7 ms·

My QR reader on Android (ZXing's Barcode Reader) shows you the information on the screen before you decide what you want to do with it. That's as "Human Readab

My QR reader on Android (ZXing's Barcode Reader) shows you the information on the screen before you decide what you want to do with it. That's as "Human Readable" as it needs to be, for me.

TeMPOraL 7y ago
It's only helpful if you know what to expect. A side effect of adtech and surveillance mania infecting everything, URLs in QR codes are likely to be either semirandom strings with tracking IDs, or links to URL shorteners that expand to such semirandom strings with tracking IDs. Either is very trivial to spoof with a similar-looking malicious URL.
- jakub_g 7y ago
  It's the same with or without the QR code. Say you're on the bus stop and want to check upcoming buses (real stuff in the place where I live). The bus company could either slap a QR code, or a "bit.ly/bus-stop-1234" URL. And someone could paste over it a "evil.com/bus-stop-1234". Hint: use Firefox Focus as your default handler for URLs on mobile phone. It clears all history and cookies after each usage, which is perfect for opening unknown URLs.
  - jschwartzi 7y ago
    I'm looking forward to 20 years from now when all QR codes have to be digitally signed to be valid, and the digital signature must be authorized by a certificate authority in your phone.
    - zulln 7y ago
      And what would the benefit be from that? That is how HTTPS works today, and does not protect you against phishing at all.
      - jandrese 7y ago
        Maybe if the QR reader gave you the CN and domain of the certificate so you at least knew who signed it. You scan your bust stop and it says "Verified Signed by City, County Bus service" instead of "anonymous asshole". Not perfect, but it at least gives the users a chance unlike the blind redirect situation we have now.
        dwiel 7y ago
        Signed by "Mobile Transportation Services inc."
        Normal_gaussian 7y ago
        Having just navigated through a bunch of forms on my councils website I can verify that the following people are all on certificates at different points: * a freelance web dev * two design agencies * nobody (plain lets encryot) * a payments middle man company (stylised like "EZ pay") * the council themselves (on the confirmation pages...) So I would hazard a guess that "Mobile Transportation Services inc." ie a little too sensible to be trustworthy...
        oxygenoxy 7y ago
        Then you'll get "Verified Signed by Citÿ, County Bus service"
        theamk 7y ago
        This sounds just like EV certificates, and they have not been shown to work very well. (There have been many articles explaining why, here is one: https://www.troyhunt.com/extended-validation-certificates-are-dead/ https://www.troyhunt.com/extended-validation-certificates-ar... )
        big_chungus 7y ago
        "Vеrifiеd Signеd Ву Citу, сountу Вus sеrviсе" Paste that string into google, and tell me if you get the results you expect. You'll get a lot of Russian. Think people might go for that? There was an attack a while back where bad guys registered "adoḅe.com" and distributed malware. EV doesn't work.
    - theamk 7y ago
      I don't. I like to be able to transfer data from my PC to my phone via QR codes; print out QR codes pointing to the latest photo album and and give them to friends; finding QR links on "garage sale" signs (real thing that happened today). Requiring signatures will likely kill those applications.
      - wh0knows 7y ago
        It's incorrect to assume that the existence of signature validation would kill this use-case. Similar to how the existence of HTTPS does not kill the ability to transmit data over HTTP and visit sites with no certificate or a non-trusted certificate. It could be as simple as a pop-up saying, "this QR code is not validated, continue anyway"?
- pmoriarty 7y ago
  I've also heard of QR-reader software being exploitable through QR codes that they're supposed to read. So any time I see a QR code, I hesitate to point a reader app at it because I'm concerned that my phone could get hacked through it.
  - jandrese 7y ago
    It would be really hard for a QR app to take over your phone, even if it is poorly written and gets owned. There are layers of protection below the aps on an OS like iOS. I'm not saying it's absolutely impossible, but if someone figured it out they could sell the technique for literally millions of dollars to a huge assortment of potential buyers. They probably aren't going to waste it on you.
    - pmoriarty 7y ago
      My phone is a rooted Android phone, though.
      - somehnguy 7y ago
        You already gave up your security then sooo
      - Dylan16807 7y ago
        Then don't give the QR app root.
  - 0b0001 7y ago
    That's the case for any software that accepts any kind of input. Your browser, your PDF viewer, your messenger are just more popular, but not fundamentally different from a QR reader application.
  - kazinator 7y ago
    Years ago, WinAmp on Windows was exploitable through a maliciously prepared .m3u playlist: a simple plain text file expected to be filled with pathnames of songs, one per line. If you're so scared, don't browse anything with your mobile device; browsers are exploitable through pages they land on.
- kazinator 7y ago
  I don't see how it can be made less dangerous. The QR code is read and decoded to a URL. The QR code is now gone, and it is the URL that is dangrous. The URL is dangerous no matter how you got it. On mobile devices, you can't hover the mouse pointer over a link to see where you're going. That's subtantially more dangerous than a URL reader which shows you the URL.
Jemm 7y ago
I think the app is Barcode Scanner, Not Barcode Reader.
- wccrawford 7y ago
  You're right. The dumbest part is that I actually went to my phone to find the company name and still thought it said "Reader" for the app name. Thanks!
m-p-3 7y ago
Imagine if someone discovers a flaw in the qrcode library and manage to execute an arbitrary command once read? It's already too late, the device already read the code. It's the same kind of issue that's possible with any kind of viewer (Adobe Reader, Flash Player, etc) Once the file or data string is read, it's already game over, and both the QR code and PDF, SWF, etc aren't human-readable.
- Groxx 7y ago
  sure, but visiting any website or launching any app has those vulnerabilities too, except they're many times more complicated. even if it's a legit site, they could have been hacked, best to just not touch external data ever if that's your threat model.
- shakna 7y ago
  This has actually happened before. [0] > An exploitable code execution vulnerability exists in the QR code scanning functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted QR Code can cause a buffer overflow, resulting in code execution. [0] https://talosintelligence.com/vulnerability_reports/TALOS-2018-0571 https://talosintelligence.com/vulnerability_reports/TALOS-20...
  - theamk 7y ago
    Note that it was not in the QR scanner itself -- the parsing part was fine, the image was always decoded safely. It is the network setup script which parsed the extracted text which was vulnerable. And this is not unique to QR codes -- the correct setup string looked like "b=USmtPf6GnLZYDuR9&s=PCheX14pPg==&p=AbCD123465". This already looks like gibberish to most people; if this was replaced with evil string, I am not sure user would realize that.
- theamk 7y ago
  Uh, no? At least in mobile OS's, the applications are isolated very strongly. And QR reader app is likely to have minimal permissions, and does not declare "backgroup daemon" one -- so even if app is entirely taken over, the worst it can do is to show scary messages and redirect you to nasty URL. The former is easily ignorable, while the latter is no worse than typing random link shortener URL you found on paper.

My QR reader on Android (ZXing's Barcode Reader) shows you the information on the screen before you decide what you want to do with it. That's as "Human Readable" as it needs to be, for me.

TeMPOraL 7y ago

It's only helpful if you know what to expect. A side effect of adtech and surveillance mania infecting everything, URLs in QR codes are likely to be either semirandom strings with tracking IDs, or links to URL shorteners that expand to such semirandom strings with tracking IDs. Either is very trivial to spoof with a similar-looking malicious URL.

jakub_g 7y ago
It's the same with or without the QR code. Say you're on the bus stop and want to check upcoming buses (real stuff in the place where I live). The bus company could either slap a QR code, or a "bit.ly/bus-stop-1234" URL. And someone could paste over it a "evil.com/bus-stop-1234". Hint: use Firefox Focus as your default handler for URLs on mobile phone. It clears all history and cookies after each usage, which is perfect for opening unknown URLs.
- jschwartzi 7y ago
  I'm looking forward to 20 years from now when all QR codes have to be digitally signed to be valid, and the digital signature must be authorized by a certificate authority in your phone.
  - zulln 7y ago
    And what would the benefit be from that? That is how HTTPS works today, and does not protect you against phishing at all.
    - jandrese 7y ago
      Maybe if the QR reader gave you the CN and domain of the certificate so you at least knew who signed it. You scan your bust stop and it says "Verified Signed by City, County Bus service" instead of "anonymous asshole". Not perfect, but it at least gives the users a chance unlike the blind redirect situation we have now.
      - dwiel 7y ago
        Signed by "Mobile Transportation Services inc."
        Normal_gaussian 7y ago
        Having just navigated through a bunch of forms on my councils website I can verify that the following people are all on certificates at different points: * a freelance web dev * two design agencies * nobody (plain lets encryot) * a payments middle man company (stylised like "EZ pay") * the council themselves (on the confirmation pages...) So I would hazard a guess that "Mobile Transportation Services inc." ie a little too sensible to be trustworthy...
      - oxygenoxy 7y ago
        Then you'll get "Verified Signed by Citÿ, County Bus service"
      - theamk 7y ago
        This sounds just like EV certificates, and they have not been shown to work very well. (There have been many articles explaining why, here is one: https://www.troyhunt.com/extended-validation-certificates-are-dead/ https://www.troyhunt.com/extended-validation-certificates-ar... )
      - big_chungus 7y ago
        "Vеrifiеd Signеd Ву Citу, сountу Вus sеrviсе" Paste that string into google, and tell me if you get the results you expect. You'll get a lot of Russian. Think people might go for that? There was an attack a while back where bad guys registered "adoḅe.com" and distributed malware. EV doesn't work.
  - theamk 7y ago
    I don't. I like to be able to transfer data from my PC to my phone via QR codes; print out QR codes pointing to the latest photo album and and give them to friends; finding QR links on "garage sale" signs (real thing that happened today). Requiring signatures will likely kill those applications.
    - wh0knows 7y ago
      It's incorrect to assume that the existence of signature validation would kill this use-case. Similar to how the existence of HTTPS does not kill the ability to transmit data over HTTP and visit sites with no certificate or a non-trusted certificate. It could be as simple as a pop-up saying, "this QR code is not validated, continue anyway"?
pmoriarty 7y ago
I've also heard of QR-reader software being exploitable through QR codes that they're supposed to read. So any time I see a QR code, I hesitate to point a reader app at it because I'm concerned that my phone could get hacked through it.
- jandrese 7y ago
  It would be really hard for a QR app to take over your phone, even if it is poorly written and gets owned. There are layers of protection below the aps on an OS like iOS. I'm not saying it's absolutely impossible, but if someone figured it out they could sell the technique for literally millions of dollars to a huge assortment of potential buyers. They probably aren't going to waste it on you.
  - pmoriarty 7y ago
    My phone is a rooted Android phone, though.
    - somehnguy 7y ago
      You already gave up your security then sooo
    - Dylan16807 7y ago
      Then don't give the QR app root.
- 0b0001 7y ago
  That's the case for any software that accepts any kind of input. Your browser, your PDF viewer, your messenger are just more popular, but not fundamentally different from a QR reader application.
- kazinator 7y ago
  Years ago, WinAmp on Windows was exploitable through a maliciously prepared .m3u playlist: a simple plain text file expected to be filled with pathnames of songs, one per line. If you're so scared, don't browse anything with your mobile device; browsers are exploitable through pages they land on.
kazinator 7y ago
I don't see how it can be made less dangerous. The QR code is read and decoded to a URL. The QR code is now gone, and it is the URL that is dangrous. The URL is dangerous no matter how you got it. On mobile devices, you can't hover the mouse pointer over a link to see where you're going. That's subtantially more dangerous than a URL reader which shows you the URL.

Jemm 7y ago

I think the app is Barcode Scanner, Not Barcode Reader.

wccrawford 7y ago
You're right. The dumbest part is that I actually went to my phone to find the company name and still thought it said "Reader" for the app name. Thanks!

m-p-3 7y ago

Imagine if someone discovers a flaw in the qrcode library and manage to execute an arbitrary command once read? It's already too late, the device already read the code. It's the same kind of issue that's possible with any kind of viewer (Adobe Reader, Flash Player, etc) Once the file or data string is read, it's already game over, and both the QR code and PDF, SWF, etc aren't human-readable.

Groxx 7y ago
sure, but visiting any website or launching any app has those vulnerabilities too, except they're many times more complicated. even if it's a legit site, they could have been hacked, best to just not touch external data ever if that's your threat model.
shakna 7y ago
This has actually happened before. [0] > An exploitable code execution vulnerability exists in the QR code scanning functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted QR Code can cause a buffer overflow, resulting in code execution. [0] https://talosintelligence.com/vulnerability_reports/TALOS-2018-0571 https://talosintelligence.com/vulnerability_reports/TALOS-20...
- theamk 7y ago
  Note that it was not in the QR scanner itself -- the parsing part was fine, the image was always decoded safely. It is the network setup script which parsed the extracted text which was vulnerable. And this is not unique to QR codes -- the correct setup string looked like "b=USmtPf6GnLZYDuR9&s=PCheX14pPg==&p=AbCD123465". This already looks like gibberish to most people; if this was replaced with evil string, I am not sure user would realize that.
theamk 7y ago
Uh, no? At least in mobile OS's, the applications are isolated very strongly. And QR reader app is likely to have minimal permissions, and does not declare "backgroup daemon" one -- so even if app is entirely taken over, the worst it can do is to show scary messages and redirect you to nasty URL. The former is easily ignorable, while the latter is no worse than typing random link shortener URL you found on paper.