Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What are the security risks of scanning a QR code from an untrusted source?

If the QR code was constructed by an attacker, what can the attacker do to me? Do widely used QR scanners have any known vulnerabilities? What information can be stored in a QR code, how is it handled by QR scanners, and how could this be used by an attacker?

I know a QR code can contain a URL, and many readers will launch a browser to that URL, so a QR code could be used as a launching point to mount any attack that can successfully be exploited against my browser. Is there anything else? Can other data be stored in a QR code and automatically processed by the scanner?

share|improve this question
    
See also this related question: Malicious QR Code and Mitigation - IT Security - Stack Exchange –  nealmcb Apr 11 '12 at 5:58
2  
Related: Cusiosity Pwned the Cat - th3j35t3r blog –  Gurzo Apr 11 '12 at 9:17
add comment

4 Answers

up vote 7 down vote accepted

This are some risks you can face:

  1. If the QR code linked you to a poisonous website, this site can try to exploit your browser, the danger depends if your browser is secure or have vulnerabilities and of the type of explotation.

  2. The QR code can exploit the scanner application, this exploit can be performed by an intentionally corrupt QR code, this code can affect the process of the scanner application, obviously the exploit only can have success if the scanner application is vulnerable. Like in the first case the danger depends of the type of explotation.

References

QR code - Wikipedia

share|improve this answer
add comment

Samsung USSD remote wipe attack can be performed with a QR code embedding a url/tel link. Eko Party Video.
Or can even pwn your kernel with a url to a pdf. Jailbreakme V3.

share|improve this answer
add comment

A QR Code, Quick Response Code, also known as a two dimensional code, is a small white square with small sections of black covering it. It can be read by the camera of a smartphone, and once read it may instantly redirect the smartphone user to a webpage.
How are QR Codes used?
QR Codes can be used in a variety of ways to market a business, to provide further information on a product or service by encoding general text, URL, phone number, business card and even provide WiFi access.
Best Practices
* If it smells phishy, throw it back. Most of us aren’t tempted to open emails which are obviously spam. However, QR codes are tricky because you cannot weed out the bad from the good by simply looking at the code. Because the vulnerability is practically part of the design, consider downloading an app on your phone which provides a preview to each code before it opens a webpage (eg: I-nigma). This way, you will have right of refusal if you think the QR code is corrupted.
* Remember the old proverb, “Curiosity killed the cat.” Hackers prey on curiosity, thus if you see a lonely QR Code posted on a wall, DO NOT scan it to find out why is it there and what it does.

share|improve this answer
add comment

You never must trust in user input, independly if this is a string, a bar code or a qr code. All of them, can exploit your application. Eg. SQL-Injection. Take a look in this PDF, its very useful for your question :) http://qrcodethursday.files.wordpress.com/2011/03/qr_code_security.pdf

Bonus: I don't know if this is a joke or really true, but make sense: http://cicero.files.wordpress.com/2010/04/500x_for_traffic_cameras.jpg

share|improve this answer
    
Thanks, Victor! +1, helpful. That said: I was asking a slightly different question. I know that if I were building the code to handle the contents of a QR code, I shouldn't trust its input. Agreed. But I'm still curious: What are the risks associated with deployed systems that happen to use QR codes? What are the issues to beware of, given that I'm not the developer of those systems but merely a user? –  D.W. Apr 11 '12 at 4:47
2  
Isn't that Bobby Tables' car? xkcd.com/327 –  Iszi Apr 11 '12 at 18:26
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.