↓ Skip to main content
A lattice relay mast on open ground, its drum antennas facing out across distant landscape.
Photo by Kabiur Rahman Riyad on Unsplash
  1. Archive/

Stop OS X Spotlight Leaking Your Location

·2 mins
Spotlight macOS Burp Suite Information disclosure
Patrik Grobshäuser
Author
Patrik Grobshäuser
Security researcher at Assetnote / Searchlight Cyber. Before that, seven years triaging other people’s reports at HackerOne and Shopify. Hunting bugs since 2012, published as Patrik Fehrenbach until 2025.
Table of Contents

tl;dr: how to stop OS X from shipping your location to Apple’s servers every time you use Spotlight.

The OS X Spotlight search window open on the desktop, the search feature that transmits location data to Apple

I like using the Spotlight function of OS X — it is a fast way to get at my files — but it also sends my geolocation to Apple every time I search. This blogpost will be about how to disable or at least prevent the built-in Spotlight search from sending your IP-based location to Apple’s servers.

Proof of concept
#

But first have a look at what’s being sent:

GET /search?q=asd&latlng=48.082000,8.640000&geosrc=wifi,155.643824&storefront=143443-4,13&locale=de-DE&time_zone=Europe/Berlin&calendar=gregorian&key=montana4289 HTTP/1.1
Host: api.smoot.apple.com

This request was captured during a Burp session.

What you can see here in the Parameters

  • q is the Query you send to the Apple Servers
  • latlng is the Latitude and the Longitude of your current (IP) location

I think it’s needless to say that this information should stay private (at least in my opinion). If you want to keep your searches fancy you can stop reading here, preventing the geolocation will change your search experience but you will gain some privacy back.

Setting it up
#

First way: the hosts file
#

The /etc/hosts is a local text file that tells the system how to resolve an IP-Address to a Domain. The clue here is to point the Apple domain api.smoot.apple.com to the localhost address of your machine (127.0.0.1). This will tell the system to resolve every request to api.smoot.apple.com to the localhost address, thus leading nowhere. To do so:

  1. Open a terminal
  2. sudo vim /etc/hosts
  3. Add the line 127.0.0.1 api.smoot.apple.com
  4. Flush the DNS cache with sudo discoveryutil mdnsflushcache
  5. All set.
The /etc/hosts file open in a terminal showing api.smoot.apple.com pointed at 127.0.0.1

Second way: Little Snitch
#

I don’t want to promote anything here, but the Little Snitch software is worth buying. Little Snitch helps you to organize every incoming and outgoing connection, you can simply add a rule for the Spotlight search:

You want to disable the locationd Service that tries to connect to gs-loc.apple.com – forever.

A Little Snitch connection alert asking whether to allow the locationd process to connect to gs-loc.apple.com, set to deny forever

You are done — privacy saved.

Related