5 ms·

Major U.S. energy org targeted in QR code phishing attack

44 points by mikece 3y ago

stackedinserter 3y ago
QR codes shouldn't exist in 2023, change my mind. We can recognize plants, animals and lanmarks using our phones, why can't we just read URLs with our cameras?
- toomuchtodo 3y ago
  Politely disagree. They are a durable machine readable means to communicate data. I would argue that when a QR code is read, more tech controls need to be in place to protect users prior to where they're navigating to (show full unrolled URL, big confirm button, check URLs against malware/malicious URL databases). Humans already don't check URLs carefully (email phishing and the efforts to encourage better behavior and awareness around that), they use QR codes because they are easy vs typing in the URL. If the camera read a URL with high confidence, people would still not check it. Humans are always the weakest link. Do more to protect the human.
  - stackedinserter 3y ago
    In that sense human-readable link is more secure that a QR code, because you can at least read that it's "td.com" and not "xxx.win-lottery-get-pussy.tu". There's a chance that people won't even point their cameras at URLs like this. Scroll this page down, someone said they scan every code just out of curiosity.
- mistrial9 3y ago
  qualified agree -- marketers and worse are abusing the naturally-opaque entrance.. harken back to the days of certain bars being a supply of enslaved crew members via blackjack
- Sayrus 3y ago
  QR Codes bring a more machine readable format and error correction. QRCode is partially scratched? It can still work. How often will a camera mistake a l and I? Even for scanned books, OCRs make mistakes.
- solardev 3y ago
  Error correction. Abrading one character in a URL will break it (or make it subject to a MITM attack via lookalike domains or whatever). QR codes are insanely durable and redundant and can survive a lot of wear and tear. It's also a binary works or doesn't, as opposed to a OCR algorithm with probabilistic correctness. And UX. People know what to do about a square barcode (thanks to covid). Nobody is gonna know to take a picture of a URL (they can in fact already do that and have it OCRed on many phones, but who knew?)
- mzs 3y ago
  q & g constantly get confused by Apple's image to text
falsenapkin 3y ago
Maybe this is common outside of where I live and I'm blissfully unaware, but I went on a work trip recently and was surprised/disturbed by how every lunch/dinner spot was QR code menus. Multiple of these links went through a marketing platform redirect and the only reason this was obvious to me was the preview dialog on the iPhone camera showed a different domain than the page I landed on. I read the privacy policy for one of these platforms and it was not great. It's already hard enough to get people to understand how URLs work, QR codes really don't help. Certainly it's in the best interest of corporations to scan codes in emails for security purposes, but I think it's on QR code reader producers (e.g. Apple via iOS camera) to make the concept safer somehow. I'd also really like to see well meaning people, like restaurants, create codes that do not use redirects or any other trickery and to have the link written out for the rightfully paranoid. And paper menus would be cool too...
- rlpb 3y ago
  The reason for the redirect is probably so that they can change the URL without reprinting the menus. For example, if a small business changes who they get to do their online ordering system, sometimes that involves a URL change because coordinating the transfer of control of domain registration, DNS (and consequently sometimes email) and website hosting, and preserving the old URLs (or even just the entry point) on the new system is too difficult. I don't think the lack of redirects would really resolve anything either. You either trust that the QR code you're scanning was really generated by the organisation you think it was, or you don't. If you trust them then you can also trust their redirects.
  - psychphysic 3y ago
    Then they can redirect via their own domain... Why I troduce a third party?
    - solardev 3y ago
      I think you overestimate the tech savvy of your average restaurant
    - 3y ago
tizz98 3y ago
I've started thinking about a verifiable format for QR codes. https://blog.xqr.dev/introducing-xqrs-the-next-evolution-in-secure-qr-codes https://blog.xqr.dev/introducing-xqrs-the-next-evolution-in-... I've written a library in Rust to handle this as well as a CLI example: https://github.com/xqr-dev/xqr-rs https://github.com/xqr-dev/xqr-rs It's still early stages, so feedback would be helpful!
- varenc 3y ago
  How do you handle redirects? Like if a popular QR code generator and redirector hosting service supported this and signed my QR code, couldn’t I just change the redirect but the original target URL is still valid? You could try to detect redirects but that could be tricky once JS is involved.
reaperducer 3y ago
People have been pasting bogus QR codes on the parking meters where I live. They go to web sites that collect your credit card information, then forward you to the real web site. Someone put up fake "Pay to park" signs with QR codes on them in the parking garage of the hotel across the street. The hotel has no pay-to-park mechanism. You give the hotel your license plate number when you check in and the fee is added to your bill. Public trust of QR codes is such a massive security flaw.
- palmer_fox 3y ago
  The only surprising part in your story is that QR code scamming is somehow not a massive industry by now. Any charge and data collection could be easily hijacked. Entering Louvre? Scan this QR code real quick for a ticket. Waiting in line in a USCIS office? Scan this QR code and pre-register with ALL your personal details.
- dannyphantom 3y ago
  Ah! Yeah - this happened at my college. They sold the [huge] parking lot adjacent to the main union area to the company that owns all the lots in the city since it was so torn up and [assuming] didn't want to pay to fix it. Before it was sold, you just bought a little placard that hung from your rear-view mirror to park in the lot. Well - the company it was sold do has been doing the QR thing for years at this point so they just implemented it after a quick repaving and that was that. It's been a few people at this point who simply make a clone of the parking website and slap their own QR code stickers on a bunch of the spots. If you saw a ticket on the windshield upon returning to the car, most people assume they made a mistake so they are double paying for the spot. Once to a phisher and once to the actual company in the form of a ticket. Company has sent out a ton of emails about it but because the lot is so high-volume [it's next to a new stadium so it's no longer just business hours college parking] the ability to make a quick buck so easily is just...there. No changes being made by the company - you'll see a thread pop up on the city subreddit about it every now and then where others share their own experiences - and that's as far as it goes.

44 points by mikece 3y ago

QR codes shouldn't exist in 2023, change my mind. We can recognize plants, animals and lanmarks using our phones, why can't we just read URLs with our cameras?

toomuchtodo 3y ago
Politely disagree. They are a durable machine readable means to communicate data. I would argue that when a QR code is read, more tech controls need to be in place to protect users prior to where they're navigating to (show full unrolled URL, big confirm button, check URLs against malware/malicious URL databases). Humans already don't check URLs carefully (email phishing and the efforts to encourage better behavior and awareness around that), they use QR codes because they are easy vs typing in the URL. If the camera read a URL with high confidence, people would still not check it. Humans are always the weakest link. Do more to protect the human.
- stackedinserter 3y ago
  In that sense human-readable link is more secure that a QR code, because you can at least read that it's "td.com" and not "xxx.win-lottery-get-pussy.tu". There's a chance that people won't even point their cameras at URLs like this. Scroll this page down, someone said they scan every code just out of curiosity.
mistrial9 3y ago
qualified agree -- marketers and worse are abusing the naturally-opaque entrance.. harken back to the days of certain bars being a supply of enslaved crew members via blackjack
Sayrus 3y ago
QR Codes bring a more machine readable format and error correction. QRCode is partially scratched? It can still work. How often will a camera mistake a l and I? Even for scanned books, OCRs make mistakes.
solardev 3y ago
Error correction. Abrading one character in a URL will break it (or make it subject to a MITM attack via lookalike domains or whatever). QR codes are insanely durable and redundant and can survive a lot of wear and tear. It's also a binary works or doesn't, as opposed to a OCR algorithm with probabilistic correctness. And UX. People know what to do about a square barcode (thanks to covid). Nobody is gonna know to take a picture of a URL (they can in fact already do that and have it OCRed on many phones, but who knew?)
mzs 3y ago
q & g constantly get confused by Apple's image to text

falsenapkin 3y ago

Maybe this is common outside of where I live and I'm blissfully unaware, but I went on a work trip recently and was surprised/disturbed by how every lunch/dinner spot was QR code menus. Multiple of these links went through a marketing platform redirect and the only reason this was obvious to me was the preview dialog on the iPhone camera showed a different domain than the page I landed on. I read the privacy policy for one of these platforms and it was not great. It's already hard enough to get people to understand how URLs work, QR codes really don't help. Certainly it's in the best interest of corporations to scan codes in emails for security purposes, but I think it's on QR code reader producers (e.g. Apple via iOS camera) to make the concept safer somehow. I'd also really like to see well meaning people, like restaurants, create codes that do not use redirects or any other trickery and to have the link written out for the rightfully paranoid. And paper menus would be cool too...

rlpb 3y ago
The reason for the redirect is probably so that they can change the URL without reprinting the menus. For example, if a small business changes who they get to do their online ordering system, sometimes that involves a URL change because coordinating the transfer of control of domain registration, DNS (and consequently sometimes email) and website hosting, and preserving the old URLs (or even just the entry point) on the new system is too difficult. I don't think the lack of redirects would really resolve anything either. You either trust that the QR code you're scanning was really generated by the organisation you think it was, or you don't. If you trust them then you can also trust their redirects.
- psychphysic 3y ago
  Then they can redirect via their own domain... Why I troduce a third party?
  - solardev 3y ago
    I think you overestimate the tech savvy of your average restaurant
  - 3y ago

tizz98 3y ago

I've started thinking about a verifiable format for QR codes. https://blog.xqr.dev/introducing-xqrs-the-next-evolution-in-secure-qr-codes https://blog.xqr.dev/introducing-xqrs-the-next-evolution-in-... I've written a library in Rust to handle this as well as a CLI example: https://github.com/xqr-dev/xqr-rs https://github.com/xqr-dev/xqr-rs It's still early stages, so feedback would be helpful!

varenc 3y ago
How do you handle redirects? Like if a popular QR code generator and redirector hosting service supported this and signed my QR code, couldn’t I just change the redirect but the original target URL is still valid? You could try to detect redirects but that could be tricky once JS is involved.

reaperducer 3y ago

People have been pasting bogus QR codes on the parking meters where I live. They go to web sites that collect your credit card information, then forward you to the real web site. Someone put up fake "Pay to park" signs with QR codes on them in the parking garage of the hotel across the street. The hotel has no pay-to-park mechanism. You give the hotel your license plate number when you check in and the fee is added to your bill. Public trust of QR codes is such a massive security flaw.

palmer_fox 3y ago
The only surprising part in your story is that QR code scamming is somehow not a massive industry by now. Any charge and data collection could be easily hijacked. Entering Louvre? Scan this QR code real quick for a ticket. Waiting in line in a USCIS office? Scan this QR code and pre-register with ALL your personal details.
dannyphantom 3y ago
Ah! Yeah - this happened at my college. They sold the [huge] parking lot adjacent to the main union area to the company that owns all the lots in the city since it was so torn up and [assuming] didn't want to pay to fix it. Before it was sold, you just bought a little placard that hung from your rear-view mirror to park in the lot. Well - the company it was sold do has been doing the QR thing for years at this point so they just implemented it after a quick repaving and that was that. It's been a few people at this point who simply make a clone of the parking website and slap their own QR code stickers on a bunch of the spots. If you saw a ticket on the windshield upon returning to the car, most people assume they made a mistake so they are double paying for the spot. Once to a phisher and once to the actual company in the form of a ticket. Company has sent out a ton of emails about it but because the lot is so high-volume [it's next to a new stadium so it's no longer just business hours college parking] the ability to make a quick buck so easily is just...there. No changes being made by the company - you'll see a thread pop up on the city subreddit about it every now and then where others share their own experiences - and that's as far as it goes.