I just started reading a little on QR code, so I'm not entirely familiar with QR Code capabilities, but a thought crossed my mind today.

I scanned a QR Code on a postcard I received, and it immediately took me to a website.

Just like URL shorteners, is there any protection from obscuring a malicious site in the QR code?

I also noticed you can use QR Code for multiple other things such as VCards, Youtube videos, etc...

Can you embed code that then gets executed on the client when scanned?

Again, I just started reading around, so my understanding of this technology is pretty feeble, but primarily what I'm looking for is some ideas of potential threats from scanning QR codes, as well as potential mitigation techniques.

This question was IT Security Question of the Week.
Read the May 4, 2012 blog entry for more details or submit your own Question of the Week.


A QR code is nothing more than an encoding of data. URLs being encoded as QR codes are just one specific usage. As you say, it suffers the same problems as URL-shorteners in that you might never actually know where it goes until it takes you there. However, any decoder could provide a safe landing zone before allowing a browser to be launched.

Because the QR code can encode any data up to a specific maximum, the use of the QR code is only limited by the applications which scan them and make use of the data. This allows a wide and blind attack area. Furthermore, the decoder itself could have a variety of buffer overflows to exploit.


The mitigation is very simple, and some QR code scanners already do this:

Don't go straight to the URL, but display it in full instead, so the user can validate it first.

However this isn't as user-friendly, so often the apps just take you straight to the website. If that URL is malicious (which is very easy - it could take you to any website) then your device could be instantly compromised. Game over.

  • 1
    What if the QR code leads to a URL shortened link which then leads to malicious page? Then you're really screwed I guess :)
    – emtunc
    Feb 1 '12 at 20:22
  • That's why you use plugins that display the redirect - actually, I wonder if there is one for browsers on phones.
    – Rory Alsop
    Feb 1 '12 at 20:23

Yes, they can be a big problem, and I believe will eventually be a common threat. Here's how they work.

  • 3
    Generally speaking, answers containing only a link don't carry much weight, and aren't looked upon highly around here. If you were to change your answer to a brief overview of the link, followed by the references, your answer would be much more acceptable, and even be voted up I'm sure.
    – Purge
    Feb 2 '12 at 2:35
  • 2
    @Purge, more so for URLs that redirect to a different place, ironically for this question.
    – Bruno
    Apr 30 '12 at 18:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.