4 ms·
Oh no. Here's how an attack might go. I'm a shop assistant and show you a QR code to scan to make a purchase. Unknown to you, I'm not actually showing you th
by antimagic 11y ago
Oh no. Here's how an attack might go. I'm a shop assistant and show you a QR code to scan to make a purchase. Unknown to you, I'm not actually showing you the real app, but a fake app with fake QR code that will redirect you to a malicious website, which in it's turn will load the proper URL after having executed an unpatched zero-day on your device. You are sad because your device has just been pwned.
You are at the mercy of the source of the QR code, with no real way of being able to validate it before scanning.
- rahimnathwani 11y agoThis attack wouldn't work. Scanning a QR code which goes to a non-WeChat URL will flip to WeChat's built-in browser, which looks very different from the payment dialogue box. In any case, how are QR codes different from text URLs? Do you check the destination of every web link and/or button before clicking? Do you disable JS so that you can be sure that the URL displayed in the status bar isn't different from the one which will really be launched?
- EliRivers 11y agoWhat you say is true, and makes no difference. QR codes are very popular and in very common use in China.
- djyde 11y agoYup, now when I wanna pay for some drink, I only need to take out my mobile, then open wechat, then scan the QR code showed on the vending machine screen. Like this: http://i.imgur.com/mlIr3QP.jpg http://i.imgur.com/mlIr3QP.jpg
- tellthetruth1 11y agoVending machines in the US only take coins, like a post-apocalyptic stone age world. So ahead of time...
- bouyoul420 11y agoIn this case, the scanning is done by the Wechat app not some general-use browser. You would assume they check the validity of the data in the QR code and don't do simple redirection to a random web page.
- erikb 11y agoYeah, but you don't show your QR Code, I show mine. Your trick can be to grab more money from me than you put on your price tag.