As Wojciech Reguła explained in his blog post,
“I found out that Quicklook registers com.apple.quicklook.ThumbnailsAgent XPC service that is responsible for creating thumbnails database and storing it in /var/folders/.../C/com.apple.QuickLook.thumbnailcache/ directory. It means that all photos that you have previewed using space (or Quicklook cached them independently) are stored in that directory as a miniature and its path. They stay there even if you delete these files or if you have previewed them in encrypted HDD or TrueCrypt/VeraCrypt container.”He even gave a proof of concept to show how this app retains your data.
Wojciech Reguła is an iOS apps security researcher and a penetration tester at Securing. Though, according to him, he never noticed this flaw in the app. Yet, he is not the first to point out towards a Quick Look vulnerability.
Previously, Mari DeGrazia, in 2016, highlighted how Quick Look stores data related to thumbnails into an index.sqlite file located under /private/var/folders/<random>/<random>/C/com.apple.QuickLook.thumbnailcache. Likewise, Sara Newcomer (in 2014), and Lodrina Cherne (in 2018) also described how Quick Look can store your data.
Now, a week later, another vulnerability discovered in Mac OS. That too, in its Quick Look feature, which already has a legacy of vulnerabilities reported in the previous years. Indeed, if Apple wants to keep marketing itself as a “privacy freak” company, it should get rid of all such bugs that violate customer’s privacy as soon as possible.
Let us know your thoughts in the comments below.
