macOS QuickLook Cache Leaks Encrypted File Previews
macOS QuickLook caches unencrypted thumbnails and file paths of contents stored in encrypted containers and USB drives, exposing them even after unmounting.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
Security researcher Wojciech Reguła, in a guest post on Objective-See, details how macOS's QuickLook feature (via the com.apple.quicklook.ThumbnailsAgent XPC service) persistently caches thumbnails and file paths of previewed files—including those stored in password-protected encrypted containers like VeraCrypt, TrueCrypt, or encrypted HFS+/APFS volumes—in a plaintext SQLite database and data file under the user's temporary directory. This caching can occur automatically simply by viewing a directory in Finder, without the user ever manually invoking a QuickLook preview, and the cached thumbnails often retain enough resolution to discern the original file's contents.
The research demonstrates that this cached data persists even after the encrypted volume is unmounted and survives across reboots, making it accessible to any code running in the user's context, forensic investigators, or an attacker/law-enforcement actor with access to a running (even if the container is unmounted) system. The same behavior extends to removable USB drives, meaning file names and thumbnails from any USB stick ever inserted into the Mac remain recorded indefinitely, which the authors note could serve as a valuable historical record for forensic investigation or surveillance implants.
The post also covers mitigation: Apple's qlmanage utility with the standard -r flag does not clear the cache, but an undocumented 'qlmanage -r cache' flag purges it immediately, and 'qlmanage -r disablecache' can persistently disable QuickLook caching by modifying the com.apple.QuickLookDaemon.plist. This is presented as a privacy/forensics issue rather than an actively exploited vulnerability, with no CVE assigned and no indication of in-the-wild abuse by threat actors.
Detection guidance
QuickLook Cache Access via qlmanage Utility
A behavioural hunt for the technique in general.
Detects execution of qlmanage utility with cache-related flags, which may indicate attempted access to or manipulation of QuickLook thumbnail cache containing file previews from encrypted volumes. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: QuickLook Cache Access via qlmanage Utility
description: Detects qlmanage utility execution with cache manipulation flags (-r
cache, -r disablecache). QuickLook caches thumbnails and file paths from encrypted
containers, USB drives, and other sources in plaintext SQLite databases accessible
to user-context processes.
tags:
- attack.t1005
- attack.discovery
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith: /qlmanage
CommandLine|contains:
- -r cache
- -r disablecache
filter_legitimate_admin:
User|contains:
- root
- _securityagent
condition: selection and not filter_legitimate_admin
falsepositives:
- System administrators routinely clearing QuickLook cache as part of privacy/forensics
hygiene
- Legitimate privacy-focused utilities scripting cache purges
level: medium
id: 9a620837-5457-5258-a115-44e1170fdf71
status: experimental
author: Vorant
Enumeration of QuickLook Cache for Encrypted Volume Artifacts
A behavioural hunt for the technique in general.
Detects processes enumerating or listing contents of QuickLook cache directories in user temporary folders, potentially to extract file paths and thumbnails from unmounted encrypted volumes or USB drives. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Enumeration of QuickLook Cache for Encrypted Volume Artifacts
description: Detects process listing or directory enumeration of QuickLook cache stored
under user temp directories. Attackers may enumerate these caches to extract file
paths and preview thumbnails from encrypted containers and removable media without
needing to mount or decrypt the original volumes.
tags:
- attack.t1005
logsource:
category: process_creation
product: macos
detection:
selection:
CommandLine|contains:
- 'ls '
- 'find '
- 'cat '
- 'strings '
- 'sqlite3 '
filter_admin_context:
User|contains: root
condition: selection and not filter_admin_context
falsepositives:
- Security researchers or forensic analysts investigating system artifacts
- System administrators performing cache diagnostics
level: low
id: 8d8ede25-b60f-5ce4-8ca6-afb3fc3bf620
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x30.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs