BadBarcode Attack Forces Host System To Carry Out Commands (threatpost.com)

msm1267 writes: Researchers at this week's PacSec 2015 conference in Tokyo demonstrated how they were able to inject special control characters into a barcode, so that a barcode reader will 'press' host system hotkeys, and activate a particular function. The attacks, called BadBarcode, can be used against any keyboard wedge barcode scanner that supports ASCII control characters--many do. An attacker than then use control commands to open or save files, launch a browser or execute commands. Here are the presentation slides.

Comments

Re:Go to bars to drink

[Nabeel_co]

Um, that's totally not true. Most barcode scanners just show up as USB keyboards, and most places don't bother to change them out of their default config.

Also, most discount cards, if they aren't 2D barcodes, are 1D Code128 codes.

Re:Go to bars to drink

[Technician]

Since many are USB devices, and programmed by special barcodes to enable and disable various symbologies, with enough info on the target scanner, you can reprogram the scanner with a barcode to enable a full ascii symbology, then scan in the attack code. Like many thumb drives, BIOS, etc, there is no write protect to prevent unauthorised alteration of the configuration.