3 ms·

Imagine if someone discovers a flaw in the qrcode library and manage to execute an arbitrary command once read? It's already too late, the device already read t

by m-p-3 7y ago

Imagine if someone discovers a flaw in the qrcode library and manage to execute an arbitrary command once read? It's already too late, the device already read the code. It's the same kind of issue that's possible with any kind of viewer (Adobe Reader, Flash Player, etc) Once the file or data string is read, it's already game over, and both the QR code and PDF, SWF, etc aren't human-readable.

Groxx 7y ago
sure, but visiting any website or launching any app has those vulnerabilities too, except they're many times more complicated. even if it's a legit site, they could have been hacked, best to just not touch external data ever if that's your threat model.
shakna 7y ago
This has actually happened before. [0] > An exploitable code execution vulnerability exists in the QR code scanning functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted QR Code can cause a buffer overflow, resulting in code execution. [0] https://talosintelligence.com/vulnerability_reports/TALOS-2018-0571 https://talosintelligence.com/vulnerability_reports/TALOS-20...
- theamk 7y ago
  Note that it was not in the QR scanner itself -- the parsing part was fine, the image was always decoded safely. It is the network setup script which parsed the extracted text which was vulnerable. And this is not unique to QR codes -- the correct setup string looked like "b=USmtPf6GnLZYDuR9&s=PCheX14pPg==&p=AbCD123465". This already looks like gibberish to most people; if this was replaced with evil string, I am not sure user would realize that.
theamk 7y ago
Uh, no? At least in mobile OS's, the applications are isolated very strongly. And QR reader app is likely to have minimal permissions, and does not declare "backgroup daemon" one -- so even if app is entirely taken over, the worst it can do is to show scary messages and redirect you to nasty URL. The former is easily ignorable, while the latter is no worse than typing random link shortener URL you found on paper.
kazinator 7y ago
Imagine if someone discovers a flaw in any library that your web browser uses, or the browser itself or is JS engine ... oh no!

by m-p-3 7y ago

Groxx 7y ago

sure, but visiting any website or launching any app has those vulnerabilities too, except they're many times more complicated. even if it's a legit site, they could have been hacked, best to just not touch external data ever if that's your threat model.

shakna 7y ago

This has actually happened before. [0] > An exploitable code execution vulnerability exists in the QR code scanning functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted QR Code can cause a buffer overflow, resulting in code execution. [0] https://talosintelligence.com/vulnerability_reports/TALOS-2018-0571 https://talosintelligence.com/vulnerability_reports/TALOS-20...

theamk 7y ago
Note that it was not in the QR scanner itself -- the parsing part was fine, the image was always decoded safely. It is the network setup script which parsed the extracted text which was vulnerable. And this is not unique to QR codes -- the correct setup string looked like "b=USmtPf6GnLZYDuR9&s=PCheX14pPg==&p=AbCD123465". This already looks like gibberish to most people; if this was replaced with evil string, I am not sure user would realize that.

theamk 7y ago

Uh, no? At least in mobile OS's, the applications are isolated very strongly. And QR reader app is likely to have minimal permissions, and does not declare "backgroup daemon" one -- so even if app is entirely taken over, the worst it can do is to show scary messages and redirect you to nasty URL. The former is easily ignorable, while the latter is no worse than typing random link shortener URL you found on paper.

kazinator 7y ago

Imagine if someone discovers a flaw in any library that your web browser uses, or the browser itself or is JS engine ... oh no!