4 ms·
It's all fun and games until 300 drones form a QR code that send unsuspecting people (the same people who would scan a QR code for fun) to a phishing link.
by julianlam 5y ago
It's all fun and games until 300 drones form a QR code that send unsuspecting people (the same people who would scan a QR code for fun) to a phishing link.
- zitterbewegung 5y agoWhy not both? In all serious you would want to do both so that people think it is just a joke still.
- walrus01 5y ago> to a goatse link
- yosito 5y agoWith the resurgence of QR codes, it's only a matter of time until someone starts printing phishing link QR code stickers and sticking them over innocent looking QR codes for restaurant menus and such.
- Breza 5y agoHow would that work? "Please enter your Gmail password to continue placing an order"?
- dylan604 5y agoOr people that are placing sticker QR codes everywhere are disabled when someone pulls off part of the alignment corners or other destructive ways to make valid QR codes unusable. Some of the local city parking lots have switched to mobile app payment systems expecting people to scan QR codes. These have been disabled by making the QR code unreadable. However, it would also be "easy enough" for people to make a payment system that looks like the legit system, and scam unsuspecting people attempting to pay for parking only to find their cars towed because it wasn't a legit payment. There are certain things where QR codes are NOT the answer.
- aendruk 5y agoIt’s been done: https://www.austintexas.gov/news/fraudulent-qr-codes-found-austin-parking-pay-stations https://www.austintexas.gov/news/fraudulent-qr-codes-found-a...
- Sebb767 5y agoThis is not a flaw of QR codes, though. If they used an URL or a phone number instead, people could replace it with a phishing one just as easily.
- dylan604 5y agoNo, it's just a flaw in people using QR codes poorly. Too many people assume the best out of other people which is nice and all in lalaland kind of way, but in the real world, people actively look to get one over on people. QR codes are just way too susceptible to being interfered with by anyone with just enough knowledge and inclination to do so. If the app payment system is the way to go (why not? not expensive onsite equipment), then it needs to be something other than a QR code that is easy to manipulate.
- yosito 5y agoThe problem is, for most people a QR code is just magic, they don't understand that it's just an encoded URL nor have any understanding of how that can be exploited.
- dylan604 5y agoIt's not just an encoded URL. It could be any data. If you encode the infamous AV test string as a QR code, you can cause some mischief for things randomly scanning for codes. There was a post here not long ago about it. So they can be way more dangerous than just a Rick-roll or spam redirect
- Nextgrid 5y agoWhy steal the money completely? I bet it would last way longer if you just skim a bit off the top but then use the rest to pay for their parking so they're not towed and don't have reasons to question anything.
- ASalazarMX 5y agoOnly a matter of time, but that time is now already. https://www.bitdefender.com/blog/hotforsecurity/us-police-parking-meters-phishing-qr-codes/ https://www.bitdefender.com/blog/hotforsecurity/us-police-pa...
- meemo 5y agoA gas station near me has stickers on pumps with a QR code that supposedly links to a rewards app. I may be wrong, but I think it says something about paying through the app. Seems perfect for phishing.
- reaperducer 5y agoIt's all fun and games until 300 drones form a QR code that send unsuspecting people (the same people who would scan a QR code for fun) to a phishing link. 2032: Elon Musk puts a giant QR code on the moon.