BadBarcode Attack Forces Host System To Carry Out Commands (threatpost.com)

Posted by timothy on Friday November 13, 2015 @03:28PM from the don't-look-at-this dept.

msm1267 writes: Researchers at this week's PacSec 2015 conference in Tokyo demonstrated how they were able to inject special control characters into a barcode, so that a barcode reader will 'press' host system hotkeys, and activate a particular function. The attacks, called BadBarcode, can be used against any keyboard wedge barcode scanner that supports ASCII control characters--many do. An attacker than then use control commands to open or save files, launch a browser or execute commands. Here are the presentation slides.

1 of 79 comments (clear)

Min score:

Reason:

Sort:

Derp by flopsquad · 2015-11-13 15:55 · Score: 4, Funny

[STX]
Did you implement all of ASCII in your barcode scanner?
[ACK]
Did you think to scrub out control characters?
[NAK]
Do you know what that means?
[ENQ]
I'll ask the questions, bub.
[BS][BS][BS]
Don't try to BS me.
[SI][SO][ESC]
Where are you going? You can't leave!
[NUL] . . . [DC1]
[BEL][BEL][BEL] Correct. Hackers have control of your device. Now go fix your shit.
[ETX]

--
Nothing posted to /. has ever been legal advice, including this.