4 ms·

It could be an AV engine doing it. Some phishing attacks have switched to using QR codes instead of links as an evasion technique in the last couple of years,

by 13of40 4y ago

It could be an AV engine doing it. Some phishing attacks have switched to using QR codes instead of links as an evasion technique in the last couple of years, so the anti-evasion to that is decode it and browse the link to see if it's malicious.

kennywinker 4y ago
“This link might be dangerous - better click on it!” I’d suspect it’s indexing for search rather than a security protocol - i feel like anybody security minded would have approached this differently
- Filligree 4y ago
  Antivirus software isn’t known for being security-minded. Running potential malware in a buggy kernel-space sandbox comes to mind.
  - fmajid 4y ago
    Antivirus software is so sloppily written it actually increases your attack surface, often catastrophically so: https://www.theregister.com/2016/05/17/tavis_ormandy_zeroes_in_on_antivirus_remotecrash_bug https://www.theregister.com/2016/05/17/tavis_ormandy_zeroes_... https://www.computerworld.com/article/2493275/researcher-finds-critical-vulnerabilities-in-sophos-antivirus-product.html https://www.computerworld.com/article/2493275/researcher-fin...
- Analemma_ 4y ago
  If you've ever seen Tavis Ormandy and P0's analysis of AV software, you know this isn't actually far-fetched. A lot of these products have horrifying vulnerabilities.
- bombcar 4y ago
  I hate AV scanners, they consume one-time URLs in many cases (Salesforce password resets just don't work for me).
- xattt 4y ago
  > I’d suspect it’s indexing for search rather than a security protocol - i feel like anybody security minded would have approached this differently So it’s exploding the QR to see where the link goes?
- jabroni_salad 4y ago
  running it and seeing what it does is the most practical way of identifying malware these days. Heuristics are too easy to stay ahead of.
- matai_kolila 4y ago
  The language used throughout this thread is terrible; "better click on it" you think an AV is literally loading up a full browser and forcing it to navigate to a random link it finds in a QR code on an image? Even the title uses the word "executed" as if a QR code is "runnable" in some way; it's not. QR code related hacks are not some magical "scan this image and get pwnd", they're related to browser exploits and other methods of forcing code execution by way of the browser. To my knowledge there have never been any "offline" QR code hacks, where simply scanning the QR code itself has ever lead to an exploit. AV is generally dumb, but simply converting a QR code itself is harmless.
  - kennywinker 4y ago
    No, I don't think it's loading up a full browser - I think it's sending an HTTP request and then parsing the results to some degree. To whatever extent the HTTP request mechanism is secure, and the parsing mechanism is secure, it's secure. But you don't need a browser to have security holes - anything parsing random data from the internet could be a vector. That said, I agree - parsing the QR code itself isn't really a vector I'd worry much about.

by 13of40 4y ago

kennywinker 4y ago

“This link might be dangerous - better click on it!” I’d suspect it’s indexing for search rather than a security protocol - i feel like anybody security minded would have approached this differently

Filligree 4y ago
Antivirus software isn’t known for being security-minded. Running potential malware in a buggy kernel-space sandbox comes to mind.
- fmajid 4y ago
  Antivirus software is so sloppily written it actually increases your attack surface, often catastrophically so: https://www.theregister.com/2016/05/17/tavis_ormandy_zeroes_in_on_antivirus_remotecrash_bug https://www.theregister.com/2016/05/17/tavis_ormandy_zeroes_... https://www.computerworld.com/article/2493275/researcher-finds-critical-vulnerabilities-in-sophos-antivirus-product.html https://www.computerworld.com/article/2493275/researcher-fin...
Analemma_ 4y ago
If you've ever seen Tavis Ormandy and P0's analysis of AV software, you know this isn't actually far-fetched. A lot of these products have horrifying vulnerabilities.
bombcar 4y ago
I hate AV scanners, they consume one-time URLs in many cases (Salesforce password resets just don't work for me).
xattt 4y ago
> I’d suspect it’s indexing for search rather than a security protocol - i feel like anybody security minded would have approached this differently So it’s exploding the QR to see where the link goes?
jabroni_salad 4y ago
running it and seeing what it does is the most practical way of identifying malware these days. Heuristics are too easy to stay ahead of.
matai_kolila 4y ago
The language used throughout this thread is terrible; "better click on it" you think an AV is literally loading up a full browser and forcing it to navigate to a random link it finds in a QR code on an image? Even the title uses the word "executed" as if a QR code is "runnable" in some way; it's not. QR code related hacks are not some magical "scan this image and get pwnd", they're related to browser exploits and other methods of forcing code execution by way of the browser. To my knowledge there have never been any "offline" QR code hacks, where simply scanning the QR code itself has ever lead to an exploit. AV is generally dumb, but simply converting a QR code itself is harmless.
- kennywinker 4y ago
  No, I don't think it's loading up a full browser - I think it's sending an HTTP request and then parsing the results to some degree. To whatever extent the HTTP request mechanism is secure, and the parsing mechanism is secure, it's secure. But you don't need a browser to have security holes - anything parsing random data from the internet could be a vector. That said, I agree - parsing the QR code itself isn't really a vector I'd worry much about.