though. But, I used to keep bookmarks as URL (.url) files. It would seem natural for a thumbnail of the page to show up in Finder (though I don't think it does this?). As for it being an "attack" to get someone's IP -- seems like that ship has long since sailed, as it's common for any messaging and e-mail client to already show previews. If you need to protect yourself against all of those, you pretty much need to figure out what level of Little Snitch or turning off internet or airgapping is required for your security concerns.
- smoldesu 4y ago
  I feel like there are better ways to do this, to the point that this 'feature' actually looks really out-of-place. Why wouldn't you get these thumbnail previews when you actually scan the QR Code? You're going to be fetching/caching the favicon and framebuffer for the page anyways, there's literally no reason not to get that data at runtime rather than 3 hours later. It's not exactly malicious, but weird "we know better than you" behavior like this ultimately drove me away from MacOS as a daily-driver.
  - grooot 4y ago
    There is absolutely nothing malicious that has been shown.
    - vorpalhex 4y ago
      Scanning your images and followong links in them without user consent is pretty malicious.
      - grooot 4y ago
        What are you talking about? It sounds like you don’t understand what is going on here. Perhaps you think some data is going to Apple?
        vorpalhex 4y ago
        Having read the article I entirely understand what is going on here. Do you expect your images to be scanned on disk and the links in them to be opened, leaking your ip? What if you do something as simple as screenshot an address bar in a browser? Save a menu QR code? Now you are sending out traffic, accidentally, with your full ip to random places due to a service Apple inserted that you have no knowledge of.
        grooot 4y ago
joshstrange 4y ago
I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor opening it Preview, nor scanning it with my iPhone, the only thing that caused a request was clicking on the detected link in my iPhone camera app. Obviously if this is a background daemon that runs periodically then my test wouldn't catch it (unless I got "lucky") and for a longer-term test I'd probably want to use something other than request bin. That said request bin says it keeps bins for 48 hours so that might be enough time. [0] https://requestbin.io/ https://requestbin.io/
- Liquid_Fire 4y ago
  The Twitter thread says it was created "a few days ago" and was hit "this morning" so I'm guessing 10 minutes might not be enough (if it is even something time-based).
  - joshstrange 4y ago
    Absolutely and I called that out, I just thought that opening it in QL/Preview or even scanning on an iPhone might manually kick off the same “processing” that’s being speculated about here.
    - aliqot 4y ago
      I guess we all regroup here in a week or so then, right?
  - sleepybrett 4y ago
    I'm willing to bet that if you triggered a spotlight database rebuild that it would be triggered in that process. My guess is that spotlight sees an image to index, ocrs all the text and adds it to the index. It probably also detects qr codes and generates a 'preview' of their content by following the link. Possible it may also do that if you were to take a picture of a url clearly enough that it could be OCRed.
yellowapple 4y ago
- grooot 4y ago
  - yellowapple 4y ago
    I am, and so is the author of those tweets.
    - grooot 4y ago
      Is your claim that data is being exfiltrated to Apple?
      - yellowapple 4y ago
        Data exfiltration is not necessary for this to be a privacy concern; data becomes a liability as soon as it's collected even locally. EDIT: in this case, however, data exfiltration is happening, by means of Apple's closed-source software blindly sending HTTP requests to unknown servers. Apple might not be the recipient of the exfiltrated data, but the exfiltration is happening nonetheless.
        grooot 4y ago
        yellowapple 4y ago
        > Frankly this is absurd. What's absurd is Apple's software sending requests to random and entirely-unvetted servers without even so much as notifying the user, let alone obtaining consent. > Did you know that the file system of your computer contains your personal data, including files you save? Why yes, and that would just so happen to be the reason why I ain't exactly comfortable with closed-source software silently sifting through it and blindly following anything and everything vaguely resembling a URL or encoding thereof. > EDIT: No, that’s not what exfiltration means. You are simply misusing the word. https://www.fortinet.com/resources/cyberglossary/data-exfiltration https://www.fortinet.com/resources/cyberglossary/data-exfilt...: "A common data exfiltration definition is the theft or unauthorized removal or movement of any data from a device. Data exfiltration typically involves a cyber criminal stealing data from personal or corporate devices, such as computers and mobile phones, through various cyberattack methods. "Another data exfiltration meaning is data exportation and extrusion, data leakage, or data theft, which can pose serious problems for organizations. Failing to control information security can lead to data loss that could cause reputational and financial damage to an organization." Thanks to this crawler, anyone who sends you even so much as a QR-encoded image of a link will know that it was successfully received, that it was a macOS machine that received it, and quite possibly the public IP address of the machine that received it. That's data that's worth preventing disclosure, for the same reasons email clients often don't load images in emails by default.
kgc 4y ago
I'm guessing it's an antivirus/anti-malware operation.
numbsafari 4y ago
Apple should be proxying and caching these results to avoid the risk of exposing client devices, prevent incidental DDOS, as well as the obvious privacy issues.
- martin_a 4y ago
  We'll just switch to user-specific QR codes then, like unique links in spam mails to find out who clicked it.
  - hunter2_ 4y ago
    But if every code you send out gets hit by the proxy regardless of any user action taken, then the hit doesn't tell you anything but "you got the proxy's attention" which isn't much.
    - martin_a 4y ago
      So far only actively downloaded codes seem to trigger this. Put in a dynamically generated "instructions.pdf" which you have to download before opening. I'm sure someone will find a way...
paxys 4y ago
So, if I send you a QR code via iMessage the URL in it will automatically be hit, using your IP address and browser/OS details. Wow that's quite an attack vector.
- lilyball 4y ago
  Nobody said that.
  - spicybright 4y ago
    That's exactly what happens though, and is an obvious method of attack.
    - lilyball 4y ago
      Is it? Has anyone actually tested sending a QR code over iMessage? Because doing that does not generate a link preview, and so there is no reason for Messages.app to be decoding it and fetching the URL. If macOS really is background-scanning all images, and if Messages.app actually writes all received images out to disk as individual image files, then the background scanning could conceivably scan it. However I haven't seen anyone make this claim, it certainly doesn't seem necessary (why write it out to a file on disk?), and if this scanning is triggered by e.g. Spotlight indexing then it wouldn't be indexing cache files anyway. So, has anyone actually demonstrated that sending a QR code over iMessage causes the recipient's device to fetch the URL? Because so far this just seems like complete speculation presented as fact.
      - zimpenfish 4y ago
        > Has anyone actually tested sending a QR code over iMessage? I have, just now. Nothing happened at either end - the URL was not accessed at all. I can get it to recognise it's a QR code on my iPhone by tapping to focus the image, waiting for the OCR badge, tapping that, and then tapping the image again to bring up a small menu with the URL as a title and headed by "Open in Safari". None of those steps accesses the URL. You have to make a conscious action to access the URL...
FollowingTheDao 4y ago
That's It. I am done. Back to Debian Linux full time for me. Anyone want to buy a lightly used MacBook Air M1?
m_st 4y ago
Isn't this like WhatsApp, Teams, Skype and others giving you instant previews of URLs when sending them around? I really hate this feature. Impossible to share 'single hit' URLs as they'll be called already when you want to open them.
- amelius 4y ago
  Single-hit URLs abuse the REST design of HTTP(S).
1970-01-01 4y ago
My first thought was he used Canary tokens. I'm going to try to reproduce it right now, and you can too: https://www.canarytokens.org/generate# https://www.canarytokens.org/generate#
m463 4y ago
I wonder about deep links. I know ios can pass links to apps that register certain URLs. can this happen with qr codes (so although the os doesn't, an app can make the request)
nottorp 4y ago
All browsers now download links in the background in case you click on them by default. A QR code is a kind of link. Why not? Question is, can you disable it?
ballenf 4y ago
I wouldn't be surprised if it turns out that an IOS device has the page open in a tab and refreshes it from time to time. I wish manual refresh was an option, especially for pages with redirects to another app or the AppStore.
lilyball 4y ago
The tweet has now been deleted and the author has retracted his claim. https://twitter.com/hodgesmr/status/1577739222412312578 https://twitter.com/hodgesmr/status/1577739222412312578 https://news.ycombinator.com/item?id=33100130 https://news.ycombinator.com/item?id=33100130
- yellowapple 4y ago
  The explanation for the retraction doesn't explain that user agent string. It's weird enough coming from macOS; it's even weirder coming from Firefox. The behavior's still concerning in any case, whether it's macOS silently doing it or Firefox silently doing it.
  - __ryan__ 4y ago
    The original tweets explained it. The user agent is impersonating a shared Facebook/Twitter/etc link preview/thumbnail. Many sites respond with markup more appropriate for a thumbnail when using that user agent, and if not, it’s unlikely that they serve anything worse, so it’s little harm done.
- woojoo666 4y ago
  The author originally made it sound like they just generated the QR code, saved it, and then left it in the downloads folder. Now they are saying the Firefox "recents" feature on the home screen triggered it. This would have to mean the author already visited the link embedded in the QR code. If the author had mentioned that fact, then internet speculation would have probably figured out the real cause a lot earlier. Though I gotta say, this is still an attack vector that I hadn't considered. If you use a VPN and occasionally rotate IPs, this Firefox "recents" feature can leak your new IP to websites that you previously visited.
olliej 4y ago
This claim has been retracted: https://news.ycombinator.com/item?id=33100130 https://news.ycombinator.com/item?id=33100130

213 points by mik3y 4y ago

Was anyone else able to confirm this?

This happened to me last week and I ignored it thinking maybe I did something wrong and Apple wouldn't be so silly to build in an attack vector like this in to their software. It was between two devices on the same Apple ID though via AirDrop, so maybe it only did it because the device was "trusted".

crazygringo 4y ago

"Background scanning" sounds more nefarious than what's probably really going on -- which is probably either generating thumbnail previews (for Finder) or indexing (for Spotlight), both of which are desired. Or maybe malware scanning to put files in quarantine if they point to dangerous content? macOS is also becoming more intelligent about text in images, e.g. it OCR's images so you can select text. I don't know if it indexes text in images for Spotlight the way Google has already done in Drive for years. But I wouldn't be surprised if it fetches URL's in QR codes in order to index the title text associated with the URL for Spotlight. It's not so different from when you text someone a URL in Messages, it automatically shows a title and thumbnail to both parties. Or, if it's just a shared "preview" library used across thumbnails and iMessage. I'm not sure what to think about it. Previews, smart text, showing URL information on hover, prefetching, indexing, etc. -- it's all pretty standard stuff. On the other hand, it does feel a little weird for previews on a local filesystem to query the internet -- we're totally used to it in e-mail and messaging though. But, I used to keep bookmarks as URL (.url) files. It would seem natural for a thumbnail of the page to show up in Finder (though I don't think it does this?). As for it being an "attack" to get someone's IP -- seems like that ship has long since sailed, as it's common for any messaging and e-mail client to already show previews. If you need to protect yourself against all of those, you pretty much need to figure out what level of Little Snitch or turning off internet or airgapping is required for your security concerns.

smoldesu 4y ago
I feel like there are better ways to do this, to the point that this 'feature' actually looks really out-of-place. Why wouldn't you get these thumbnail previews when you actually scan the QR Code? You're going to be fetching/caching the favicon and framebuffer for the page anyways, there's literally no reason not to get that data at runtime rather than 3 hours later. It's not exactly malicious, but weird "we know better than you" behavior like this ultimately drove me away from MacOS as a daily-driver.
- grooot 4y ago
  There is absolutely nothing malicious that has been shown.
  - vorpalhex 4y ago
    Scanning your images and followong links in them without user consent is pretty malicious.
    - grooot 4y ago
      What are you talking about? It sounds like you don’t understand what is going on here. Perhaps you think some data is going to Apple?
      - vorpalhex 4y ago
        Having read the article I entirely understand what is going on here. Do you expect your images to be scanned on disk and the links in them to be opened, leaking your ip? What if you do something as simple as screenshot an address bar in a browser? Save a menu QR code? Now you are sending out traffic, accidentally, with your full ip to random places due to a service Apple inserted that you have no knowledge of.
        grooot 4y ago

joshstrange 4y ago

I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor opening it Preview, nor scanning it with my iPhone, the only thing that caused a request was clicking on the detected link in my iPhone camera app. Obviously if this is a background daemon that runs periodically then my test wouldn't catch it (unless I got "lucky") and for a longer-term test I'd probably want to use something other than request bin. That said request bin says it keeps bins for 48 hours so that might be enough time. [0] https://requestbin.io/ https://requestbin.io/

Liquid_Fire 4y ago
The Twitter thread says it was created "a few days ago" and was hit "this morning" so I'm guessing 10 minutes might not be enough (if it is even something time-based).
- joshstrange 4y ago
  Absolutely and I called that out, I just thought that opening it in QL/Preview or even scanning on an iPhone might manually kick off the same “processing” that’s being speculated about here.
  - aliqot 4y ago
    I guess we all regroup here in a week or so then, right?
- sleepybrett 4y ago
  I'm willing to bet that if you triggered a spotlight database rebuild that it would be triggered in that process. My guess is that spotlight sees an image to index, ocrs all the text and adds it to the index. It probably also detects qr codes and generates a 'preview' of their content by following the link. Possible it may also do that if you were to take a picture of a url clearly enough that it could be OCRed.

yellowapple 4y ago

grooot 4y ago
- yellowapple 4y ago
  I am, and so is the author of those tweets.
  - grooot 4y ago
    Is your claim that data is being exfiltrated to Apple?
    - yellowapple 4y ago
      Data exfiltration is not necessary for this to be a privacy concern; data becomes a liability as soon as it's collected even locally. EDIT: in this case, however, data exfiltration is happening, by means of Apple's closed-source software blindly sending HTTP requests to unknown servers. Apple might not be the recipient of the exfiltrated data, but the exfiltration is happening nonetheless.
      - grooot 4y ago
        yellowapple 4y ago
        > Frankly this is absurd. What's absurd is Apple's software sending requests to random and entirely-unvetted servers without even so much as notifying the user, let alone obtaining consent. > Did you know that the file system of your computer contains your personal data, including files you save? Why yes, and that would just so happen to be the reason why I ain't exactly comfortable with closed-source software silently sifting through it and blindly following anything and everything vaguely resembling a URL or encoding thereof. > EDIT: No, that’s not what exfiltration means. You are simply misusing the word. https://www.fortinet.com/resources/cyberglossary/data-exfiltration https://www.fortinet.com/resources/cyberglossary/data-exfilt...: "A common data exfiltration definition is the theft or unauthorized removal or movement of any data from a device. Data exfiltration typically involves a cyber criminal stealing data from personal or corporate devices, such as computers and mobile phones, through various cyberattack methods. "Another data exfiltration meaning is data exportation and extrusion, data leakage, or data theft, which can pose serious problems for organizations. Failing to control information security can lead to data loss that could cause reputational and financial damage to an organization." Thanks to this crawler, anyone who sends you even so much as a QR-encoded image of a link will know that it was successfully received, that it was a macOS machine that received it, and quite possibly the public IP address of the machine that received it. That's data that's worth preventing disclosure, for the same reasons email clients often don't load images in emails by default.

kgc 4y ago

I'm guessing it's an antivirus/anti-malware operation.

numbsafari 4y ago

Apple should be proxying and caching these results to avoid the risk of exposing client devices, prevent incidental DDOS, as well as the obvious privacy issues.

martin_a 4y ago
We'll just switch to user-specific QR codes then, like unique links in spam mails to find out who clicked it.
- hunter2_ 4y ago
  But if every code you send out gets hit by the proxy regardless of any user action taken, then the hit doesn't tell you anything but "you got the proxy's attention" which isn't much.
  - martin_a 4y ago
    So far only actively downloaded codes seem to trigger this. Put in a dynamically generated "instructions.pdf" which you have to download before opening. I'm sure someone will find a way...

paxys 4y ago

So, if I send you a QR code via iMessage the URL in it will automatically be hit, using your IP address and browser/OS details. Wow that's quite an attack vector.

lilyball 4y ago
Nobody said that.
- spicybright 4y ago
  That's exactly what happens though, and is an obvious method of attack.
  - lilyball 4y ago
    Is it? Has anyone actually tested sending a QR code over iMessage? Because doing that does not generate a link preview, and so there is no reason for Messages.app to be decoding it and fetching the URL. If macOS really is background-scanning all images, and if Messages.app actually writes all received images out to disk as individual image files, then the background scanning could conceivably scan it. However I haven't seen anyone make this claim, it certainly doesn't seem necessary (why write it out to a file on disk?), and if this scanning is triggered by e.g. Spotlight indexing then it wouldn't be indexing cache files anyway. So, has anyone actually demonstrated that sending a QR code over iMessage causes the recipient's device to fetch the URL? Because so far this just seems like complete speculation presented as fact.
    - zimpenfish 4y ago
      > Has anyone actually tested sending a QR code over iMessage? I have, just now. Nothing happened at either end - the URL was not accessed at all. I can get it to recognise it's a QR code on my iPhone by tapping to focus the image, waiting for the OCR badge, tapping that, and then tapping the image again to bring up a small menu with the URL as a title and headed by "Open in Safari". None of those steps accesses the URL. You have to make a conscious action to access the URL...

FollowingTheDao 4y ago

That's It. I am done. Back to Debian Linux full time for me. Anyone want to buy a lightly used MacBook Air M1?

m_st 4y ago

Isn't this like WhatsApp, Teams, Skype and others giving you instant previews of URLs when sending them around? I really hate this feature. Impossible to share 'single hit' URLs as they'll be called already when you want to open them.

amelius 4y ago
Single-hit URLs abuse the REST design of HTTP(S).

1970-01-01 4y ago

My first thought was he used Canary tokens. I'm going to try to reproduce it right now, and you can too: https://www.canarytokens.org/generate# https://www.canarytokens.org/generate#

m463 4y ago

I wonder about deep links. I know ios can pass links to apps that register certain URLs. can this happen with qr codes (so although the os doesn't, an app can make the request)

nottorp 4y ago

All browsers now download links in the background in case you click on them by default. A QR code is a kind of link. Why not? Question is, can you disable it?

ballenf 4y ago

I wouldn't be surprised if it turns out that an IOS device has the page open in a tab and refreshes it from time to time. I wish manual refresh was an option, especially for pages with redirects to another app or the AppStore.

lilyball 4y ago

The tweet has now been deleted and the author has retracted his claim. https://twitter.com/hodgesmr/status/1577739222412312578 https://twitter.com/hodgesmr/status/1577739222412312578 https://news.ycombinator.com/item?id=33100130 https://news.ycombinator.com/item?id=33100130

yellowapple 4y ago
The explanation for the retraction doesn't explain that user agent string. It's weird enough coming from macOS; it's even weirder coming from Firefox. The behavior's still concerning in any case, whether it's macOS silently doing it or Firefox silently doing it.
- __ryan__ 4y ago
  The original tweets explained it. The user agent is impersonating a shared Facebook/Twitter/etc link preview/thumbnail. Many sites respond with markup more appropriate for a thumbnail when using that user agent, and if not, it’s unlikely that they serve anything worse, so it’s little harm done.
woojoo666 4y ago
The author originally made it sound like they just generated the QR code, saved it, and then left it in the downloads folder. Now they are saying the Firefox "recents" feature on the home screen triggered it. This would have to mean the author already visited the link embedded in the QR code. If the author had mentioned that fact, then internet speculation would have probably figured out the real cause a lot earlier. Though I gotta say, this is still an attack vector that I hadn't considered. If you use a VPN and occasionally rotate IPs, this Firefox "recents" feature can leak your new IP to websites that you previously visited.

olliej 4y ago

This claim has been retracted: https://news.ycombinator.com/item?id=33100130 https://news.ycombinator.com/item?id=33100130