Spotlight in OS X Yosemite May Reveal Personal Information

The Spotlight search feature in OS X Yosemite appears to contain a security vulnerability that could cause personal information to be inadvertently exposed. That can happen when Spotlight searches email messages.

According to the German news site Heise, the problem lies in the fact that Spotlight automatically previews the search results. Because the search engine also searches e-mails, the attached images can be opened automatically in this way. This allows any accompanying tracking information, which is hidden in the images, to do its job.

Even if users have chosen not to automatically open images in emails, the search engine is allowed access: according to Heise, Spotlight does not adhere to this setting. In addition, e-mails that have ended up in the junk folder are also searched. Such emails are more likely than average to contain tracking information.

The Spotlight vulnerability could, among other things, allow IP addresses to be stolen and find out when and how often the user viewed the image, as well as the email addresses that received it. Such information is, for example, of interest to spammers, who want to know whether their e-mails are received and viewed.

A plug-in has now been developed that ensures that Spotlight only searches the text versions of e-mail messages. Therefore, images are left alone. It is not yet clear whether Apple will fix the leak.