Slashdot Mirror
QR Codes As Anti-Forgery On Currency Could Infect Banks
New submitter planetzuda writes "Invisible nano QR codes have been proposed as a way to stop forgery of U.S. currency by students of the South Dakota School of Mines and Technology. Unfortunately QR codes are easy to forge and can send you to a site that infects your system. Banks would most likely need to scan currency that have QR codes to ensure the authenticity of the bill. If the QR code was forged it could infect the bank with a virus."
Only if they're stupid enough to execute code formed from non-executable input.
There was a way to scan a QR code without having an unpatched IE6 accessing the url in the code...
A bank note QR code would refer to a single site. It would not go to "the world".
Input hardening in such a case should be reasonably trivial. And if it failed to have the proper form it would be false.
I guess that's why all the checkouts at our local grocery stores get viruses when we scan the wrong barcodes.
Use appropriate software. Fuck.
What? QR codes can hold arbitrary strings, they don't have to be just URLs. This summary makes no sense. There isn't even an article here! Who is editing this shit?
A QR code is a two-dimensional barcode. A pretty decent way to embed a serial number. What exactly about the idea makes the poster believe the banks' scanning software would jump to some arbitrary website after the scan? Presumably, a much more sane and secure thing to do would be to look up the serial number in a database on a single, secure site.
QR Codes don't send you anywhere. They're just data. They can contain web links, just like any written sentence, but a device won't download the content at a linked URL unless it is programmed to.
QR codes are futuristic, 2D versions of bar codes. Nothing more.
This story displays an incredibly low understanding about what a QR code even is, let alone how you would write a QR code reader for a secure environment. I'm surprised this even got accepted.
The only way I could remotely see that happening would be if there was a vulnerability in the system that allowed for a buffer overflow attack of some sort. The problem with that is that QR codes only have a limited amount a data, which would make this all but impossible.
Next problem: idiotic user submissions combined with lazy "editors" could infect Slashdot with terrible articles on the front page.
Bank staff could break their teeth by trying to bite coins. They could also give themselves a sun burn by keeping their hand under the note-testing UV lamp. And now they have the added hazard that they could follow a link on a QR code to an infected site.
1. It's "The University of Michigan." Not trying to be as pedantic as those who insist on THE Ohio State University (as opposed to that other Ohio State?), but no one uses 'Michigan University.'
2. At no point, in any of the three cited articles, is U of M mentioned. The QR / Currency article from engadget refers to The South Dakota School of Mines and Technology, which is slightly different from umich.
There are some people that if they don't know, you can't tell 'em.
It's unclear how much malware spread by QR codes in late 2011, but AVG reports that it's an ideal distribution method for nefarious software and it expects the practice to grow throughout 2012. Users are unaware of what the code contains until the malware has already gained foothold. The point being, QR codes aren't as safe as you might expect them to be. The security firm likens scanning unknown QR codes to running an unfamiliar executable on your computer.
Let's repeat this again, people: QR Codes are simply a new version of a barcode. They are not magic pictures that infect computers or phones. There is nothing wrong with taking a picture of a barcode.
OTOH, if you run an application that which upon reading a code will automatically open a webpage that might run a script without user intervention, you giving people a guest pass.
when malware spread through QR codes on a Russian website and forums. The code directed victims to a download location for an infected version of the Jimm mobile ICQ client. The malware sent SMS messages to premium numbers.
They directed their phones to a web address they didn't know and shouldn't have trusted, downloaded an application and then installed it. This was their own fault. This has no more to do with QR codes infecting computers than a hyperlink can.
As other posters have pointed out, what if the QR code contained a hash of the serial number and a few other identifying marks visible on the bill? Now you can use the infrared QR and OCR to validate a given bill. In general I think the mints have given up on creating a forge-proof bills. They just keep updating the design with forge resistant features to stay one step ahead. The only problem I have with this is that there are so many different designs in circulation that a lay person cannot easily spot a fake, and may be more likely to accept one.
Reminds me at that movie: "uploading virus ..."
Funny was they used a Mac for that ...
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
Dude probably is watching too much TV where you can burn down computer by scanning bones
Each note seems to have a serial number, meaning it should be unique. Why not have each note's S/N cryptographically signed and the signature stamped onto the note along with the S/N in some kind of machine-readable format?
It should then be possible to scan the barcode and verify the signature to determine whether the note was legitimate. They could create unique keys for each Federal Reserve district, perhaps annually, so that you wouldn't have to worry as much about the key being compromised.
Someone could clone the same S/N and signature, but if they did it would be easy for banks or other large cash processors with scanners to identify duplicates and remove them from circulation. Dupes could be identified as currency scanned at more than one geographic location within a certain time window where the chance of the currency being in two places at once was very slim -- kind of like the antifraud calls I've gotten from a credit card company when I've used a card in two cities in the same day.
Small numbers of duplicates would be hard to track, but the economic risk from counterfeiting isn't from some guy with a scanner and a inkjet printer but from mass counterfeiting of thousands of notes.
Well, your post contains one truth, your IQ isn't 50. It is far far lower.
QR is simply a bar code. You scan it and get a string of data. That is it. It can contain any string valid within its codeset but it is just a string just a barcode is just a number.
Sure, buffer overflows exist but they exist deep within complex code, not on simple basic stuff as reading in a user input especially when there is only one.
And people with IQ of 50 (you call them master or whatever you can manage to utter with your sub-50 IQ) don't work for banks.
It doesn't matter if the string contains characters that together form a URL, that is only valid if someone with a sense of humor starts testing the read string for what it might possibly contain. It could be a string that if processed as a gif shows a image. But why would a banknote scanner contain the code to do that?
I could build a nut screwing robot and then give it an icecream and watch it transform itself into a icecream eating machine OR I could see it reject the input as invalid because it was never programmed to deal with that input.
What do you think that happens if a random string of text in a ssl key happens to form the word "reboot". That the computer will reboot?
You, the submitter, timothy and an awful lot of people who should be on facebook instead of slashdot seem to think computers are magic. They are not.
Only when silly MS programmers try to make their software clever by trying to guess what input could mean, things go wrong. People who software for banks are not silly.
If you spend a million years beating them over the head with a feature for "smart" input where code just tries to run any input whatsoever, they would just not get what you are trying to do. Such a stupid idea just does not exists in the universe of serious coders. There are no serious coders at MS. Or indeed Apple. Or many linux projects. Luckily banks for make it a point to find it for their "oh shit this is going to cost us more money then the worst/best traders in history" projects. Else the treasury goes after them and this ain't the corrupt branch of government, this is the bit that closes you down and then dissects your corpse while you are still using it so they can find the stupid bit and show it to all the banks. There are a lot of banks, so they will have to cut your up pretty small.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
It's blatantly just planetzuda.com spamming its own worthless article.
Oh, I'm sorry sir, I thought you were referring to me, Mr. Wensleydale.
Please remove this post, the lamest programmer in the world will be able to avoid this "infection", as said by a lot of people QR codes contain binary datas or strings. I think this is a tabloid level post, an insult to slashdot users.
It would be super amazing to own a smartphone with an infrared laser illuminated microscope.
I'm baffled by all the comments about the security concerns on this. Barcode scanners have been reading UPC codes at PC-based cash registers operated by high school dropouts for decades, and nobody has yet been able to craft a magic barcode that can crash the system. The argument is asinine. It is not that hard to establish a standard and write some firmware with strict adherence to that standard that will reject anything that is non-sense. Seriously does nobody understand how things work any more?
Here, let's invent a specification and a bill sorter that uses it, it'll be fun. The QR code will implement a cipher using 6-bit characters supporting an input character set of [A-Z0-9] with an exact string length 11 characters, or 66 bits. This is sufficient to encode the serial number on the $5 bill in my pocket right now. The cipher will put out the exact same number of bits, and the "QR style code" will encode exactly those bits, no more, no less (for extra credit, we can add some checksum / error correction bits). When a scanner picks up the code, it will check the bit length and verify that it is 66 bits, then it will reverse the cipher and compare it to the plain text serial number on the front of the bill. If the 66-bit strings match, the sorter will drop the bill in the "accepted bin", else it will be diverted to the "inspection bin".
Now you go ahead and think up a scheme by which you can crash and/or infect my scanner. Any firmware developer worth their salt would be able to see you coming a mile away in such a simple system.