Slashdot Mirror

← Back to Stories (view on slashdot.org)

Malicious QR Codes Posted Where There's Lots of Foot Traffic

Posted by Soulskill on from the neither-idiotproof-nor-jerkproof dept.

Orome1 writes "QR codes are very handy for directing users to specific sites by simply scanning them with their smartphones. But the ease with which this technology works has also made it a favorite of malware peddlers and online crooks, who have taken to including QR codes that lead to malicious sites in spam emails. They have also begun using the same tactic in the physical world, by printing out the malicious QR codes on stickers and affixing them on prominent places in locations where there is a lot of foot traffic. According to Symantec Hosted Services director Warren Sealey, these locations include airports and city centers, where the crooks stick them over genuine QR codes included in advertisements and notices, and most likely anywhere a person might look and be tempted to scan them."

10 of 89 comments (clear)

  1. This could be really dangerous! by Anonymous Coward · · Score: 4, Insightful

    If anyone actually used QR Codes, which they don't, so no harm.

    1. Re:This could be really dangerous! by MrEricSir · · Score: 4, Funny

      This is why I'm sticking with my :CueCat.

      --
      There's no -1 for "I don't get it."
    2. Re:This could be really dangerous! by idontgno · · Score: 4, Informative

      I can only speak for my specific case (Android, using Barcode Scanner app): the app displays the captured image, metadata about the capture, and a decode of the string (recognizing, for instance, that it's a URI QR). BUT does not just hie off to whatever website is indicated. The displayed URI string is clickable, and clicking it does open the URI in the default browser app, but it does take that much human intervention to navigate there.

      A few notable specifics to compare with other situations:

      (A) No OS-native QR code capability. It required an app from the Google App Store (free, but not Free). One of several, it appears.

      (B) There is a configurable option "Retrieve more info" which, when enabled, looks up information about URI/URL QR codes as part of the decode. For instance, after ingesting the sample QR code from the Wikipedia "QR Code" article, the app correctly decodes the URI as "http://en.m.wikipedia.org", but with the "Retrieve more info" option enabled, it adds the descriptor "Wikipedia, the free encyclopedia"... which is the <Title> property at the top of that page, so I guess the app is retrieving the target URL internally and decoding the <Title> at least. Maybe that would be a buffer overflow vector for a well-crafted exploit, so I turn that option off.

      --
      Welcome to the Panopticon. Used to be a prison, now it's your home.
    3. Re:This could be really dangerous! by CanadianRealist · · Score: 3, Interesting

      The problem here is you are being reasonable and thinking logically about what you're doing. I'm sure you've noticed how much the average person hates having to think. Compare your comment with the average YouTube comment and see if you don't notice a difference.

      Now, try behaving like the average person for a bit: point at the QR code and then click whatever link pops up. Come on, you've already done more than enough thinking: putting the app on your phone, loading the app and pressing a button while aiming at the QR code. Now you want to have to think some more, think about where that link is going to take you?

      I bet the problem makes much more sense now.

    4. Re:This could be really dangerous! by Eythian · · Score: 3, Informative

      The source code for the Barcode Scanner app can be found here: http://code.google.com/p/zxing/source/browse/trunk

      It is free as in Free, Apache 2.0 license.

  2. I don't use QR codes by dmomo · · Score: 3, Funny

    No way. Rick Astley? Goatse? Not worth the risk.

    1. Re:I don't use QR codes by emurphy42 · · Score: 3

      I love how those two things are like equally heinous in your book. :)

      I scan 'em once in a blue moon, but my phone app shows you the URL and asks confirmation, so at least there's that.

  3. Re:Yes, and my /. id is smaller than yours by SuperKendall · · Score: 4, Funny

    Now I will need to disable them in Google Glasses or something.

    The Glasses! They do something!

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
  4. Norton Snap QR code reader by doug141 · · Score: 3, Informative

    It'll check out the site before connecting you, and is one of the few free code readers that doesn't require location permissions.

  5. Obfuscated URLs by agiacalone · · Score: 5, Interesting

    Any time you obfuscate the underlying address in a URL you pose a security risk.

    QR codes are no different than shortened URL services like blt.ly or goo.gl. All of these have the potential to take users to malicious websites because they can't be easily identified to the human reader.