6 ms·

That square QR barcode on the poster? Check it's not a sticker

38 points by tankenmate 14y ago

nicholassmith 14y ago
I was chatting to a friend recently about how if QR Codes had taken off a bit more than they have (in terms of general population penetration, so your 50 year old parents would know what they are), that they'd become a pretty decent way to use for miscellaneous hijinks/spamming/attack vectors. Especially when that Samsung Android bug was discovered that could trigger the reset code, that in the wild would have been something crazy.
jeffehobbs 14y ago
Spam is a best case scenario -- unexpected porn would be a more eye-searing experience. I remember this trick from the good ol' days of Slashdot.
- meaty 14y ago
  Yes in London we've had Goatse QR codes deployed, much to the amusement of the deployer I imagine :)
froo 14y ago
Guerilla Marketing possibility by hijacking other people's ads?
- jiggy2011 14y ago
  Maybe, but a company doing this could probably look forward to some strongly worded letters from the lawyers of the company who bought the poster space.
edent 14y ago
I wrote about this a year ago http://shkspr.mobi/blog/2011/12/how-to-prevent-qr-hijacking/ http://shkspr.mobi/blog/2011/12/how-to-prevent-qr-hijacking/ It's already happening - on a small scale. QR codes are really popular in the UK, but I've only seen this sort of "sticker attack" once.
- anu_gupta 14y ago
  > QR codes are really popular in the UK, I don't think that's accurate, at least for values of "really popular" that I understand.
indiecore 14y ago
Good argument for customizing your QR code a little bit. Likely anyone who's going to do this will just print off a big pile of black and white perfect squares. If you design your media so that looks weird to people that's a single passive thing that will help protect your customers.
ohwp 14y ago
Another thing is that most apps show the Unicode URL: * User confirms he likes to open the url https://www.gооgle.cоm ('о' != 'o') * https://www.xn--ggle-55da.xn--cm-fmc/ is opened
- andrewaylett 14y ago
  Did you check xn--ggle-55da.com? Google's already registered it :). Some TLDs have restrictions on which IDNs can be registered, specifically to avoid this kind of spoofing...
  - tankenmate 14y ago
    And in fact all new gTLDs will be required to have a policy to limit this kind of thing.
franze 14y ago
well, it seems a very un-economic strategy, because you need to invest in a) physical items (paper, glue) b) human workforce c) transportation (you need to get around town) and also I) nobody uses QR codes see http://www.google.com/trends/explore#q=qr%20code%2C%20qr%2C%20&cmpt=q and http://www.google.com/trends/explore#q=qr%20code%2C%20qr%2C%20mail&cmpt=q i run a quite popular create and read QR code website http://miniqr.com http://miniqr.com, and well let's say i won't get rich (for this sideproject) mail spam works because it's cheap to distribute, physical QR-codes - not so much.
- konstruktor 14y ago
  On the other hand, targeting can be very precise using this technique. Think bank advertisements.
- Cogito 14y ago
  nobody uses QR codes http://picturesofpeoplescanningqrcodes.tumblr.com/ http://picturesofpeoplescanningqrcodes.tumblr.com/ (this has been posted on other QR code threads before, but is always relevant)
  - Spoygg 14y ago
    Hahahaha :) Did not come about this one until now :)
  - franze 14y ago
    if you really want to see people scanning QR codes, there is a website for that http://replycam.com/browse.php http://replycam.com/browse.php has a few thousand or more qr codes (http://miniqr.com/reader http://miniqr.com/reader reused the http://replycam.com http://replycam.com flash webcam), should count them sometime.
  - apathetic 14y ago
    it's empty. Did they mean it to be this way?
    - 14y ago
nwh 14y ago
I actually did do this once to a particular area of advertising. I took the time to make unique codes for each one replaced, and routed the requests past my own server to record each hit. The idea was simply to find out how much they get used, as a lot of clients seem to insist on having them as the only call to action on their advertising. In the end there were about 20 proxied URL on an extremely high traffic footpath.Either people noticed the edges of the sticker (unlikely), or absolutely nobody in my area wanted to scan any of those suckers.
ortusdux 14y ago
I wonder if there is a possible system where google goggles could replace QR codes, like a physical adwords. The advertiser submits their ad, google slaps a 'official google ad' watermark in the corner for orientation, and pairs the image with the desired url. QR codes already assume that the user has internet access. Users are much more friendly to the idea of holding their phones up to a billboard because it asked them to. Hijackers would need to run a card through goggle payment processing to get a dirty url to work in the system. And what does the advertiser get out of the whole thing? Analytics.
VBprogrammer 14y ago
Does anyone have metrics on how many people actually scan QR codes? I'd count my self as pretty technical and except for a few attempts years ago for novelty value I've never scanned one. I can't imagine non-technical people even knowing what these are but their recent proliferation makes me wonder if maybe I'm wrong.
- erock 14y ago
  I did an experiment in my town, placing my own qr codes over everything i could find. running for a month, with putting 80 or so qr codes through out town. the number of scans i got was around 10. no one scans QR codes I have been thinking about printing up my own posters, like "Scan the code below to donate to Toys for Tots", but i still don't think I'd get many scans. here's an article http://www.veracode.com/blog/2012/06/dangers-of-scanning-qr-codes-interview-with-eric-mikulas/ http://www.veracode.com/blog/2012/06/dangers-of-scanning-qr-...
  - leephillips 14y ago
    If you got 10 scans after distributing 80 stickers I would not conclude that "no one scans QR codes". This is, instead, an impressive proportion of responses, unless I misunderstand.
    - erock 14y ago
      To be fair, I'm more disappointed, that i didn't track each scan a little further, and I'm also disappointed no one flamed me when their scan took them to a web page telling them they shouldn't go around just scanning random things.
    - highwind 14y ago
      If there are thousands of foot traffic by the 80 stickers per day, then I'd say 10 scans in a month do sound relatively scarce. But you are right, 10 != no one.
    - deleted 14y ago
      [deleted]
LiveFanChat 14y ago
oh pulease....thats like sayign check that url is not a sticker....some people are too dumb to be using the internet.
LiveFanChat 14y ago
oh pulease....thats like sayign check that url is not a sticker....some people are too dumb to be using the internet.
snippyhollow 14y ago
That's funny, because I made such stickers that I put in Paris subway on top of ads: http://emotion.inrialpes.fr/people/synnaeve/index_files/qr_wiki_rdm_en.png http://emotion.inrialpes.fr/people/synnaeve/index_files/qr_w... that redirect to a random Wikipedia page...
jfb 14y ago
How about not scanning robot barf in the first place?
daeken 14y ago
It'd be really interesting to scan codes in the wild, print replacements that forward it through a tracking service, and replace the originals. Information on when and where people scan QR codes across different markets (e.g. which products are most scanned) could be quite valuable.
- deleted 14y ago
  [deleted]
- franze 14y ago
  i.e.: https://news.ycombinator.com/item?id=4898851 https://news.ycombinator.com/item?id=4898851
  - daeken 14y ago
    Completely missed that -- thanks!
- TazeTSchnitzel 14y ago
  And then someone from a competing service scans the sticker and puts another on top, and now we're going through two layers of tracking...
vyrotek 14y ago
Google Glasses (and the competitors) might make QR codes very popular soon. Your camera will always be on and picking up any codes it happens to cross. This obviously eliminates the first friction point which is taking out your phone and pulling up your QR app. But, the more I think about this the more I'm afraid for this. They could essentially act as real world cookies. They could track everything you've glanced at and be used to bombard you with ads or other things. I'm sure there will be resistance and then QR scanning features might be turned off by default. Then we're back to no one scanning QR codes.
Aardwolf 14y ago
I have the solution! Rather than putting a QR code on the poster, put the actual URL there, so it's obvious when it's a spam URL. And then let phones use OCR to visit the URL! Then both the human and their phone can read it.
- indiecore 14y ago
  QR has error correction and stuff built in, OCR does not.

38 points by tankenmate 14y ago

I was chatting to a friend recently about how if QR Codes had taken off a bit more than they have (in terms of general population penetration, so your 50 year old parents would know what they are), that they'd become a pretty decent way to use for miscellaneous hijinks/spamming/attack vectors. Especially when that Samsung Android bug was discovered that could trigger the reset code, that in the wild would have been something crazy.

jeffehobbs 14y ago

Spam is a best case scenario -- unexpected porn would be a more eye-searing experience. I remember this trick from the good ol' days of Slashdot.

meaty 14y ago
Yes in London we've had Goatse QR codes deployed, much to the amusement of the deployer I imagine :)

froo 14y ago

Guerilla Marketing possibility by hijacking other people's ads?

jiggy2011 14y ago
Maybe, but a company doing this could probably look forward to some strongly worded letters from the lawyers of the company who bought the poster space.

edent 14y ago

I wrote about this a year ago http://shkspr.mobi/blog/2011/12/how-to-prevent-qr-hijacking/ http://shkspr.mobi/blog/2011/12/how-to-prevent-qr-hijacking/ It's already happening - on a small scale. QR codes are really popular in the UK, but I've only seen this sort of "sticker attack" once.

anu_gupta 14y ago
> QR codes are really popular in the UK, I don't think that's accurate, at least for values of "really popular" that I understand.

indiecore 14y ago

Good argument for customizing your QR code a little bit. Likely anyone who's going to do this will just print off a big pile of black and white perfect squares. If you design your media so that looks weird to people that's a single passive thing that will help protect your customers.

ohwp 14y ago

Another thing is that most apps show the Unicode URL: * User confirms he likes to open the url https://www.gооgle.cоm ('о' != 'o') * https://www.xn--ggle-55da.xn--cm-fmc/ is opened

andrewaylett 14y ago
Did you check xn--ggle-55da.com? Google's already registered it :). Some TLDs have restrictions on which IDNs can be registered, specifically to avoid this kind of spoofing...
- tankenmate 14y ago
  And in fact all new gTLDs will be required to have a policy to limit this kind of thing.

franze 14y ago

well, it seems a very un-economic strategy, because you need to invest in a) physical items (paper, glue) b) human workforce c) transportation (you need to get around town) and also I) nobody uses QR codes see http://www.google.com/trends/explore#q=qr%20code%2C%20qr%2C%20&cmpt=q and http://www.google.com/trends/explore#q=qr%20code%2C%20qr%2C%20mail&cmpt=q i run a quite popular create and read QR code website http://miniqr.com http://miniqr.com, and well let's say i won't get rich (for this sideproject) mail spam works because it's cheap to distribute, physical QR-codes - not so much.

konstruktor 14y ago
On the other hand, targeting can be very precise using this technique. Think bank advertisements.
Cogito 14y ago
nobody uses QR codes http://picturesofpeoplescanningqrcodes.tumblr.com/ http://picturesofpeoplescanningqrcodes.tumblr.com/ (this has been posted on other QR code threads before, but is always relevant)
- Spoygg 14y ago
  Hahahaha :) Did not come about this one until now :)
- franze 14y ago
  if you really want to see people scanning QR codes, there is a website for that http://replycam.com/browse.php http://replycam.com/browse.php has a few thousand or more qr codes (http://miniqr.com/reader http://miniqr.com/reader reused the http://replycam.com http://replycam.com flash webcam), should count them sometime.
- apathetic 14y ago
  it's empty. Did they mean it to be this way?
  - 14y ago

nwh 14y ago

I actually did do this once to a particular area of advertising. I took the time to make unique codes for each one replaced, and routed the requests past my own server to record each hit. The idea was simply to find out how much they get used, as a lot of clients seem to insist on having them as the only call to action on their advertising. In the end there were about 20 proxied URL on an extremely high traffic footpath.Either people noticed the edges of the sticker (unlikely), or absolutely nobody in my area wanted to scan any of those suckers.

ortusdux 14y ago

I wonder if there is a possible system where google goggles could replace QR codes, like a physical adwords. The advertiser submits their ad, google slaps a 'official google ad' watermark in the corner for orientation, and pairs the image with the desired url. QR codes already assume that the user has internet access. Users are much more friendly to the idea of holding their phones up to a billboard because it asked them to. Hijackers would need to run a card through goggle payment processing to get a dirty url to work in the system. And what does the advertiser get out of the whole thing? Analytics.

VBprogrammer 14y ago

Does anyone have metrics on how many people actually scan QR codes? I'd count my self as pretty technical and except for a few attempts years ago for novelty value I've never scanned one. I can't imagine non-technical people even knowing what these are but their recent proliferation makes me wonder if maybe I'm wrong.

erock 14y ago
I did an experiment in my town, placing my own qr codes over everything i could find. running for a month, with putting 80 or so qr codes through out town. the number of scans i got was around 10. no one scans QR codes I have been thinking about printing up my own posters, like "Scan the code below to donate to Toys for Tots", but i still don't think I'd get many scans. here's an article http://www.veracode.com/blog/2012/06/dangers-of-scanning-qr-codes-interview-with-eric-mikulas/ http://www.veracode.com/blog/2012/06/dangers-of-scanning-qr-...
- leephillips 14y ago
  If you got 10 scans after distributing 80 stickers I would not conclude that "no one scans QR codes". This is, instead, an impressive proportion of responses, unless I misunderstand.
  - erock 14y ago
    To be fair, I'm more disappointed, that i didn't track each scan a little further, and I'm also disappointed no one flamed me when their scan took them to a web page telling them they shouldn't go around just scanning random things.
  - highwind 14y ago
    If there are thousands of foot traffic by the 80 stickers per day, then I'd say 10 scans in a month do sound relatively scarce. But you are right, 10 != no one.
  - deleted 14y ago
    [deleted]

LiveFanChat 14y ago

oh pulease....thats like sayign check that url is not a sticker....some people are too dumb to be using the internet.

LiveFanChat 14y ago

oh pulease....thats like sayign check that url is not a sticker....some people are too dumb to be using the internet.

snippyhollow 14y ago

That's funny, because I made such stickers that I put in Paris subway on top of ads: http://emotion.inrialpes.fr/people/synnaeve/index_files/qr_wiki_rdm_en.png http://emotion.inrialpes.fr/people/synnaeve/index_files/qr_w... that redirect to a random Wikipedia page...

jfb 14y ago

How about not scanning robot barf in the first place?

daeken 14y ago

It'd be really interesting to scan codes in the wild, print replacements that forward it through a tracking service, and replace the originals. Information on when and where people scan QR codes across different markets (e.g. which products are most scanned) could be quite valuable.

deleted 14y ago
[deleted]
franze 14y ago
i.e.: https://news.ycombinator.com/item?id=4898851 https://news.ycombinator.com/item?id=4898851
- daeken 14y ago
  Completely missed that -- thanks!
TazeTSchnitzel 14y ago
And then someone from a competing service scans the sticker and puts another on top, and now we're going through two layers of tracking...

vyrotek 14y ago

Google Glasses (and the competitors) might make QR codes very popular soon. Your camera will always be on and picking up any codes it happens to cross. This obviously eliminates the first friction point which is taking out your phone and pulling up your QR app. But, the more I think about this the more I'm afraid for this. They could essentially act as real world cookies. They could track everything you've glanced at and be used to bombard you with ads or other things. I'm sure there will be resistance and then QR scanning features might be turned off by default. Then we're back to no one scanning QR codes.

Aardwolf 14y ago

I have the solution! Rather than putting a QR code on the poster, put the actual URL there, so it's obvious when it's a spam URL. And then let phones use OCR to visit the URL! Then both the human and their phone can read it.

indiecore 14y ago
QR has error correction and stuff built in, OCR does not.