5 ms·

Wow, never really thought a barcode as another attack vector. I might dig a bit deeper and do my master's thesis about it. Sounds really interesting.

by crisp 11y ago

jakub_g 11y ago
Since QR codes became ubiquitous in public places, I started thinking about someone planting fake ones, on top of the original ones, that would redirect to shady websites. If the website is similar enough to the one it impersonates, it would be hard for the user to distinguish.
- crisp 11y ago
  True. It would be interesting to conduct an empirical study about this and raise people's awareness at the same time.
- roel_v 11y ago
  Does anyone ever scan a qr code? Besides, I haven't seen any for maybe 2 years now - or have I just become blind to them?
  - crisp 11y ago
    I live in Finland and I see them every now and then. I myself read them quite rarely, though. Only if it's a good offer or it benefits me some other way. Most of those codes are just for more info -type which don't really seem to interest people, including myself. The idea of QR codes are kinda okay but the implementations lack of imagination.
  - runholm 11y ago
    I can pay at my local store by scanning the QR code for the specific register. The app then let me chose to pay for the currently ongoing transaction at that register. It's neat. Besides such application specific use cases they seem dead though.
    - roel_v 11y ago
      Where is that? Never heard of that use case. Have you ever asked the merchant how many people use it?
  - Djorak_ 11y ago
    I often scan them to hire a bike in Glasgow, the mobile app uses a QR code to identify the bike and give me the lock code.
  - carlob 11y ago
    http://picturesofpeoplescanningqrcodes.tumblr.com http://picturesofpeoplescanningqrcodes.tumblr.com
    - roel_v 11y ago
      I lol at this page every time I open it, even after all those years. Call me immature, I guess...
  - patkai 11y ago
    Almost any user manual nowadays has a QR code, I also see it on magazines, even in printed ads (in Finland also). However, the UX is really bad: 1. most people don't know what they are 2. if they learn, then they have to find a QR reader app 3. reading experience: pick phone from pocket, open it, find the app, start it, scan it. Possible solution: 1. phones should have it pre-installed 2. it should be simple to snap a qr tag (e.g. without opening, e.g. with hotkey) 3. url should go to notifications queue or very easily accessible, also for integrations 4. users should be better educated, e.g. when there is a qr tag in a magazine there should be a short explanation. (https://www.quikklytags.com/#/ https://www.quikklytags.com/#/ seems very promising from this point of view) I think QR tags have huge untapped potential.
    - Already__Taken 11y ago
      Yeh your phone camera app should just do it. I spent ages going through the android store to phone an app the didn't[0] want my entire contacts list or browsing history to scan a glorified sudoku. [0]: https://play.google.com/store/apps/details?id=tw.mobileapp.qrcode.banner&hl=en_GB https://play.google.com/store/apps/details?id=tw.mobileapp.q...
      - jakub_g 11y ago
        In the same spirit, it is mindblowing that some Android phones do not even have a flashlight app (I had a flashlight in my dumbphone 8 years ago), and the same applies - most flashlight apps need exorbitant permissions; I found [0] as the only one that doesn't need anything else than, well, camera and flashlight access. I see Android as OS may not want to support it as some phones/tablets do not have physical flashlight. This would be a genuine occasion for vendors to provide something themselves which is not a bloated crapware, but not all of them do it. [0] https://play.google.com/store/apps/details?id=com.snoopwall.flashlight&hl=en https://play.google.com/store/apps/details?id=com.snoopwall....
        Already__Taken 11y ago
        I've not updated my moto gallery app because it wants new permissions to "Contacts" for god knows why. So I don't think the OEMs would do it properly anyway. Street view update now wants identity, photos/files, camera and wifi info. On top of location of which as least made sense.
  - wingerlang 11y ago
    Commonplace in Asia. Especially for IM apps to add friends etc.
- cstuder 11y ago
  There were reported instances of fake QR codes on political posters in Germany and Switzerland back in 2012. Somebody put a sticker on top of the original code and forwarded the people scanning it to porn websites. (I'm actually surprised somebody discovered the manipulation.)
- geographomics 11y ago
  It's happened with Bitcoin QR codes, to redirect payment to the attacker's wallet: https://www.reddit.com/r/Bitcoin/comments/1wwzbf/psa_new_scam_to_be_aware_of_someone_stole_my/ https://www.reddit.com/r/Bitcoin/comments/1wwzbf/psa_new_sca...

Wow, never really thought a barcode as another attack vector. I might dig a bit deeper and do my master's thesis about it. Sounds really interesting.

by crisp 11y ago

Wow, never really thought a barcode as another attack vector. I might dig a bit deeper and do my master's thesis about it. Sounds really interesting.

jakub_g 11y ago

Since QR codes became ubiquitous in public places, I started thinking about someone planting fake ones, on top of the original ones, that would redirect to shady websites. If the website is similar enough to the one it impersonates, it would be hard for the user to distinguish.

crisp 11y ago
True. It would be interesting to conduct an empirical study about this and raise people's awareness at the same time.
roel_v 11y ago
Does anyone ever scan a qr code? Besides, I haven't seen any for maybe 2 years now - or have I just become blind to them?
- crisp 11y ago
  I live in Finland and I see them every now and then. I myself read them quite rarely, though. Only if it's a good offer or it benefits me some other way. Most of those codes are just for more info -type which don't really seem to interest people, including myself. The idea of QR codes are kinda okay but the implementations lack of imagination.
- runholm 11y ago
  I can pay at my local store by scanning the QR code for the specific register. The app then let me chose to pay for the currently ongoing transaction at that register. It's neat. Besides such application specific use cases they seem dead though.
  - roel_v 11y ago
    Where is that? Never heard of that use case. Have you ever asked the merchant how many people use it?
- Djorak_ 11y ago
  I often scan them to hire a bike in Glasgow, the mobile app uses a QR code to identify the bike and give me the lock code.
- carlob 11y ago
  http://picturesofpeoplescanningqrcodes.tumblr.com http://picturesofpeoplescanningqrcodes.tumblr.com
  - roel_v 11y ago
    I lol at this page every time I open it, even after all those years. Call me immature, I guess...
- patkai 11y ago
  Almost any user manual nowadays has a QR code, I also see it on magazines, even in printed ads (in Finland also). However, the UX is really bad: 1. most people don't know what they are 2. if they learn, then they have to find a QR reader app 3. reading experience: pick phone from pocket, open it, find the app, start it, scan it. Possible solution: 1. phones should have it pre-installed 2. it should be simple to snap a qr tag (e.g. without opening, e.g. with hotkey) 3. url should go to notifications queue or very easily accessible, also for integrations 4. users should be better educated, e.g. when there is a qr tag in a magazine there should be a short explanation. (https://www.quikklytags.com/#/ https://www.quikklytags.com/#/ seems very promising from this point of view) I think QR tags have huge untapped potential.
  - Already__Taken 11y ago
    Yeh your phone camera app should just do it. I spent ages going through the android store to phone an app the didn't[0] want my entire contacts list or browsing history to scan a glorified sudoku. [0]: https://play.google.com/store/apps/details?id=tw.mobileapp.qrcode.banner&hl=en_GB https://play.google.com/store/apps/details?id=tw.mobileapp.q...
    - jakub_g 11y ago
      In the same spirit, it is mindblowing that some Android phones do not even have a flashlight app (I had a flashlight in my dumbphone 8 years ago), and the same applies - most flashlight apps need exorbitant permissions; I found [0] as the only one that doesn't need anything else than, well, camera and flashlight access. I see Android as OS may not want to support it as some phones/tablets do not have physical flashlight. This would be a genuine occasion for vendors to provide something themselves which is not a bloated crapware, but not all of them do it. [0] https://play.google.com/store/apps/details?id=com.snoopwall.flashlight&hl=en https://play.google.com/store/apps/details?id=com.snoopwall....
      - Already__Taken 11y ago
        I've not updated my moto gallery app because it wants new permissions to "Contacts" for god knows why. So I don't think the OEMs would do it properly anyway. Street view update now wants identity, photos/files, camera and wifi info. On top of location of which as least made sense.
- wingerlang 11y ago
  Commonplace in Asia. Especially for IM apps to add friends etc.
cstuder 11y ago
There were reported instances of fake QR codes on political posters in Germany and Switzerland back in 2012. Somebody put a sticker on top of the original code and forwarded the people scanning it to porn websites. (I'm actually surprised somebody discovered the manipulation.)
geographomics 11y ago
It's happened with Bitcoin QR codes, to redirect payment to the attacker's wallet: https://www.reddit.com/r/Bitcoin/comments/1wwzbf/psa_new_scam_to_be_aware_of_someone_stole_my/ https://www.reddit.com/r/Bitcoin/comments/1wwzbf/psa_new_sca...