Slashdot Mirror
Malicious QR Codes Posted Where There's Lots of Foot Traffic
Orome1 writes "QR codes are very handy for directing users to specific sites by simply scanning them with their smartphones. But the ease with which this technology works has also made it a favorite of malware peddlers and online crooks, who have taken to including QR codes that lead to malicious sites in spam emails. They have also begun using the same tactic in the physical world, by printing out the malicious QR codes on stickers and affixing them on prominent places in locations where there is a lot of foot traffic. According to Symantec Hosted Services director Warren Sealey, these locations include airports and city centers, where the crooks stick them over genuine QR codes included in advertisements and notices, and most likely anywhere a person might look and be tempted to scan them."
If anyone actually used QR Codes, which they don't, so no harm.
No way. Rick Astley? Goatse? Not worth the risk.
Does anyone actually use QR codes to go to websites? I've only used a handful of QR codes and those were for store promotions where if you were in their store you could scan a QR code and get a virtual "scratchers" ticket which would tell you if you won a prize or not.
Taxation is legalized theft, no more, no less.
I know it's about pedestrian, rather than vehicular, traffic. But for an instant I thought some genius had thought of an exploit for high-tech shoes that had QR code scanners in their soles that linked to their smartphones.
Now that would be a plot for a near future sci-fi novel. A sort of Apple maps-like fiasco that would send hapless pedestrians falling off bridges or onto the freeway.
Now I will need to disable them in Google Glasses or something.
The Glasses! They do something!
"There is more worth loving than we have strength to love." - Brian Jay Stanley
It'll check out the site before connecting you, and is one of the few free code readers that doesn't require location permissions.
Any time you obfuscate the underlying address in a URL you pose a security risk.
QR codes are no different than shortened URL services like blt.ly or goo.gl. All of these have the potential to take users to malicious websites because they can't be easily identified to the human reader.
I'm far more afraid of vicious gangs of Keep Left signs
If you insert your reproductive organs into an unverified orifice, or allow unverified reproductive organs or objects into your orifice, you run the risk of catching an infection.
Why should sticking a QR code into your phone be any different?
[End Of Line]
At least in the realm of getting a small bit of info from a printed surface into a modern (i.e., powerful) mobile device. Why not just have some human-readable text in a nice machine-readable font inside a distinctly-shaped box? Mobile devices can easily read lots of kinds of text, but a) this one has high reliability and b) the font itself conveys the purpose. For a shape, the existing QR box -- a square with three smaller squares -- would work, or it could be something new.
This would solve THREE problems: 1) much less chance of malicious URLs, 2) you wouldn't need to scan it with a machine to see if you even want it in the first place, and 3) they'd be much easier to generate.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
Well, I am surprised it took so long to appear. The attack is easy and the gains are obvious.
When you put links to Tubgirl and Goetse on top of realtors(estate agents) QR codes
Donte Alistair Anderson Roberts - hi son!
Karma: Chameleon
1. Find film posters.
2. Apply QR code pointing to a pirate source for that film.
3. No profit. That's the idea.
I predict the next QR code attack will be:
Malware QR codes blinked on TV screens, or web pages, just long enough to drive exposed phones and devices to hostile sites.
Sorta like digital subliminals.
I think it's interesting that slashdot got it. Maybe there is no pure security out there, but clearly there are preventative steps that could help.
PocketPermissions Android Permission Guide
Follow the money. Sooner or later someone has to take money out of the ultimate destination account.
Then, testicleectomy is warranted.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.