OT: How Secure are QR Codes?

That means, when you decode it, you get a string of some sort, a short string. QR squares come in different sizes, and there are larger versions that can hold a longer string.

It has error correction, which means there is code redundancy. That allows the scanning device to get one of the bits wrong, and the decoder can see a bit is wrong and correct it.

If you take a pair of scissors and cut off one "ear" of the square (25 percent of the bits), the encoded string can still be recovered. This is good when a QR is used for addressing on a paper-wrapped parcel and part of the label gets ripped off.

It's up to the application code on a computing device, to decide whether to "ingest" random information in the environment. Desktop computers do not normally "volunteer to eat malware" presented to them in this way.

/mnt/d$ sudo apt install zbar-tools

/mnt/d$ zbarimg QRCode-test.bmp QR-Code:

That's an example of me taking a picture of a QR code symbol, reading the BMP file with zbarimg and zbarimg spits out the URL string encoded in the QRCode. The QRCode in my example then, is the URL of a downloadable PDF file.

Since I manually parse the string, I see it is https:

Only a fool would give unlimited access to a computing device, for the purpose of "ingesting and acting upon" a QR Code. You look at them first. On a desktop, normally there isn't sufficient automation for bad stuff to happen.

When that string above was spit out into the Terminal session, only by copying and pasting the string, is there any "action". Yes, I downloaded that PDF file, which is the instruction manual for a computer motherboard.

Paul

That will give you some text - what you do with it after will dictate if it is "safe". i.e. if it is a web link to a malicious site and you follow it, that might be "unsafe".

I think that is taking a grain of truth, stretching it a good bit, and then stuffing in a nice big fat lie at the end :-)

They are using QR codes that will link to a site that will let you easily email your union requesting cancellation. Once on the page you would need to add your contact details and your union membership number before requesting it send it for you.

So there is no "auto zapping", or the phone "locking on" or doing anything without your knowledge etc.

What they are doing is providing a "service" that makes the process as frictionless as possible.

Similar things exist for all kinds of cases like:

There have been some examples where a particular QR code has been replaced by a scam QR code and the original user of the QR codes has stopped using QR codes for that reason.

Parking in the UK from memory.

That's kind of like asking "How secure is something written on a postcard?".

It depends whether what is written on it, and having read it, what you do with it, they don't "do" anything by themselves ...

You phone *can* be set up to use the camera to decode QR codes and take you there, *if* the camera is on.

But it can also be set up to *not* do that.

I have a dedicated QR code reader app. This because I am a geocacher, and sometimes QR and other less common codes are used to convey geocache information without that being an internet link. The native phone reader is (or used to be) confused be such text content as "Take the second left".

The code reader app ("Binary Eye") decodes the code, displays the data plus additional format information, and as an availed option offers to pass it to a browser as an internet link.

Furthermore, a phone would have to have an active camera to scan a QR code.

Accurate summary, as far as I can see.

Thomas Prufer

Famously some scammers replaced the QR code for buying on-line tickets at a railway station.

"In a recent scam, fraudsters covered a genuine QR code with a fake one in Thornaby Station's car park, Teeside. The QR code took one

Short answer: completely insecure

The code itself is just storing some text & data, just like barcode However, since it is human unreadable, some sort of SCAM made use of this like mentioned above

Yeah, that was the one I meant.

There have been a few similar cases where QR codes purporting to link to a payment apps have been stuck on notice boards and pay machines in car parks.

(normally there will be good signage for the real payment app[1] - so look for that by name on the relevant app store, rather than using QR code for a link)

My local Tesco uses My Parking Space for anybody who wants to stay more than the three hours allowed for free.

Yes, and they can do the same without QR codes - just put a fake web address in text. They could make a sticker saying "Pay for parking online at parking-paying.org.uk" and unless you already know that's not the real web site there's nothing to stop you going there and having your card details stolen. It's at little less obvious with QR codes - if it's in plain text, a random person might notice it's not the real web site, while someone not wanting to pay at that time is unlikely to scan the QR code - but that's all.

Mike

The thing is, it's not actually an "app" it takes you to. Because to get an app on any platform requires enough details to make you very traceable.

It will be a shonky website. And even then, I would expect the payment gateway to have a bit of culpability. I am sure they don't just hand out folded fivers to the operators of such dodgy websites, so there is the start of an audit trail.

Precisely - hence "purporting", when in reality nothing more than a phishing exercise to try and capture payment details or access credentials to a legitimate parking app.

Not really... for example I could create a google account using a VPN and fake details, then download an app. However the exercise here is to try and lead you *away* from the normal path of searching for the app by name on your normal app store, and into using their link instead.

There does not even need to be a payment gateway if all the want is credit card details etc.

I think you are missing the point of the exercise.... you obviously don't have a criminal mind :-)

Having got legit payment details for a parking "transaction" that will ultimately "fail" - "Sorry we have experienced an error - please try later", they can use those on other legit sites to purchase goods or services (aka a "man in the middle" attack, or more likely, simply sell on the card details on a dark web "carding" site. Take some of the money up front, and let someone else take the risk trying to use the details. The other details they have can be used (or sold) for follow up spear phishing attacks.

My Moto G31 seems to spend much of its time in 'battery saver mode', where it refuses to acknowledge QR codes :-).

Miscreants have been sticking their own QR codes over the genuine ones on parking machines at council and railway carparks in the UK. An unsuspecting person trying to buy a parking ticket is then directed to a scam site which harvests credit/debit card details.

Heh.

I read that miscreants set up a false ATM that harvested credit/debit card details plus PIN. It was a freestanding block thing, in a tourist area, and sent data off immediately. Presumably it took the marks through the authentication steps, and then returned the card with a polite "transaction not possible".

Thomas Prufer

The "better" ones are the skimmers added to real cash machines. A card reader mounted around (or actually in) the card slot, and then either a thin supplementary keypad stuck on top of the real one, or a disguised down facing camera lurking somewhere.

They allow the machine to be used, and it works, and it dispenses cash - the user is none the wiser... until the card details are programmed back to a blank card, and used with the captured pin.

As I have no control over what the code contains & cannot (easily) read it, any label or paperwork that arrives with a bar/QR code is either shredded or burnt.

Any paperwork that I have to keep has the codes redacted.

The worst thing that anyone who has banking apps on their phone can do (or forget to do) is not change the default pin on the

If your phone is stolen, the sim is put in another phone and the thief requests a new password for the banking app, pretending to have forgotten it. Bank then sends a 2FA code to the thiefs phone and he is in.

If a new sim pin has been set, then that stops them dead in their tracks, assuming you haven't used 1234, 1111, 0000 or similar (which I hope would be blocked by the sim provider anyway).

Barclays have a 10 day delay activating their banking app on a new phone, presumably to give you time to report theft and prevent that type of "take-over"?