9 ms·
QR code images in macOS are silently executed in the background hours/days later
- deleted 4y ago[deleted]
- ImHereToVote 4y agoBut why?
- robbiet480 4y agoI assume its Spotlight indexing + photo tagging trying to be helpful but going too far?
- ImHereToVote 4y agoThe road to hell, and all.
- bombcar 4y agoSomeone have a QR code image? Does Get Info on it show the URL?
- deleted 4y ago[deleted]
- dtx1 4y ago
- exysle 4y agoI am more worried about browsing Reddit, and steganography has put that horrible things into it, so I am looking at a picture of a tree and something horrible is in it. Seriously, imagine a tree being 'bound' to evil. A high school friend Bruce told me about that and I flipped the fuck out. That guy told me that and I went what the fuck is wrong with people. I want to browse a decent godddamn internet. It should have stayed Arpanet considering the users. Military technology should be used by the military alone in my opinion. The US government isn't that fucked up. Cops just sprinkle crack on people.
- dtx1 4y ago> The US government isn't that fucked up. 1. See MK Ultra 2. There are other governments then the US
- TobyTheDog123 4y ago>The US government isn't that fucked up. hahaha
- gjsman-1000 4y ago> The US government isn't that fucked up Well, as it is worth remembering, we killed 286,000 (mostly innocent) people in 3 days to win a war... > Cops just sprinkle crack on people. I wouldn't blame cops - I'd blame the FBI. If they planted it, and said you had it because they investigate that kind of thing (and they have tons of examples for material), you're screwed. Very convenient way to silence a dissident and silence the supporters... (not saying they have but in the future...)
- deleted 4y ago[deleted]
- soulofmischief 4y agoI've literally had a cop plant drugs on me, and one of my hometowns recently had a big bombshell where a bunch of cops were indicted for doing the same thing, so I'm not sure you know what you're talking about.
- Spivak 4y agoHow are you going to send it to them in such a way that it wouldn’t be glaringly obvious to a court that they were sent it unsolicited? If your threat model is the government fabricating evidence then why even bother, just arrest them, “collect” a USB drive at their house with CP and lie. I mean hell why even bother with the song and dance, just send them the link and iMessage preview will do it too.
- jcynix 4y agoIf it's sitting in your browser's cache, how do you determine wether it's there unsolicited or not? That's the problem already with real-time ad brokering. And it's easy to set any images to "display: none" with CSS, but they would still be loaded in the background. Now explain that to a court.
- aestetix 4y agoOr an "influencer" with many followers could post the barcode and create a DDoS attack.
- sssilver 4y agoOnly if the followers “save” the image into their photos, no?
- RockRobotRock 4y agoTotally not an overreaction.
- exysle 4y agoQR codes were invented in Eastasia.
- xnickb 4y ago
- bfgoodrich 4y ago
- navigate8310 4y agoSometimes, I believe HN is becoming Reddit albeit a very slow process, but it will happen eventually.
- DigiDigiorno 4y agoAs voting based social communities become more popular, the more nuanced commentary get's drowned out by the popular viewpoint. The issue isn't the site being "too mainstream", the issue is that the nuance gets lost amongst the noise with social voting. I'm not sure if it is because of the appeal of the popular viewpoint itself, or if it is because of the amount of posts containing it. Reddit 10+ years ago had, what I consider, great commentary on the default subs/frontpage—it was very different than the Reddit of today. "Good" social voting sites get more popular with time; I agree with you and think it's almost inevitable that HackerNews will too. My philosophy on this is to just enjoy the site while it's in the state of popularity you like, and try to find a new one when it happens. Yearning for yesteryear isn't exactly productive. ('Better to have loved and lost than never to have loved at all'?) My take: HackerNews is still quite niche in comparison. I'd estimate the comment volume is one or two orders of magnitude away from the point where it becomes too noisy to find the nuance.
- reaperducer 4y agoThe appearance of the word "fanboy" in a comment virtually guarantees that the speaker is a moron saying nothing of value. Also the presence of "lol" in a comment, which is has recently become very common on HN.
- aaaaaaaaaaab 4y agoLol. This is the User-Agent of Apple's crawler: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.4 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.4 facebookexternalhit/1.1 Facebot Twitterbot/1.0"
- lizardactivist 4y ago
- sp332 4y agoWell the scanning is supposed to be local. It's not uploading your photos or anything. You can turn it off in System Preferences -> Spotlight -> Privacy. Or go further and remove Spotlight https://cleanmymac.com/faq/how-to-turn-off-spotlight-search-on-mac https://cleanmymac.com/faq/how-to-turn-off-spotlight-search-... Not positive this works on the latest hardware.
- jbverschoor 4y agoWhich results in that NOTHING works anymore. File search, email search. Literally nothing will work anymore.
- sp332 4y agoYes, good disclaimer. That's what happens when you turn off local scanning.
- atkailash 4y ago
- daneel_w 4y ago"NOTHING, literally nothing works anymore" is an alarmist exaggeration, even if you would do the ham-fisted thing of adding your entire home directory to Spotlight's exclusion list. The sane and logical option is to add only your Pictures directory (or whatever folders you keep images in) to the exclusion list.
- jbverschoor 4y agoNo it's not, because then you can't use any search on Pictures.
- 4y ago
- 13of40 4y agoIt could be an AV engine doing it. Some phishing attacks have switched to using QR codes instead of links as an evasion technique in the last couple of years, so the anti-evasion to that is decode it and browse the link to see if it's malicious.
- kennywinker 4y ago“This link might be dangerous - better click on it!” I’d suspect it’s indexing for search rather than a security protocol - i feel like anybody security minded would have approached this differently
- Filligree 4y agoAntivirus software isn’t known for being security-minded. Running potential malware in a buggy kernel-space sandbox comes to mind.
- fmajid 4y agoAntivirus software is so sloppily written it actually increases your attack surface, often catastrophically so: https://www.theregister.com/2016/05/17/tavis_ormandy_zeroes_in_on_antivirus_remotecrash_bug https://www.theregister.com/2016/05/17/tavis_ormandy_zeroes_... https://www.computerworld.com/article/2493275/researcher-finds-critical-vulnerabilities-in-sophos-antivirus-product.html https://www.computerworld.com/article/2493275/researcher-fin...
- Analemma_ 4y agoIf you've ever seen Tavis Ormandy and P0's analysis of AV software, you know this isn't actually far-fetched. A lot of these products have horrifying vulnerabilities.
- bombcar 4y agoI hate AV scanners, they consume one-time URLs in many cases (Salesforce password resets just don't work for me).
- 4y ago
- joshstrange 4y agoOther thread on this: https://news.ycombinator.com/item?id=33095608 https://news.ycombinator.com/item?id=33095608 My comment from there: I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor opening it Preview, nor scanning it with my iPhone, the only thing that caused a request was clicking on the detected link in my iPhone camera app. Obviously if this is a background daemon that runs periodically then my test wouldn't catch it (unless I got "lucky") and for a longer-term test I'd probably want to use something other than request bin. That said request bin says it keeps bins for 48 hours so that might be enough time. [0] https://requestbin.io/ https://requestbin.io/
- bobviolier 4y agoThe original twitter threads talks about "a couple of days ago".. so that it didn't do it in 10 minutes, is not that surprising. Also not sure if your 48 hours will be enough if I go from the original thread from the person who found the issue.
- f1shy 4y agoI've just reproduced it. Went to a qr-code generator online, generated a code with an url http://xxx.xxx.xxx.xxx http://xxx.xxx.xxx.xxx In a terminal i did "sudo tcpdump ip host xxx.xxx.xxx.xxx" Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. uname -a: Darwin Kernel Version 21.6.0: Mon Aug 22 20:17:10 PDT 2022; root:xnu-8020.140.49~2/RELEASE_X86_64 x86_64 Really shitty idea from apple... EDIT!!! Sorry, I think I know where the problem was: I was testing with a site I visited in safari already. It happens that after you type a couple of characters in safari address bar, and you have a cache hit in your history, safari already loads the site. While doing the experiment I visited sites which triggered hits in the history with my test site... so no. I could not really reproduce it. Maybe original tweet comes from similar error.
- rgovostes 4y ago
- zamalek 4y ago> And sure, just browsing the web "exposes your IP address" so this may not be the most impactful privacy issue, but it's surprising and unexpected behavior Well, it's certainly fantastic for fingerprinting. You could put some UUID in the QR code and have macOS tell you who the IP address is every few days.
- yjftsjthsd-h 4y agoIt also feels like something that would leak across VPN/proxy/ISP changes. "This tracking code was loaded first from this residential IP, then this coffee shop IP, then this VPN IP" tells quite a story!
- rgovostes 4y agoI am skeptical. So far there is only a single report of this, triggering at 8:08 am local time (according to OP's bio). If it were the middle of the night, doing some kind of dark wake background scan, it would sound more plausible. During normal user hours? Is it not possible he accidentally triggered it? The user agent is the one used by the Link Presentation framework. It shouldn't be too much to dig through the shared cache for binaries that link to this framework and see if there are any QuickLook ones. Moreover joshstrange in this thread and others I know from elsewhere aren't able to reproduce. Yet the original unsubstantiated tweet has 500 retweets and will probably reach thousands as the west coast logs in this morning.
- deleted 4y ago[deleted]
- jedberg 4y agoDiscussion on the original tweet: https://news.ycombinator.com/item?id=33095608 https://news.ycombinator.com/item?id=33095608 @Dang, should these threads be merged?
- Mordisquitos 4y agoIf, as he suggests, it may be happening on iOS as well then it would offer third parties the interesting possibility of "probing" some locations for iPhone photo events, especially if the background requests and their headers can be distinguished from intentional requests. Say you own a bar, nightclub, popular tourist location, or whatever. Place specific QR codes at locations of encoding URLs pointing to a server you own, and you will be able to count how many times an iPhone user took a photo that included said QR code (or, if background scanning is active even before the picture is taken, how many times an iPhone was pointed towards it). Not that this would likely provide any valuable information for a malicious actor, nor could it really be done covertly. It's more of a thought experiment.
- zimpenfish 4y ago> if background scanning is active even before the picture is taken Just tested this and no matter how many times I point Camera at my QR code, it doesn't access the URL until I specifically click on the little yellow callout box.
- amtamt 4y agoQR code scanner should be passing and opening the url with the default url handlar, http/ sms/ deeplink to app within phone. This can be a pretty scary attack vector where a popular compromised QR code scanner is used with images sent in SPAM folders, which are processed offline, possibility sending out everything a user id has access to.
- zer0x4d 4y agoAre we sure this guy didn’t 1. Copy/paste the link and send it to himself over iMessage from his laptop, perhaps to test it out on his phone or vice versa? 2. Send the QR code itself from his phone to his laptop or vice versa perhaps to test out scanning? The fact that the user agent matches that of iMessage screams that the code is somehow in a iMessage thread and iMessage is trying to refresh a preview thumbnail, detect an app clip, or make sure a url is accessible. Add to that the fact that this requests came in the morning suggesting they happened when he turned his laptop on or unlocked his phone to check messages, etc.
- aaroninsf 4y agoITT a lot of attempts to reproduce which didn't catch the assertion that this is alleged to have happened during background processing hours/days after receipt. It's not supposed to be happening promptly; reproducing (or not) will take a couple days AFAIK?
- soheil 4y agoThe fact that to reproduce this you need hours/days is probably a good indication that it shouldn't be taken very seriously. There are numerous things that could have occurred not having anything to do with MacOS that caused the URL to be visited. Until someone else can reproduce this let's stop wasting everyone's time on something we have no evidence of. For the record I tried to reproduce this and so far the URL has not been visited.
- OJFord 4y agoThis is a quote/reply/retweet/whatever of a tweet that is also on the front page in its own right: https://news.ycombinator.com/item?id=33095608 https://news.ycombinator.com/item?id=33095608
- nyuszika7h 4y agoDupe https://news.ycombinator.com/item?id=33095608 https://news.ycombinator.com/item?id=33095608
- madmax108 4y agoThere's a clarification from the original poster of this [1]: "Well, I was wrong. I now believe the canary token was triggered not by macOS decoding the QR, but by Firefox’s “recent” shortcuts on the home screen. I gave too much trust to a Stack Exchange answer. I have deleted the incorrect information. I regret the error." False alarm, Get back to work folks! ;) [1] https://twitter.com/hodgesmr/status/1577739222412312578 https://twitter.com/hodgesmr/status/1577739222412312578
- olliej 4y agoThis claim has been retracted: https://news.ycombinator.com/item?id=33100130 https://news.ycombinator.com/item?id=33100130