11 ms·

Barcode attack technique

125 points by voltagex_ 11y ago

crisp 11y ago
Wow, never really thought a barcode as another attack vector. I might dig a bit deeper and do my master's thesis about it. Sounds really interesting.
- jakub_g 11y ago
  Since QR codes became ubiquitous in public places, I started thinking about someone planting fake ones, on top of the original ones, that would redirect to shady websites. If the website is similar enough to the one it impersonates, it would be hard for the user to distinguish.
  - crisp 11y ago
    True. It would be interesting to conduct an empirical study about this and raise people's awareness at the same time.
  - roel_v 11y ago
    Does anyone ever scan a qr code? Besides, I haven't seen any for maybe 2 years now - or have I just become blind to them?
    - crisp 11y ago
      I live in Finland and I see them every now and then. I myself read them quite rarely, though. Only if it's a good offer or it benefits me some other way. Most of those codes are just for more info -type which don't really seem to interest people, including myself. The idea of QR codes are kinda okay but the implementations lack of imagination.
    - runholm 11y ago
      I can pay at my local store by scanning the QR code for the specific register. The app then let me chose to pay for the currently ongoing transaction at that register. It's neat. Besides such application specific use cases they seem dead though.
      - roel_v 11y ago
        Where is that? Never heard of that use case. Have you ever asked the merchant how many people use it?
    - Djorak_ 11y ago
      I often scan them to hire a bike in Glasgow, the mobile app uses a QR code to identify the bike and give me the lock code.
    - carlob 11y ago
      http://picturesofpeoplescanningqrcodes.tumblr.com http://picturesofpeoplescanningqrcodes.tumblr.com
      - roel_v 11y ago
        I lol at this page every time I open it, even after all those years. Call me immature, I guess...
    - patkai 11y ago
      Almost any user manual nowadays has a QR code, I also see it on magazines, even in printed ads (in Finland also). However, the UX is really bad: 1. most people don't know what they are 2. if they learn, then they have to find a QR reader app 3. reading experience: pick phone from pocket, open it, find the app, start it, scan it. Possible solution: 1. phones should have it pre-installed 2. it should be simple to snap a qr tag (e.g. without opening, e.g. with hotkey) 3. url should go to notifications queue or very easily accessible, also for integrations 4. users should be better educated, e.g. when there is a qr tag in a magazine there should be a short explanation. (https://www.quikklytags.com/#/ https://www.quikklytags.com/#/ seems very promising from this point of view) I think QR tags have huge untapped potential.
      - Already__Taken 11y ago
        Yeh your phone camera app should just do it. I spent ages going through the android store to phone an app the didn't[0] want my entire contacts list or browsing history to scan a glorified sudoku. [0]: https://play.google.com/store/apps/details?id=tw.mobileapp.qrcode.banner&hl=en_GB https://play.google.com/store/apps/details?id=tw.mobileapp.q...
        jakub_g 11y ago
        In the same spirit, it is mindblowing that some Android phones do not even have a flashlight app (I had a flashlight in my dumbphone 8 years ago), and the same applies - most flashlight apps need exorbitant permissions; I found [0] as the only one that doesn't need anything else than, well, camera and flashlight access. I see Android as OS may not want to support it as some phones/tablets do not have physical flashlight. This would be a genuine occasion for vendors to provide something themselves which is not a bloated crapware, but not all of them do it. [0] https://play.google.com/store/apps/details?id=com.snoopwall.flashlight&hl=en https://play.google.com/store/apps/details?id=com.snoopwall....
        Already__Taken 11y ago
        I've not updated my moto gallery app because it wants new permissions to "Contacts" for god knows why. So I don't think the OEMs would do it properly anyway. Street view update now wants identity, photos/files, camera and wifi info. On top of location of which as least made sense.
    - wingerlang 11y ago
      Commonplace in Asia. Especially for IM apps to add friends etc.
  - cstuder 11y ago
    There were reported instances of fake QR codes on political posters in Germany and Switzerland back in 2012. Somebody put a sticker on top of the original code and forwarded the people scanning it to porn websites. (I'm actually surprised somebody discovered the manipulation.)
  - geographomics 11y ago
    It's happened with Bitcoin QR codes, to redirect payment to the attacker's wallet: https://www.reddit.com/r/Bitcoin/comments/1wwzbf/psa_new_scam_to_be_aware_of_someone_stole_my/ https://www.reddit.com/r/Bitcoin/comments/1wwzbf/psa_new_sca...
marvel_boy 11y ago
This is possible on code128 barcode. This kind of barcode accepts not only numbers but also chars. Usually consumers deal with EAN13 barcode on the supermarket, they only accept numbers and this attack is impossible.
- crisp 11y ago
  This was something I wasn't sure of. How do you know this for a fact?
  - chiph 11y ago
    Because the "A" variant of Code128 allows you to have control characters in there. Many barcode readers act like keyboards to the computer - so the clerk/user positions their cursor to the item number field, waves the item in front of the scanner, and the scanner hardware inserts what it read into the field. Fast, reliable, and easy. But if the barcode contains control characters, it acts like a keyboard macro and will send them to the application. So if I embed a Ctrl-S in my hostile barcode, I can tell the software to save the record with data I supplied.
    - crisp 11y ago
      I actually wanted to know how marvel_boy knows that consumers usually deal with EAN13 barcode instead of code128. As he or she states, EAN13 barcodes would make this kind of attack impossible so I wanted to know if this is a real everyday problem concerning most of the stores or only a minority of them.
      - chiph 11y ago
        Look at the products you buy at the store (supermarket, Walmart, Target, etc) - the barcode is almost always EAN (now IAN)¹ There are exceptions for smaller items like packs of gum, which use UPC-E² encoding (if the manufacturer portion ends in zeros). Hundreds of thousands of products being purchased by billions of people mean they're the dominant barcode system. So far as attacks via UPC/EAN/IAN, they're not really possible as it only encodes digits, and only 13 of them. ¹ https://en.wikipedia.org/wiki/International_Article_Number_(EAN) https://en.wikipedia.org/wiki/International_Article_Number_(... ² http://www.barcodeisland.com/upce.phtml http://www.barcodeisland.com/upce.phtml
greggarious 11y ago
Reminds me of Tim Vidas' work on QRishing: https://www.cylab.cmu.edu/files/pdfs/tech_reports/CMUCyLab12022.pdf https://www.cylab.cmu.edu/files/pdfs/tech_reports/CMUCyLab12...
pkstn 11y ago
I wonder would similar technique work with RFID's..?

125 points by voltagex_ 11y ago

crisp 11y ago

Wow, never really thought a barcode as another attack vector. I might dig a bit deeper and do my master's thesis about it. Sounds really interesting.

jakub_g 11y ago
Since QR codes became ubiquitous in public places, I started thinking about someone planting fake ones, on top of the original ones, that would redirect to shady websites. If the website is similar enough to the one it impersonates, it would be hard for the user to distinguish.
- crisp 11y ago
  True. It would be interesting to conduct an empirical study about this and raise people's awareness at the same time.
- roel_v 11y ago
  Does anyone ever scan a qr code? Besides, I haven't seen any for maybe 2 years now - or have I just become blind to them?
  - crisp 11y ago
    I live in Finland and I see them every now and then. I myself read them quite rarely, though. Only if it's a good offer or it benefits me some other way. Most of those codes are just for more info -type which don't really seem to interest people, including myself. The idea of QR codes are kinda okay but the implementations lack of imagination.
  - runholm 11y ago
    I can pay at my local store by scanning the QR code for the specific register. The app then let me chose to pay for the currently ongoing transaction at that register. It's neat. Besides such application specific use cases they seem dead though.
    - roel_v 11y ago
      Where is that? Never heard of that use case. Have you ever asked the merchant how many people use it?
  - Djorak_ 11y ago
    I often scan them to hire a bike in Glasgow, the mobile app uses a QR code to identify the bike and give me the lock code.
  - carlob 11y ago
    http://picturesofpeoplescanningqrcodes.tumblr.com http://picturesofpeoplescanningqrcodes.tumblr.com
    - roel_v 11y ago
      I lol at this page every time I open it, even after all those years. Call me immature, I guess...
  - patkai 11y ago
    Almost any user manual nowadays has a QR code, I also see it on magazines, even in printed ads (in Finland also). However, the UX is really bad: 1. most people don't know what they are 2. if they learn, then they have to find a QR reader app 3. reading experience: pick phone from pocket, open it, find the app, start it, scan it. Possible solution: 1. phones should have it pre-installed 2. it should be simple to snap a qr tag (e.g. without opening, e.g. with hotkey) 3. url should go to notifications queue or very easily accessible, also for integrations 4. users should be better educated, e.g. when there is a qr tag in a magazine there should be a short explanation. (https://www.quikklytags.com/#/ https://www.quikklytags.com/#/ seems very promising from this point of view) I think QR tags have huge untapped potential.
    - Already__Taken 11y ago
      Yeh your phone camera app should just do it. I spent ages going through the android store to phone an app the didn't[0] want my entire contacts list or browsing history to scan a glorified sudoku. [0]: https://play.google.com/store/apps/details?id=tw.mobileapp.qrcode.banner&hl=en_GB https://play.google.com/store/apps/details?id=tw.mobileapp.q...
      - jakub_g 11y ago
        In the same spirit, it is mindblowing that some Android phones do not even have a flashlight app (I had a flashlight in my dumbphone 8 years ago), and the same applies - most flashlight apps need exorbitant permissions; I found [0] as the only one that doesn't need anything else than, well, camera and flashlight access. I see Android as OS may not want to support it as some phones/tablets do not have physical flashlight. This would be a genuine occasion for vendors to provide something themselves which is not a bloated crapware, but not all of them do it. [0] https://play.google.com/store/apps/details?id=com.snoopwall.flashlight&hl=en https://play.google.com/store/apps/details?id=com.snoopwall....
        Already__Taken 11y ago
        I've not updated my moto gallery app because it wants new permissions to "Contacts" for god knows why. So I don't think the OEMs would do it properly anyway. Street view update now wants identity, photos/files, camera and wifi info. On top of location of which as least made sense.
  - wingerlang 11y ago
    Commonplace in Asia. Especially for IM apps to add friends etc.
- cstuder 11y ago
  There were reported instances of fake QR codes on political posters in Germany and Switzerland back in 2012. Somebody put a sticker on top of the original code and forwarded the people scanning it to porn websites. (I'm actually surprised somebody discovered the manipulation.)
- geographomics 11y ago
  It's happened with Bitcoin QR codes, to redirect payment to the attacker's wallet: https://www.reddit.com/r/Bitcoin/comments/1wwzbf/psa_new_scam_to_be_aware_of_someone_stole_my/ https://www.reddit.com/r/Bitcoin/comments/1wwzbf/psa_new_sca...

marvel_boy 11y ago

This is possible on code128 barcode. This kind of barcode accepts not only numbers but also chars. Usually consumers deal with EAN13 barcode on the supermarket, they only accept numbers and this attack is impossible.

crisp 11y ago
This was something I wasn't sure of. How do you know this for a fact?
- chiph 11y ago
  Because the "A" variant of Code128 allows you to have control characters in there. Many barcode readers act like keyboards to the computer - so the clerk/user positions their cursor to the item number field, waves the item in front of the scanner, and the scanner hardware inserts what it read into the field. Fast, reliable, and easy. But if the barcode contains control characters, it acts like a keyboard macro and will send them to the application. So if I embed a Ctrl-S in my hostile barcode, I can tell the software to save the record with data I supplied.
  - crisp 11y ago
    I actually wanted to know how marvel_boy knows that consumers usually deal with EAN13 barcode instead of code128. As he or she states, EAN13 barcodes would make this kind of attack impossible so I wanted to know if this is a real everyday problem concerning most of the stores or only a minority of them.
    - chiph 11y ago
      Look at the products you buy at the store (supermarket, Walmart, Target, etc) - the barcode is almost always EAN (now IAN)¹ There are exceptions for smaller items like packs of gum, which use UPC-E² encoding (if the manufacturer portion ends in zeros). Hundreds of thousands of products being purchased by billions of people mean they're the dominant barcode system. So far as attacks via UPC/EAN/IAN, they're not really possible as it only encodes digits, and only 13 of them. ¹ https://en.wikipedia.org/wiki/International_Article_Number_(EAN) https://en.wikipedia.org/wiki/International_Article_Number_(... ² http://www.barcodeisland.com/upce.phtml http://www.barcodeisland.com/upce.phtml

greggarious 11y ago

Reminds me of Tim Vidas' work on QRishing: https://www.cylab.cmu.edu/files/pdfs/tech_reports/CMUCyLab12022.pdf https://www.cylab.cmu.edu/files/pdfs/tech_reports/CMUCyLab12...

pkstn 11y ago

I wonder would similar technique work with RFID's..?