from Hacker News

macOS is background scanning and following downloaded QR codes?

by mik3y on 10/5/22, 1:54 PM with 85 comments

• by lilyball on 10/5/22, 7:23 PM

  The tweet has now been deleted and the author has retracted his claim.

  https://twitter.com/hodgesmr/status/1577739222412312578

  https://news.ycombinator.com/item?id=33100130

• by crazygringo on 10/5/22, 3:19 PM

  "Background scanning" sounds more nefarious than what's probably really going on -- which is probably either generating thumbnail previews (for Finder) or indexing (for Spotlight), both of which are desired. Or maybe malware scanning to put files in quarantine if they point to dangerous content? macOS is also becoming more intelligent about text in images, e.g. it OCR's images so you can select text. I don't know if it indexes text in images for Spotlight the way Google has already done in Drive for years.

  But I wouldn't be surprised if it fetches URL's in QR codes in order to index the title text associated with the URL for Spotlight. It's not so different from when you text someone a URL in Messages, it automatically shows a title and thumbnail to both parties. Or, if it's just a shared "preview" library used across thumbnails and iMessage.

  I'm not sure what to think about it. Previews, smart text, showing URL information on hover, prefetching, indexing, etc. -- it's all pretty standard stuff. On the other hand, it does feel a little weird for previews on a local filesystem to query the internet -- we're totally used to it in e-mail and messaging though. But, I used to keep bookmarks as URL (.url) files. It would seem natural for a thumbnail of the page to show up in Finder (though I don't think it does this?).

  As for it being an "attack" to get someone's IP -- seems like that ship has long since sailed, as it's common for any messaging and e-mail client to already show previews. If you need to protect yourself against all of those, you pretty much need to figure out what level of Little Snitch or turning off internet or airgapping is required for your security concerns.

• by joshstrange on 10/5/22, 3:21 PM

  I'll be interested to see if anyone else can reproduce this. I created a request bin [0], then created a QR code pointing at it, then downloaded that QR code. I'm not sure how often this "image scanning" is supposed to occur but just downloading it didn't cause a hit nor did the 10min I waited, nor did using QuickLook, nor opening it Preview, nor scanning it with my iPhone, the only thing that caused a request was clicking on the detected link in my iPhone camera app.

  Obviously if this is a background daemon that runs periodically then my test wouldn't catch it (unless I got "lucky") and for a longer-term test I'd probably want to use something other than request bin. That said request bin says it keeps bins for 48 hours so that might be enough time.

  [0] https://requestbin.io/

• by paxys on 10/5/22, 4:22 PM

  So, if I send you a QR code via iMessage the URL in it will automatically be hit, using your IP address and browser/OS details. Wow that's quite an attack vector.

• by olliej on 10/5/22, 8:43 PM

  This claim has been retracted: https://news.ycombinator.com/item?id=33100130

• by numbsafari on 10/5/22, 3:55 PM

  Apple should be proxying and caching these results to avoid the risk of exposing client devices, prevent incidental DDOS, as well as the obvious privacy issues.

• by dt3ft on 10/5/22, 3:11 PM

  Was anyone else able to confirm this?

• by m_st on 10/5/22, 4:40 PM

  Isn't this like WhatsApp, Teams, Skype and others giving you instant previews of URLs when sending them around? I really hate this feature. Impossible to share 'single hit' URLs as they'll be called already when you want to open them.

• by 1970-01-01 on 10/5/22, 4:46 PM

  My first thought was he used Canary tokens. I'm going to try to reproduce it right now, and you can too: https://www.canarytokens.org/generate#

• by ballenf on 10/5/22, 6:30 PM

  I wouldn't be surprised if it turns out that an IOS device has the page open in a tab and refreshes it from time to time. I wish manual refresh was an option, especially for pages with redirects to another app or the AppStore.

• by maxehmookau on 10/5/22, 3:15 PM

  This happened to me last week and I ignored it thinking maybe I did something wrong and Apple wouldn't be so silly to build in an attack vector like this in to their software.

  It was between two devices on the same Apple ID though via AirDrop, so maybe it only did it because the device was "trusted".

• by kgc on 10/5/22, 3:47 PM

  I'm guessing it's an antivirus/anti-malware operation.

• by m463 on 10/5/22, 5:29 PM

  I wonder about deep links. I know ios can pass links to apps that register certain URLs. can this happen with qr codes (so although the os doesn't, an app can make the request)

• by nottorp on 10/5/22, 6:10 PM

  All browsers now download links in the background in case you click on them by default. A QR code is a kind of link. Why not?

  Question is, can you disable it?

• by FollowingTheDao on 10/5/22, 4:23 PM

  That's It. I am done. Back to Debian Linux full time for me.

  Anyone want to buy a lightly used MacBook Air M1?