Glitch In OS X Search Can Expose Private Details of Apple Mail Users

itwbennett (1594911) writes "The potential privacy risk in Apple's OS X Yosemite, first reported by German tech news site Heise and confirmed by IDG News Service, appears when people use the Spotlight Search feature, which also indexes emails received with the Apple Mail email client. Performing a Spotlight search opens email previews that load external images, including tracking pixels that are used to gather data, even when the Mail client is asked not to do this." From the article: A preview of the unopened emails was shown by Spotlight, which revealed to the operator of the server hosting the pixels the receiver’s IP address, current OS version and some details about the browser used as well as the version of Quick Look, a program that let’s users preview a document.

Comments

A job for Little Snitch

[GlobalEcho]

I noticed this with Little Snitch, which I recently installed on my laptop. It allowed me to prevent the queries, for which I was quite grateful. I'm not particularly happy with all of Spotlight's newly introduced web search components, either -- I wonder if there's a way to turn that off.

Re:A job for Little Snitch

[Noah Haders]

I'm not particularly happy with all of Spotlight's newly introduced web search components, either -- I wonder if there's a way to turn that off.

Apple says

If you do not want your Spotlight search queries and Spotlight Suggestions usage data sent to Apple, you can turn off Spotlight Suggestions. Simply deselect the checkboxes for both Spotlight Suggestions and Bing Web Searches in the Search Results pane of Spotlight preferences in System Preferences on your Mac. If you turn off Spotlight Suggestions and Bing Web Searches, Spotlight will search the contents of only your Mac.

Re:A job for Little Snitch

[Sox2]

following apples suggestion for limiting spotlight intrusiveness does not stop spotlight attempting to connect to a large range IPs.

Re:A job for Little Snitch

[Ol Olsoc]

I noticed this with Little Snitch, which I recently installed on my laptop. It allowed me to prevent the queries, for which I was quite grateful. I'm not particularly happy with all of Spotlight's newly introduced web search components, either -- I wonder if there's a way to turn that off.

I was also shocked, because the new "features" have caused me to stop using Spotlight

not really a bug just a behavior

[goombah99]

any browser, especially ones that do pre-fetching, reveal the same details. pre-fetching can send your OS and browser details, even cookies, to sites you never visit. This isn't seen as a disaster and those are not deep secrets. Mail is doing this one step deeper by automatically pre-fetching all your e-mails. But seriously, most people delete there e-mails by clicking on the e-mail and hitting the trashcan. so that fetch happens. only some folks will devise strategies to actually not look at an e-maiul before deleting it. and for them , they can exclude e-mail from previe and spotlight.

I already remove e-mail from spotlight just because I don't want e-mails poping up in my searches under an employees name. that could get embarassing if the employee is there while I'm searching for some document we created together.

Re:not really a bug just a behavior

[QuietLagoon]

not really a bug just a behavior

OK, if it's working as designed, then let's call it a design bug instead of a coding bug.

Re:not really a bug just a behavior

[bws111]

Browsers do not reveal the same details. The links in an email (if followed) prove that the email address is valid, something your browser can not do. Email clients (good ones anyway) do not automatically follow the links, either in preview or even if you open the mail, unless you ask them to. This is a bug.

Re:not really a bug just a behavior

[bws111]

It shows images by following links.

Re:not really a bug just a behavior

[bws111]

It IS worse. Whether or not to accept tracking cookies is up to me. Whether or not my email address gets confirmed as being active and in use is not up to me, because this search program is doing it.

Furthermore, since the search program is following these links it obviously must be interpretting the returned data somehow. Is that interpreter known to be perfect, or is it possible someone could create some malicious content that could cause the interpreter to do something bad? Then, all they have to do is send you an email with a link to the content and the search will happily do whatever the malware wants.

We constantly see comments on here about how stupid people are because they are tricked into following links to sites with malicious content. Here, we have a program doing that exact thing, without user control, and that behavior is being excused. Why?

Other mail agent

[chthon]

That's why I use claws-mail

Re:WHAT?!?!?!?

[Anonymous Coward]

It's only impervious to criticism.

Re:Eh, minor bug

[Anonymous Coward]

I am really confused what the 'Settings.app->Mail, Contacts, Calendars -> Load Remote Images' setting does then.

Mine is set to off, and I do not see any remote images. Since an Anonymous Coward on Slashdot says it does not have that option, it must be true.

Segregate mail like the good ol' days

[ilsaloving]

I personally don't understand the need to have system-wide access to email in a moment's notice. Is email not obscenely pervasive enough already?

I disable it from my spotlight preferences as a matter of course.

For that matter, I don't even use the default Mail app that comes with OSX cause it has a couple odd behaviours that tend to drive me nuts, so I'm using PostBox instead. Good ol' fashioned indexing and searching, as god intended.

This is serious for users

[dhaen]

I've used OS X since it's release, this is the first of the many published vulnerabilities that actually causes me concern. From a security perspective Spotlight is unusable on Yosemite machines until this is fixed. Thank goodness my main machines are still on 10.9.

Re:This is serious for users

[Rosyna]

This isn't a vulnerability, and to disable it all you have to do is uncheck "Mail & Messages" in the Spotlight preference pane in System Preferences.

Re:This is serious for users

[friedmud]

It's also only a problem if you're using Mail.app... I'm sure many people are like me and just use GMail, etc. directly through the web interfaces.

Personally, Google Inbox is _way_ beyond Mail.app...

Re:Eh, minor bug

[Anonymous Coward]

Or even that it does not default to blocking (like Outlook) and allow unblock...

Outlook

[steveo777]

I'm pretty sure MS caught hell for this about a decade ago when their preview pane would preload the entire contents of an email, including VBS scripts and links... It's not like it's the first time it happened, but it looks pretty bad for Apple having made the same mistake twice.

Re:Outlook

[Kaenneth]

Funny story, back when I was contract testing at MS, I bugged that as potential privacy issue in Outlook Express before it was released but the triage team didn't think it was important enough to change.

Re:MOD +5 INSIGHTFUL TO INFINITY

[ArcadeMan]

AND BEYOND!

Re:Tracking pixels?!

[ArcadeMan]

I got mine from the store that sells dehydrated water and air guitar strings.

Re:Eh, minor bug

[grub]

This is about OSX mail, not iOS mail.

Re:Eh, minor bug

[swb]

Because I'm inclined to be conspiratorial, I am somewhat suspicious that iOS Mail and Safari are written with advertiser-friendliness in mind which leads to them loading mail images automatically and the lack of an adblocking feature (or add-in capability) to Safari.

Yes, you can install a third-party browser like Mercury which can do adblocking but there's no way to change the default browser, which leads to Safari getting used (it doesn't help that Mercury's "Open in Mercury" bookmarklet is broken, the URL getting escaped/parsed wrong when it lands in Mercury).

Umm

[easyTree]

I'm sure they'll both get over it.