6 ms·

macOS phones home when previewing local image files [video]

64 points by gatonegro 4y ago

deleted 4y ago
[deleted]
metadat 4y ago
Extremely creepy. Is there a hosts entry I can add to block this behavior?
widowlark 4y ago
CSAM?
- infotogivenm 4y ago
  Almost certainly not. Likely just a metric on how often users utilize finder previews.
  - sneak 4y ago
    I have analytics turned off. Apple has no rights to the metrics on my local computer.
  - drunkenmagician 4y ago
    A metric for every preview? Sounds like a poor design decision to do metric reporting per usage.
    - lookingforeven 4y ago
      > A metric for every preview? That is not what the original blog post said. They are basing their whole argument on a single event.
re 4y ago
The author of the blog post makes a wild leap (from "A daemon connected to Apple's servers when I used QuickLook on a file" [paraphrased] to "Apple Has Begun Scanning Your Local Image Files Without Consent [...] Stock macOS now invades your privacy via the Internet when browing local files [...] macOS now contains network-based spyware"), with the strong implication that information about those files is being sent to Apple while stopping just short of actually claiming that. I've seen these kind of accusations of spying be made a lot based on misinterpretation of very scant evidence, and without something more concrete I think that's almost certainly what's happening here. A far more likely explanation IMO is that the daemon is doing something like checking for regional availability of the Live Text feature (still somewhat problematic but definitely nowhere near the same ballpark), as partially suggested by this commenter: https://infosec.exchange/@yProd/109698545121198396 https://infosec.exchange/@yProd/109698545121198396
- metadat 4y ago
  Regardless, it shouldn't be pinging the Internet whenever the user previews an image file. No good can come of such behavior.
  - re 4y ago
    The blog post reports it happening once, not every time. I'd agree that it would feel significantly worse/more suspicious if Apple's servers were contacted every time I previewed/opened a file.
  - infotogivenm 4y ago
    Agree with gp that this is a astonishingly huge logical leap by the author. I would guess the author left the default “report metrics to apple” on, and apple is noting that “a user leveraged the photo preview feature for the first time in X days.” I do wish these metrics were optin but I somewhat get the decision from a PM standpoint, and to their credit Apple presents this choice to the user during the setup process in a really hard-to-miss way. Incredibly lazy blog post IMO, if you’re going to write an article and video on an infosec site, take the time to MITM the connection so you can avoid purely tinfoil speculative reporting. Apple likely does not make this easy but it is possible to do anything when SIP is disabled.
    - sneak 4y ago
      Analytics are off, as is iCloud, the App Store, Siri Suggestions, and every other Apple service there is a knob exposed for. Live Text is on, because the machine was recently updated to Ventura and it defaults to on and it never asked if I wanted it. (It's a brand new preference setting.) If you're going to call someone lazy, look first into what it takes to MITM a TLS connection from an Apple system service to Apple. It seems you are unaware. It's not trivial these days.
      - infotogivenm 4y ago
        Maybe media codec checks then, or a bug that ignores the metrics setting. We can go all day at this until someone finishes the research. > It seems you are unaware. It's not trivial these days. I know very well what it takes, thats why I said Apple does not likely make this easy. The last time I tried was a few releases ago: disable SIP, write a frida hook to disable pinning, maybe a couple hours the first time you do it. If I were in a pinch I might not even bother with that and instead just pop mediaservicesd into IDA or Hopper and attach to the process as it hangs in littlesnitch. However I did not write a tinfoil essay on a strange observed behavior without actually investigating it, so I will not be doing any of those for you.
IronWolve 4y ago
Photo hosting services been scanning md5 sums of a database of known criminal images for 20 years. They did that on telecom and isp's since 2000'ish. Google/Apple searched your cloud for mp3s or torrented movies also. Now Apple just moved the search to the OS via an API call to its server, and people are noticing the traffic. When I worked in telecom, if there was a hit on an image it was reported to legal. Legal contacted the feds. Feds contacted the local PD of the user. The PD would send a cop in to pick up a burned cd. The server would zip all the users data and burn onto a dvd. We wouldnt touch the dvd, the cop would walk into the datacenter and hit eject and collect the dvd. No chain of custody issues.
- gatonegro 4y ago
  > Now Apple just moved the search to the OS via an API call to its server, and people are noticing the traffic. I'm not sure how photo hosting services doing this for the past 2 decades is related to this when the author of the post explicitly mentions he doesn't use Apple cloud services or products that would trigger such behaviour. This was the OS analysing someone's images, stored locally on their personal computer, and calling back to an API for no discernible reason.
  - IronWolve 4y ago
    Not sure how you cant understand, apple just moved it from cloud scanning to local scanning. Its a scummy thing to do, but apple was already doing it.
lookingforeven 4y ago
Searched for the original post - it was submitted and flagged three days ago (https://news.ycombinator.com/item?id=34392391 https://news.ycombinator.com/item?id=34392391). The post makes big accusations and extrapolations without proof or research, based on a web request whose contents this 'security researcher' didn't even see. A quick web search reveals mediaanalysisd has been a part of macOS since at least 2017. It is disappointing to see Louis Rossmann blindly repeating any random claim from any random person. This is the same person who created a 'standard' (https://consoledonottrack.com https://consoledonottrack.com) and spammed a bunch of popular projects with it with an entitled attitude. I am not a fan of the Apple Tim Cook is leading, but let's be reasonable and put down the pitchforks for a moment. A single web request does not immediately equate to your files being scanned without consent. Louis should know better, and you should not believe any random crap just because he repeats it.
sneak 4y ago
The original post: https://sneak.berlin/20230115/macos-scans-your-local-files-now/ https://sneak.berlin/20230115/macos-scans-your-local-files-n...
tempera 4y ago
This is why I avoid buying an macOS laptop, creepy surveillance of users, and the fact that they wanted to scan users photos and denouncing them to police. They wanted to be the friends of Police State, and they are friends of China. Not normal behaviour
NotPractical 4y ago
Anyone know how to actually examine the contents of the request? Everyone's tossing around their own theories as to what this request is for but it looks like nobody's doing any real investigation. I'm on macOS Ventura and I tried this method that was suggested in another HN post: https://lapcatsoftware.com/articles/logging-https.html https://lapcatsoftware.com/articles/logging-https.html But it doesn't seem to work. According to the aforementioned post, Apple system binaries are using cert pinning so it's difficult to intercept the network requests that they make. The suggestion was setting an environment variable to politely ask them to log their requests. I don't think mediaanalysisd respects this variable, however.

64 points by gatonegro 4y ago

deleted 4y ago

[deleted]

metadat 4y ago

Extremely creepy. Is there a hosts entry I can add to block this behavior?

widowlark 4y ago

CSAM?

infotogivenm 4y ago
Almost certainly not. Likely just a metric on how often users utilize finder previews.
- sneak 4y ago
  I have analytics turned off. Apple has no rights to the metrics on my local computer.
- drunkenmagician 4y ago
  A metric for every preview? Sounds like a poor design decision to do metric reporting per usage.
  - lookingforeven 4y ago
    > A metric for every preview? That is not what the original blog post said. They are basing their whole argument on a single event.

re 4y ago

The author of the blog post makes a wild leap (from "A daemon connected to Apple's servers when I used QuickLook on a file" [paraphrased] to "Apple Has Begun Scanning Your Local Image Files Without Consent [...] Stock macOS now invades your privacy via the Internet when browing local files [...] macOS now contains network-based spyware"), with the strong implication that information about those files is being sent to Apple while stopping just short of actually claiming that. I've seen these kind of accusations of spying be made a lot based on misinterpretation of very scant evidence, and without something more concrete I think that's almost certainly what's happening here. A far more likely explanation IMO is that the daemon is doing something like checking for regional availability of the Live Text feature (still somewhat problematic but definitely nowhere near the same ballpark), as partially suggested by this commenter: https://infosec.exchange/@yProd/109698545121198396 https://infosec.exchange/@yProd/109698545121198396

metadat 4y ago
Regardless, it shouldn't be pinging the Internet whenever the user previews an image file. No good can come of such behavior.
- re 4y ago
  The blog post reports it happening once, not every time. I'd agree that it would feel significantly worse/more suspicious if Apple's servers were contacted every time I previewed/opened a file.
- infotogivenm 4y ago
  Agree with gp that this is a astonishingly huge logical leap by the author. I would guess the author left the default “report metrics to apple” on, and apple is noting that “a user leveraged the photo preview feature for the first time in X days.” I do wish these metrics were optin but I somewhat get the decision from a PM standpoint, and to their credit Apple presents this choice to the user during the setup process in a really hard-to-miss way. Incredibly lazy blog post IMO, if you’re going to write an article and video on an infosec site, take the time to MITM the connection so you can avoid purely tinfoil speculative reporting. Apple likely does not make this easy but it is possible to do anything when SIP is disabled.
  - sneak 4y ago
    Analytics are off, as is iCloud, the App Store, Siri Suggestions, and every other Apple service there is a knob exposed for. Live Text is on, because the machine was recently updated to Ventura and it defaults to on and it never asked if I wanted it. (It's a brand new preference setting.) If you're going to call someone lazy, look first into what it takes to MITM a TLS connection from an Apple system service to Apple. It seems you are unaware. It's not trivial these days.
    - infotogivenm 4y ago
      Maybe media codec checks then, or a bug that ignores the metrics setting. We can go all day at this until someone finishes the research. > It seems you are unaware. It's not trivial these days. I know very well what it takes, thats why I said Apple does not likely make this easy. The last time I tried was a few releases ago: disable SIP, write a frida hook to disable pinning, maybe a couple hours the first time you do it. If I were in a pinch I might not even bother with that and instead just pop mediaservicesd into IDA or Hopper and attach to the process as it hangs in littlesnitch. However I did not write a tinfoil essay on a strange observed behavior without actually investigating it, so I will not be doing any of those for you.

IronWolve 4y ago

Photo hosting services been scanning md5 sums of a database of known criminal images for 20 years. They did that on telecom and isp's since 2000'ish. Google/Apple searched your cloud for mp3s or torrented movies also. Now Apple just moved the search to the OS via an API call to its server, and people are noticing the traffic. When I worked in telecom, if there was a hit on an image it was reported to legal. Legal contacted the feds. Feds contacted the local PD of the user. The PD would send a cop in to pick up a burned cd. The server would zip all the users data and burn onto a dvd. We wouldnt touch the dvd, the cop would walk into the datacenter and hit eject and collect the dvd. No chain of custody issues.

gatonegro 4y ago
> Now Apple just moved the search to the OS via an API call to its server, and people are noticing the traffic. I'm not sure how photo hosting services doing this for the past 2 decades is related to this when the author of the post explicitly mentions he doesn't use Apple cloud services or products that would trigger such behaviour. This was the OS analysing someone's images, stored locally on their personal computer, and calling back to an API for no discernible reason.
- IronWolve 4y ago
  Not sure how you cant understand, apple just moved it from cloud scanning to local scanning. Its a scummy thing to do, but apple was already doing it.

lookingforeven 4y ago

Searched for the original post - it was submitted and flagged three days ago (https://news.ycombinator.com/item?id=34392391 https://news.ycombinator.com/item?id=34392391). The post makes big accusations and extrapolations without proof or research, based on a web request whose contents this 'security researcher' didn't even see. A quick web search reveals mediaanalysisd has been a part of macOS since at least 2017. It is disappointing to see Louis Rossmann blindly repeating any random claim from any random person. This is the same person who created a 'standard' (https://consoledonottrack.com https://consoledonottrack.com) and spammed a bunch of popular projects with it with an entitled attitude. I am not a fan of the Apple Tim Cook is leading, but let's be reasonable and put down the pitchforks for a moment. A single web request does not immediately equate to your files being scanned without consent. Louis should know better, and you should not believe any random crap just because he repeats it.

sneak 4y ago

The original post: https://sneak.berlin/20230115/macos-scans-your-local-files-now/ https://sneak.berlin/20230115/macos-scans-your-local-files-n...

tempera 4y ago

This is why I avoid buying an macOS laptop, creepy surveillance of users, and the fact that they wanted to scan users photos and denouncing them to police. They wanted to be the friends of Police State, and they are friends of China. Not normal behaviour

NotPractical 4y ago

Anyone know how to actually examine the contents of the request? Everyone's tossing around their own theories as to what this request is for but it looks like nobody's doing any real investigation. I'm on macOS Ventura and I tried this method that was suggested in another HN post: https://lapcatsoftware.com/articles/logging-https.html https://lapcatsoftware.com/articles/logging-https.html But it doesn't seem to work. According to the aforementioned post, Apple system binaries are using cert pinning so it's difficult to intercept the network requests that they make. The suggestion was setting an environment variable to politely ask them to log their requests. I don't think mediaanalysisd respects this variable, however.