Jump to content

macOS 'Quick Look' exploit could reveal all your encrypted data


Recommended Posts

Quick Look is one of macOS’s most convenient features, but one developer has proven it’s also extremely vulnerable to hacking.

Apple's Quick Look mechanism generates and caches thumbnails of files, images, folders and other data to give users fast and easy access. That’s generally what Quick Look does with all your files, but a security researcher named Wojciech Regula realized the feature is doing the same thing with all your encrypted data and saves those said thumbnails to an unencrypted location.

This vulnerability would allow a hacker to easily capture snippets of original files, including those contained in encrypted containers, simply by rooting out Quick Look’s cache of thumbnails.

Mo’ speed, mo’ problems

Regula simulated such a hack by uploading two images into two separate encrypted containers, one encoded in VeraCrypt and another with macOS Encrypted HFS+/APFS. Using simple commands, the researcher both images through their file paths, allowing him to access a miniature version of the original files.

As if seeing thumbnails images of your private images wasn’t bad enough, Regula also showed how the Quick Look’s backend can also reveal sensitive documents. Unfortunately, Quick Look also does a great job of caching any additional drives you might have plugged into your Mac, so files stored on thumb drives or external hard drives.

So what can you do? Fortunately, users can secure their encrypted files by manually clearing the Quick Look and unmount their encrypted container and Regula notes that Apple has even made a utility called ‘qlmanage’ just for this task.

It seems like the best way to keep your data secure from Quick Look is to completely divorce it from your Mac – which isn’t convenient at all. So hopefully Apple releases a fix for this vulnerability in a near future macOS update.

Via AppleInsider


View the full article

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Unfortunately, your content contains terms that we do not allow. Please edit your content to remove the highlighted words below.
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Create New...

Important Information

By using this site, you agree to our Terms of Use.