5 ms·

I've just reproduced it. Went to a qr-code generator online, generated a code with an url http://xxx.xxx.xxx.xxx http://xxx.xxx.xxx.xxx In a terminal i did "sud

by f1shy 4y ago

I've just reproduced it. Went to a qr-code generator online, generated a code with an url http://xxx.xxx.xxx.xxx http://xxx.xxx.xxx.xxx In a terminal i did "sudo tcpdump ip host xxx.xxx.xxx.xxx" Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. uname -a: Darwin Kernel Version 21.6.0: Mon Aug 22 20:17:10 PDT 2022; root:xnu-8020.140.49~2/RELEASE_X86_64 x86_64 Really shitty idea from apple... EDIT!!! Sorry, I think I know where the problem was: I was testing with a site I visited in safari already. It happens that after you type a couple of characters in safari address bar, and you have a cache hit in your history, safari already loads the site. While doing the experiment I visited sites which triggered hits in the history with my test site... so no. I could not really reproduce it. Maybe original tweet comes from similar error.

rgovostes 4y ago
Counterpoint: I did the same thing and used Little Snitch to try to catch a request, and did not see one. If there had been one, it would have attributed it to a particular process.
- deleted 4y ago
  [deleted]
- mixmastamyk 4y ago
  Hours/days later.
  - joshstrange 4y ago
    > Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. The person they are replying to said it happened instantly in their test.
    - mixmastamyk 4y ago
      But not necessarily.
- sleepybrett 4y ago
  My understanding is that little snitch doesn't catch some requests by apple owned processes.
  - zimpenfish 4y ago
    That's what I thought but on checking, it seems they've been stripped back to a bunch of Apple domains rather than blanket permissions for daemons, etc.
  - Nextgrid 4y ago
    I believe that's now been rolled back - at least on my machine, LS is indeed catching a lot of Apple processes.
  - akerl_ 4y ago
    There's 2 things that I think are conflated here: 1. When Apple first switched from kexts to the network framework for apps like LittleSnitch, they exempted a ton of their own system processes (things like the App Store, and iCloud) from flowing through that framework. This change was reverted shortly after (I believe even before the GA release of that version, but don't quote me on that) 2. LittleSnitch ships with a bunch of default Allow rules designed to let expected first-party things like the App Store and iCloud work. I assume this is done so that the user experience for new LS users isn't "install app, entire system comes grinding to a halt". But these rules can be disabled by the user.
joshstrange 4y ago
I'm not saying it's not happening but I just did this (with both a public and private IP) and was unable to produce. For reference I used the following: * https://www.the-qrcode-generator.com/ https://www.the-qrcode-generator.com/ - for the QR Code * http://10.0.1.202 http://10.0.1.202 and http://8.8.8.8 http://8.8.8.8 - for the urls * Command + Shift + 4 - To select the area of the screen with the QR code (using the native screenshot tool, I disabled CleanShotX)
- f1shy 4y ago
  My bad. Sorry, look edit.
grooot 4y ago
Isn’t this just URL prefetching extended to QR codes? I don’t see what the fuss is about, unless there is some innuendo that data is being sent to Apple.
- matt-attack 4y ago
  Prefetching is usually a function of a web-browser in response to navigating to a page which contains links. I think the concern is that Safari is not involved at all here. This is the OS doing the prefetch by examining just a file saved to the filesystem.
  - grooot 4y ago
    Sure but as has been pointed out, the likely explanation is that this is a function being performed locally for indexing or thumb nail generation. Nobody has come close to showing anything malicious or that data is being exfiltrated, so why is this a problem?
    - lazide 4y ago
      Calling the URL is a form of data leakage and exfiltration QR codes often include marketing trackers, for one really common examples.
    - haswell 4y ago
      “Downloading image causes outbound http requests against arbitrary endpoints” Pair this with a zero-day in the HTTP request library and an image becomes the initiation of an attack that leads to a vulnerable client connecting to a malicious endpoint. Could also easily be used to track users in new ways. Just two scenarios that immediately comes to mind.
      - grooot 4y ago
    - jabbany 4y ago
zimpenfish 4y ago
I generated a QR code locally, saved it to Downloads; created a QR code online, downloaded it to Downloads; created a QR code online, downloaded it, added it to Photos, deleted it from Downloads immediately. Thus far, after 20 minutes, of those 3 QR codes with distinct URLs, not one has been hit by anything. Will keep monitoring though.
- _visgean 4y ago
  did you keep leave your computer idle? Afaik most of the photos functionality executes when the computer is plugged in and is not executing anything else..
  - zimpenfish 4y ago
    It was just plugged in and idle for 60 minutes. Still no URL activity but the QR code I saved to Photos has been synced to my iPhone and iPad (indicating that Photos scanning and syncing has, to some extent, happened.)
- sleepybrett 4y ago
  My guess is that it's some part of the spotlight indexing process.
- f1shy 4y ago
  mmmm now I'm trying again, but does not work... I will keep trying. For the record, before I did it 3 times in a row to be sure. But now it does not happen :S
matt-attack 4y ago
Data point: I did the exact same procedure on the exact same kernel version and did not see a hit. I'm wondering if there is some setting in Spotlight or Finder that is required to see this behavior.
lapcat 4y ago
I'm also unable to reproduce this. I saw no activity whatsoever in Little Snitch Network Monitor.

by f1shy 4y ago

rgovostes 4y ago

Counterpoint: I did the same thing and used Little Snitch to try to catch a request, and did not see one. If there had been one, it would have attributed it to a particular process.

deleted 4y ago
[deleted]
mixmastamyk 4y ago
Hours/days later.
- joshstrange 4y ago
  > Then I do a screen capture of the QR code, and save it. At that moment I see an http query to the ip. The person they are replying to said it happened instantly in their test.
  - mixmastamyk 4y ago
    But not necessarily.
sleepybrett 4y ago
My understanding is that little snitch doesn't catch some requests by apple owned processes.
- zimpenfish 4y ago
  That's what I thought but on checking, it seems they've been stripped back to a bunch of Apple domains rather than blanket permissions for daemons, etc.
- Nextgrid 4y ago
  I believe that's now been rolled back - at least on my machine, LS is indeed catching a lot of Apple processes.
- akerl_ 4y ago
  There's 2 things that I think are conflated here: 1. When Apple first switched from kexts to the network framework for apps like LittleSnitch, they exempted a ton of their own system processes (things like the App Store, and iCloud) from flowing through that framework. This change was reverted shortly after (I believe even before the GA release of that version, but don't quote me on that) 2. LittleSnitch ships with a bunch of default Allow rules designed to let expected first-party things like the App Store and iCloud work. I assume this is done so that the user experience for new LS users isn't "install app, entire system comes grinding to a halt". But these rules can be disabled by the user.

joshstrange 4y ago

I'm not saying it's not happening but I just did this (with both a public and private IP) and was unable to produce. For reference I used the following: * https://www.the-qrcode-generator.com/ https://www.the-qrcode-generator.com/ - for the QR Code * http://10.0.1.202 http://10.0.1.202 and http://8.8.8.8 http://8.8.8.8 - for the urls * Command + Shift + 4 - To select the area of the screen with the QR code (using the native screenshot tool, I disabled CleanShotX)

f1shy 4y ago
My bad. Sorry, look edit.

grooot 4y ago

Isn’t this just URL prefetching extended to QR codes? I don’t see what the fuss is about, unless there is some innuendo that data is being sent to Apple.

matt-attack 4y ago
Prefetching is usually a function of a web-browser in response to navigating to a page which contains links. I think the concern is that Safari is not involved at all here. This is the OS doing the prefetch by examining just a file saved to the filesystem.
- grooot 4y ago
  Sure but as has been pointed out, the likely explanation is that this is a function being performed locally for indexing or thumb nail generation. Nobody has come close to showing anything malicious or that data is being exfiltrated, so why is this a problem?
  - lazide 4y ago
    Calling the URL is a form of data leakage and exfiltration QR codes often include marketing trackers, for one really common examples.
  - haswell 4y ago
    “Downloading image causes outbound http requests against arbitrary endpoints” Pair this with a zero-day in the HTTP request library and an image becomes the initiation of an attack that leads to a vulnerable client connecting to a malicious endpoint. Could also easily be used to track users in new ways. Just two scenarios that immediately comes to mind.
    - grooot 4y ago
  - jabbany 4y ago

zimpenfish 4y ago

I generated a QR code locally, saved it to Downloads; created a QR code online, downloaded it to Downloads; created a QR code online, downloaded it, added it to Photos, deleted it from Downloads immediately. Thus far, after 20 minutes, of those 3 QR codes with distinct URLs, not one has been hit by anything. Will keep monitoring though.

_visgean 4y ago
did you keep leave your computer idle? Afaik most of the photos functionality executes when the computer is plugged in and is not executing anything else..
- zimpenfish 4y ago
  It was just plugged in and idle for 60 minutes. Still no URL activity but the QR code I saved to Photos has been synced to my iPhone and iPad (indicating that Photos scanning and syncing has, to some extent, happened.)
sleepybrett 4y ago
My guess is that it's some part of the spotlight indexing process.
f1shy 4y ago
mmmm now I'm trying again, but does not work... I will keep trying. For the record, before I did it 3 times in a row to be sure. But now it does not happen :S

matt-attack 4y ago

Data point: I did the exact same procedure on the exact same kernel version and did not see a hit. I'm wondering if there is some setting in Spotlight or Finder that is required to see this behavior.

lapcat 4y ago

I'm also unable to reproduce this. I saw no activity whatsoever in Little Snitch Network Monitor.