PRACTICAL PROTECTION IT SECURITY MAGAZINE

Dear Readers,

I m pleased to welcome you at the end of the summer period

with a brand new issue. The issue that is supposed to be just
a start in the area of QR code research. This is still a new topic
team and many people wouldnt like to share their research and dis-
Editor in Chief: coveries on QR hacking as it is still a pretty new marketing tool
Magdalena Gierwatowska and there is not much that can be done to secure people from
magdalena.gierwatowska@hakin9.org
those attacks apart from their awareness. We could mainly ad-
Editorial Advisory Board: Peter Harmsen, Dan vise you to be protective and reasonable while scanning some
Smith, Hans van Beek, Leighton Johnson, Gareth
Watters, Sushil Verma, Jose Ruiz, Casey Parman,
QR codes, think about the source of it, where they have been
Wendy Bennington, Liew Edwin. placed etc.
Proofreaders: Magdalena Gierwatowska, Krzysztof
Samborski We hope that these issue will convince you to interact a little
bit more in the area of mobile security or moreover QR code
Special thanks to our Beta testers and Proofreaders
who helped us with this issue. Our magazine would hacking, as the mobile security is not being so fragile.
not exist without your assistance and expertise. We are coming with the new edition of Hakin9 Magazine
Publisher: Pawe Marciniak
so you can access it through your computers, tablets, smart-
phones and e-book readers.
CEO: Ewa Dudzic
ewa.dudzic@hakin9.org
Just want to say that it wouldnt be possible without the sup-
Product Manager: port we receive from our authors, Hakin9 Team Members and
Krzysztof Samborski
krzysztof.samborski@hakin9.org
betatesters involved in the creation of this Magazine.
Production Director:
Andrzej Kuca
What are we going to offer you this time? Take a look at a
andrzej.kuca@hakin9.org quick overview below.
Marketing Director:
Radoslaw Sawicki David Nordell is going to take a look at the possibilities of fi-
radoslaw.sawicki@hakin9.org nancial crimes made by hidden pieces of malware. We are go-
Art Director: Ireneusz Pogroszewski
ing go through disadvantages and advantages of QR code use
ireneusz.pogroszewski@software.com.pl with Carlos Rodriguez Perez. The main factors of QR treat will
DTP: Ireneusz Pogroszewski be showed by Antonio Ierano.
Publisher: Hakin9 Media sp. z o.o. SK David Allen is going to show you that most QR code disas-
02-676 Warszawa, ul. Postpu 17D ters are self-imposed by the users and implementers. V. Mi-
Phone: 1 917 338 3631
www.hakin9.org
chael Balas is going in depth with the topic but we wont tell you
the approach, it is must read.
Whilst every effort has been made to ensure the
highest quality of the magazine, the editors make no We hope the effort of Hakin9 Team was worthwhile and the
warranty, expressed or implied, concerning the results QR Code Hacking issue will appeal to you. Enjoy the magazine!
of the contents usage. All trademarks presented in the
magazine were used for informative purposes only.

All rights to trade marks presented in the magazine

are reserved by the companies which own them.
Magdalena Gierwatowska
Editor of Hakin9

and the Hakin9 Team

DISCLAIMER!
The techniques described in our
articles may only be used in private,
local networks. The editors hold no
responsibility for misuse of the presented
techniques or consequent data loss.

4 07/2013
 CONTENTS

BASICS although he would check the URL he would probably

see the short version that is anyway not readable. Un-
Hacking QR Codes 06 less the user is using on its smartphone or tablet a se-
By Rishabh Rastogi curity suite could be easily fooled and redirected any-
An information security, risk and governance where.
minded professional who thrives on evaluating
technologies and business processes from a
QR Codes: Convenience or Minefield? 22
critical perspective. By David Nordell
Popularly QR Codes have found their application in CEO of New Global Markets
encoding URLs, visiting cards, addresses and various Imagine that you are walking in the street in the town
forms of advertisement data on posters. Along with its where you live. You need to find a new place to live,
great uses, QR codes have also many potential risks and dont really want to use an estate agent, because
due to the vulnerabilities around its design and hence they usually lie about the places they have available,
prying threat vectors would always be after exploiting and charge a commission too. But you pass a tree with
those vulnerabilities. a sheet of paper stapled to the bark, reading beautiful
two-room apartment, lots of light, modern kitchen and
QR Codes 10 bathroom no agents.
By Carlos Rodriquez Perez
Imagine you're a malware developer, and you are look- QR Codes Hacking, cracking
ing for new techniques to spread your malware, you're
and other security considerations 26
tired of thinking and suddenly you have an idea, why not By V. Michael Balas
include my trojan in a QR Code? This is the question Founder and CEO at VitreoQR, LLC
that many cyberdelinquents ask to themselves, is very On March 6th of 1992, the world waited for the Michaelan-
easy to pass a trojan by an application for our smat- gelo Computer Virus to strike hundreds of thousands of
phone, for example an X-Ray Reader (fake of course), computers across the planet. The threat was so great this
once we have read the fraudulent code, the malware one computer event received massive and widespread
disburdens himself and attack, usually the attack con- media attention in virtually every industrialized country. Ul-
sists in a malware that is installed in our smatphone... timately, the virus did little actual damage but its media
coverage frightened the world into a more pro-active posi-
THE TECHNIQUES tion regarding protection from such attacks.
Hijacking QR Codes 14 6 Ways To Protect Yourself
By David Allen From QR Code Hacking 34
Managing Director at @MobileEngage By Nick Lynch
The QR code system was invented in 1994 by Toyo- Co-Founder of OakReach, a native ad and
ta's subsidiary, Denso Wave. Its purpose was to track content marketing platform
vehicles during manufacturing; it was designed to al- In todays fast moving times, getting information and
low high-speed component scanning. It has since be- content instantly at our figure tips has become an in-
come one of the most popular types of two-dimensional creasing necessity. Because of this, Quick Response
barcodes. Originally designed for industrial uses, QR (QR) codes continue to be the biggest driver of print
codes have become common in consumer advertising. to mobile activations. When scanned, the codes often
contain web links that automatically take a user to a
QR Code A Real Treat Or Not 18 website.
By Antonio Ieran
Security Consultant, Evangelist, Speaker, Trainer interview
and Blogger at The Puchi Herald
We could easily create a related to a malware infection,
Interview with Nick Lynch 38
convert this URL through a shortened URL service, as-
By Magdalena Gierwatowska
sociate it to a common logo and embed this info in a Interview with Antonio Ieran 40
QRCode. A normal User would check the code through By Magdalena Gierwatowska
its application and would find a familiar logo to click on;

www.hakin9.org/en 5
 BASICS

Hacking QR Codes
A Case of Curiosity and
Pattern Fallacies
Summary:A curious user, putting incredible amount of
trust, scans the machine only readable QR code, the code
redirects him to a site or provides certain information or can
trigger several attacks and fraud the users

Q
uick Response codes aka QR Codes have its great uses, QR codes have also many poten-
been in use since 1994 courtesy of DEN- tial risks due to the vulnerabilities around its de-
SO WAVE. These are 2D barcodes encod- sign and hence prying threat vectors would always
ed both vertically and horizontally thereby multiply- be after exploiting those vulnerabilities. Hence
ing the capacity of holding data than the traditional not making a very sweeping statement, but fun-
1D bar codes (7089 digits in comparison to 20). nily enough every kid on the block has a QR Code
Hidden in those pixelated lines is embedded code scanner and is a potential victim of being hacked.
which is only machine Recently, the much awaited Google Glass was a
readable that points the victim to the magnitude of exploitation it could be
user to a new location subject to by QR Codes as founded by research-
on the web or process- ers from Lookout Mobile. The researchers reverse
es particular informa- engineered QR Codes turning them malicious and
tion. In the last few years once scanned by the Google Glass it would recon-
QR Codes have seen figure the device and overturn the control to the
widespread popularity hacker making him aware of all the information
in usage like never be- linked to the same.
fore due to the increase Here in this article I will try to analyse those pos-
in QR Code scanners, sible structural risks of the QR codes and the at-
which are typically smart tack vectors which affect both humans and auto-
phones enabled with mo- mated information processing systems.
bile internet. This led manufactures and adver-
tisers to incorporate QR codes on their banners Anatomy of QR Codes dissect the devil
and making the most of it. Now, QR Codes are As devil lies in the detail therefore, to begin with,
everywhere, on bus stops, pubs, railway stations, it is important to understand how QR Codes work
street light poles and recently on English football and how theyre designed. This will help us under-
clubs jersey to direct you to a WAP site. Popularly stand the loopholes in their overall structure and
QR Codes have found their application in encod- usage, exposing them to various risks.
ing URLs, visiting cards, addresses, and various The QR Codes as shown in Figure 1 are made
forms of advertisement data on posters. Along with up of inner structure which is built from contrasted

6 07/2013
 Hacking QR Codes

(black and white) squares with an overall base of tops most finder patterns, going horizontally and
a matrix like structure. Around the QR code there other pattern going vertically downwards along the
is a white margin (cannot be seen in figure) also top left and lower left finder pattern. This structural
called as Quiet Zone and is 4 times wider than pattern is important for the decoding software, by
the inner square of the overall structure. Inside the enabling it to determine the width of each module.
inner square, the following critical patterns or com-
ponents exist which form what we call as the quick Format data
response code. Any manipulation to the compo- This is the 15 bits of data which is just next to the
nents shown in (Figure 1) can lead to information separators and provides information on the mask-
which is unwarranted and often incorrect. ing rule used in QR codes and the error correction
level. Masking a QR codes pertains to the inver-
Finder Pattern sion of colored and colorless modules crucial to
The finder pattern is a concentric square made up decoding software.
of 3x3 black module-white module-7X7 black mod-
ule which is located on the three corners of the QR Data
code except the bottom right one. These are iden- Apart from the structural format as explained above
tical structures which enables the decoder soft- the data occupies most of the middle space. These
ware for correct orientation. are blocks of 8 bits of encoded words (blacks and
whites). The capacity of data to be held in a QR
Alignment Pattern Code entirely depends on the error correction level.
Alignment pattern also forms a part of the crucial
structure of the QR code as it allows the decoding Error correction level
software to scan an inverted image and convert it In QR Codes, the basis of error correction is the Reed
into a matrix of black and white structural modules Solomon codes, which forms different levels of error
which forms the overall encoded information. Its correction ( Low=7%, Medium=15%, Quartile=25%,
also like a finder patterns structure which is basi- High=30%), this percentage shows the value of re-
cally a concentric square. covery of symbol codes. Choosing a higher value
means accommodating less data but at the same
Separators time including chunk of error correcting code.
These are 1 pixel sized blocks of white spaces sep- The above knowledge on structure of QR Codes
arating the finder pattern to the rest of the data and is necessary to understand the anatomical com-
allow the decoder to distinguish between the timing ponents in order to estimate and analyse the risks
pattern, finder pattern, and the format pattern. around them and then figure out the ways they can
be exploited.
Timing Pattern
As seen in the Figure 1, there is an alternating Vulnerabilities embedded in QR Codes
stripe of black and white blocks, just under the two Structural and Usage
Structural Manipulation-the case fallacies
A QR code can either be manipulated with fallacy
of the structure as the components we discussed
above can easily be manipulated by techniques
discussed in this section. Furthermore the possi-
ble threats multiply as the code is not human read-
able, easily accessible and threat agents are prone
to social engineering along with the increased pop-
ularity and visibility.
Lets first have a look at the ways in which the
structural components of an existing QR Code can
be manipulated by an adversary.

Distorting the encoded information by masking,

characters and count indicators
Masking in QR codes refers to overlapping of sev-
eral layers of distributions of black and white pix-
Figure 1. QR Code Anatomy els or modules leading to the final picture of a QR

www.hakin9.org/en 7
 BASICS

code which has the best distribution (1:1) of black vulnerable to be exploited by a malicious QR Code
and white modules. This inherent property of QR by various ways, as discussed below:
code is vulnerable to physical manipulation of the
masks rendering the encoded information useless SQL injection by query stacking
as the code now read by the scanner would not Many automated information processing system
direct the user to its actual content. Hence, ma- which use QR-Codes as an input for a task to be
nipulating the pixel distribution on the final mask, completed can be targeted by manipulated QR
changes the data content and the error correc- Codes if the input processed through the encod-
tion code. This can further be substituted by ma- ed information is stored in a SQL server based re-
nipulating the structural pattern of the actual QR lational database. For Instance, if an information
code and changing their count indicators and the processing system integrated with an assembly
encoded characters. To implement this, it is re- line used QR codes to input the product name and
quired to skew the pixels in the data part of the QR number and hence storing them in a relational da-
code, which can be done by layering the code with tabase, then an adversary can place a maliciously
a sticker covering the modules to be skewed. In encoded QR code which includes a query string
certain cases where the error correction algorithm with the input variable appended with a malicious
(Reed Solomon Code) is incorporated to rectify SQL script to drop the whole table. This QR Code
high level (30%) of the incorrect codes, this vulner- as soon as scanned by the information process-
ability may be contained to an extent. ing system would treat it as an input to the SQL
server affecting the relational database and delete
Hazards in usage- the case of curiosity and trust the whole table. The Figure 2 illustrates the same.
With its growing visibility and ease of production,
the usage of QR codes make the users curious to
scan whatever comes there way. Theres no way
for you to know what lies behind until you scan it.
For this reason, the inquisitiveness behind the us-
age of these codes is a vulnerability itself which Figure 2. Illustration of SQL Injection by query stacking in QR
can be fairly exploited by adversaries. Malware Codes
peddlers are on rise for most operating systems
used in mobile phones such as Android, Windows Similar misuse of this vulnerability can be do-
Mobile, iOS. Therefore attackers can easily stick ne command line injections which inputs relays of
maliciously encoded QR Codes anywhere in a shell scripts being scanned by a QR code and fed
prominent area and just wait until someone scans into a processing unit. A Shell command injection
it and hence gets caught in the rain. In the follow- can encoded into a QR code and made to be pro-
ing section we discuss, how these vulnerabilities cessed leading to exploitation of the OS and the
can be exploited making QR codes as potential at- server in their core directories.
tack vectors.
Launching XSS (Cross Site Scripting)
QR Codes agent of exploitation for Most of the websites which are static in nature,
humans and information processing built using HTML (Hyper Text Mark-Up Language)
systems which is a tag based language for static website
In the earlier parts we discussed the vulnerabilities development. HTML combined with scripting lan-
in the design of QR Codes and the way they can guages like Javascript and PHP provides a mech-
be manipulated due to inherent properties of the anism for building websites dynamically. Hence,
codes which are inconceivable to a nave user. We using these languages, most of the websites built
also touched upon the vulnerability of the same today are dynamic. These languages allow the
by the increasing popularity and ease of access, web-server (place where data is stored) to send
making it more prone to be used as an attack vec- executable code to the client. A web server is con-
tor. In this section, the discussion is based on us- nected to the HTML front end by using a protocol
ing QR codes as an agent or means to implement called HTTP (Hyper Text Transfer Protocol) that is
commonly known exploitation techniques affecting used for transfer data. HTTP is a stateless proto-
both humans and information processing systems. col that does not store details about the users who
In manufacturing and automobile industries QR have sent requests to the web-server (Higure 3).
Codes are popularly used to track products by au- Cross-site scripting takes advantage of the state-
tomated processing units. These units are easily less nature of HTTP. This can be further used by

8 07/2013
 Hacking QR Codes

used by an attacker to encode a script of an URL other social networking sites and post without prior
in a QR Code redirecting the browser to a web- knowledge of the user.
server generating a page with scripts embedded
by the hacker. These scripts (usually JavaScript) Conclusion
enables the hackers to retrieve all the information QR Codes as we discussed above a ways to in-
from the users mobile phone browser and hence put information into a processing unit with a de-
render it exploited. coding facility and performs certain actions. As
these codes cannot be decoded with human eyes
therefore theyre vulnerable to exploited and pose
a serious threat to the users. Blindly, scanning a
QR code which proves to be malicious can have
grave consequences on the device. These codes
Figure 3. XSS scenario with QR Code as entry point can easily be used as attack vectors to launch ex-
ploits such as SQL injections, XSS, CSRF, and al-
so to download Trojan horses. The QR codes ones
Reflected CSRF scanned acts as an input to triggering the men-
CSRF is another type of malicious attack on web- tioned exploits without the knowledge of the user.
sites and web applications also known as one click One of the ways this can be dealt this is, using
attack, side jacking or session ridding. There are scanners which preview the URLs before opening it
many who refer CSRF as a version of XSS, but in the browser and hence is the user deems it be sus-
technically both are different. CSRF exploits the picious they can reject it. Most times, advertisers ask
privileges of authenticated users for performing users to enter their personal information on scanning
undesired functions on the users behalf. It is in- QR code and setup a honey trap to steal that infor-
teresting to note that a QR Code can easily be an mation and use it for illicit purposes. QR Codes can
attack vector for such exploit. For instance a user further be standardised using only HTTPS to estab-
attempts to scan a QR code with his smart tabloid lish communication with the web servers along with
in a parking lot which promises him to get a dis- the URL printed on the stickers so that the users can
count, if he logins to his eBay account and scans have a degree of trust in the same.
the code. Now as soon he logins and scans the Finally, along with the great potential of the vari-
code the malicious script encoded in the QR code ous applications of QR Codes, its exploitation is
extracts his login information and initiates an auto- imminent due to the inherent structure it is made
mated PayPal payment through his eBay account. up of and largely because it is not human readable
Hence, exploiting his browser by CSRF, the attack- and thus can act as an agent to prompt various
er uses an external system to expose the victim to hacking attacks.
a link or content.

Redirecting to Trojan horses/Malware

Trojan horses are standalone malicious programs
which are designed specially in such a manner that Rishabh Rastogi
the host system on which it is installed doesnt even Rishabh Rastogi is an information secu-
get to know the real intention behind the program. rity, risk and governance minded profes-
Hackers usually disguise Trojan horses in forms of sional who thrives on evaluating tech-
PDF files, mp3 files, ZIP files and other forms of util- nologies and business processes from a
ity programs. A QR code can easily be used to redi- critical perspective. When he isnt think-
rect a nave user to website promising him free mu- ing risks, or trying to review an audit pro-
sic or special Apps but actually installing a Trojan as gramme, he can often be found cooking,
soon as he begins the download. The downloaded exploring new music, building terrariums,
Trojan installs itself on the root directory of the host aquariums and evolving new hobbies.
smartphone, PDA or tabloid and can prove to be
lethal for the system. It may initiate sending auto-
Copyright information
mated SMS on a premium number, costing the user
money or maybe even worse by sending illicit SMS Rishabh Rastogi, 2013. Unauthorized use and/or duplication of
or emails to all contacts in the phone directory. If a this material without express and written permission from the men-
QR Code injects a malware into a phone then it also tioned author and/or owner is strictly prohibited provided that full
have the capability to access Facebook, Twitter and and clear credit is given to Rishabh Rastogi.

www.hakin9.org/en 9
 BASICS

QR Codes
Probably someone thinks that the QR
code is just something random, that
doesnt make sense, only a heap of
stripes and points. Nothing is further
from the true. The QR code is a new
and simple way to share our ideas
and our knowledge.

F
irst, I should introduce to you the history of History of the QR Code
the QR codes, how they were born, who The QR Code (quick response code) born in Ja-
created them and why. Also I will include pan in 1994, created by Denso Wave Company, it
some graphics on the increase of his use in the was made as a new way of transmitting informa-
last years. tion quickly, it is characterized by the three squares
that we can see, now take a look this image:

Figure 1. QR code structure

This is how it works, as you see in the image
the blue part corresponds to the version of the QR
Code, the red part indicates the format of the file
Later I will talk about the uses we can give them that we want to share, I mean it is an image, url,
and how use it in our benefit, also I will mention the etc.. I hope that you have realized that the QR
current uses. I will show you how since his growth Codes arent random.
has been increased from his creation. Now, to finish this part of the article, I will analyze
After Im going to show you his involvement in the use of QR Codes since its popularity has in-
the world of the hacker, here I will talk to you a bit creased. Look the graphic.
on the mobile malware. As you can see in the image (sorry if its a bit
And finally I will do a reflection on the mentioned small) the use of the QR Codes has increased in
previously. a 157% since from the first quarter of 2009, if we

10 07/2013
 QR CODES

observe the graph strikes us the strong trend that The users tend to use these codes to take part in
from January, 2010 is taking place worldwide. contests or promotions, in addition to access mul-
timedia content, but as I said before, normal users
dont tend to use these codes.
Now, we are going to talk about the alternatives
to the QR Codes, I will do a brief revision on more
acquaintances.

Bidi Codes
This code has been created by Movistar Company,
this code is private, and no open source, and there-
fore they are not free, since they are orientated to
Figure 2. Growth of QR code scans commercial ends, also we need specifics applica-
tions to read these codes. In conclusion, I think that
the QR is a better choice, not only because is open
Also it is necessary to say, that the actual use of source, but also because they are totally compatible
these codes is low, because few users who take with our smartphone, tablet or computer.
the time to scan the codes with their smartphones.
You will probably wonder, Who uses these codes?
Well, these codes are used principally in compa-
nies that want to give a modern aspect to their
products.

Utilities And Current Uses

I will start by naming some advantages and disad-
vantages of the QR Codes.
Advantages:

Easy and quickly way to share our information. Figure 3. The look of Bidi Codes
Free and compatible with all our smartphones,
tablets, and computers, universal format. Datamatrix Codes
In a QR Code you can store even 7.089 nu- Datamatrix, another friend of the QR, well, this
merical characters or 4.296 alphanumerical code has more similarities to the QR, for example,
characters. this one yes is open source like QR, one of the ad-
The code has the aptitude to correct mistakes, vantages of these codes is that the minimal size is
the information can be restored if part of the minor that in the QR, nevertheless, this advantage
code is damaged. can suppose a misadventure, since it enters conflict
The QR can be read in any position, vertical, with the chambers of the mobiles, because being
horizontal... so small, the cameras have problems to focus on it.

Disadvantages
We need to download an application in our
smartphone, tablet or computer to read these
codes, While the mobile operating systems do
not include the reader the cost of seeking and
lowering an application can be a lag and im-
pedes the general adoption of the tool.
Low use. Few people know them and those who
know them find little real value to use them.

As you can see, the QR Codes need to attract Figure 4. The look of Datamatrix Codes
more people, and be more accessible, because
though it is true that many companies use them, Now, Im going to show you some applications to
still they need to catch the great public. create or read our codes.

www.hakin9.org/en 11
 BASICS

Create your own QR Code online -> QR Code Generator

Read QR Codes in your smartphone/Tablet -> QR Code Reader
Read QR Codes in your computer -> QR Code Reader PC

QR Code In The Hacker World

Ok, this is the interesting part of the article, here,
I will speak also a bit of the Mobile Malware, and
some techniques to avoid it. So, without further
ado lets begin.
Surely some he wonders how the QR can influ-
ence in the Hacker World, or in the Malware World,
well, there is no better way of explaining it that with
an example:
Figure 5. The Mobile Malware
Imagine youre a malware developer, and
you are looking for new techniques to In the last years the mobile malware has in-
spread your malware, youre tired of think- creased, just as the use of the mobile phones or
ing and suddenly you have an idea, Why smartphones has increased.
not include my trojan in a QR Code?

This is the question that many cyber delinquents

ask to themselves, is very easy to pass a trojan
by an application for our smartphone, for example
an X-Ray Reader (fake of course), once we have
read the fraudulent code, the malware disburdens
himself and attack, usually the attack consists in a
malware that is installed in our smartphone, once
installed is dedicated to illegal activities, such as
sending SMS to a payment service that takes ad-
vantages of the attacker. The social networks or
the publicity are the main vehicles to make these
codes to the users. But, How can we protect our-
selves from this? Below Im going to give you some Figure 6. The growth of Android malware
tips to protect ourselves from this.
As you can see there has been a sharp increase
What to do since 2012, I think that this is normal, since we all
have a smartphone, and this implies a business for
Always download apps only from the Play store the cyber delinquents, because they have the possi-
(Android), AppStore (Mac), Market (Windows bility to earn money with our smartphones, and this
Phone). The apps that you can find here are is a very lucrative business. Weve talking about An-
revised. droid, but, what about the other Operating Systems
Use an Antivirus System, Avira or Avast! For like IOS or Windows Phone?. Lets take a look.
example, the two are totally free.
Keep your device updated. IOS
See the rights of the applications, I mean, if you Well, were talking about a very exclusive system,
see an app with full rights I recommend you not I mean that is hard to install apps out of the Ap-
to install it unless you know well what it is. pStore or iTunes, but there are other ways to in-
stall apps, in iOS, for example, we are able to ap-
To complete this section Im going to talk about the ply Jailbreak in our device, And what is Jailbreak?
mobile malware, just a few clarifications about this. Well, is the process of removing the limitations on
Apple devices, in other words, we are superusers.
The Mobile Malware The jailbreak allow us to install apps, themes, ex-
Well, this one is a wide enough topic, before I men- tensions... out of the AppStore, through Cydia, this
tion some techniques to protect myour devices, is like the Appstore for the rooted devices, although
and now Ill talk a bit more on this topic. its true that in the last versions this isnt available

12 07/2013
but there are still a lot of vulnerable devices, And
how can Hackers infect by Cydia? Very easy, the
apps from Cydia are installed by repositories, and
they are not revised, so, for it there would be nec-
essary to upload the app of the Trojan to Cydia and
convince the user to install it, for example, saying
that is a game.

Figure 7. Cydia Apps

Windows Phone
There is not much to say about this system, is very
new but, however recently it has been discovered
vulnerabilities in the Wi-Fi system that can allow
Hackers to gain access to users encrypted domain
credentials, but there isnt still specific malware to
this system.

Figure 8. Windows Phone logo

To finish the article, Ill do a reflection on what

has been said above.

Reflection
In this article we have learned many things about
the QR Codes, what are, and what theyre used
for, weve seen their different uses, and his dan-
gers, but the most important question that we have
to do to ourselves is; What benefit do I get by scan-
ning a code? Or What benefit do its supposed for
my company or business? Well, these questions
havent a clear answer, because many users dont
know them or dont know what theyre used for.
The utilities that have the QR Codes are great,
and we havent yet reached to know all them,
we are sure to expect great surprises from these
codes, but nowadays the QR havent big success
between the normal users.

Carlos Rodriguez Perez

www.hakin9.org/en
 THE TECHNIQUES

Hijacking
QR Codes
I am a joint US/UK national living just outside London. Do
I know much about QR codes? Well, more than most, but I
am not a programmer. That being said, I hold my own on
the technical side of the understanding. Im the one that did
all the QR codes for the London 2012 Olympics, contracting
directly with LOCOG (the London organising committee for
the Olympic Games).

W
ere at the heart of the first Mobile Olym- Direct codes
pics as they were called. We had just Performing a point-to-point movement of data, for
over 80 QR Codes in use dealing with ev- instance a code is embedded with the site infor-
erything from ticketing, brochures, and codes on all mation like that of www.guinness.com, which when
the mascots around London. By far, our most used scanned takes you directly to the Guinness web
code was the one that took you to install the Real site.
Time Results app, of which there were over 40M
downloads. This app for all major phone O/Ss gave Indirect codes
you every result in every sport within 2 seconds of Taking you to a server that then takes the user to
when it finished, gave you information about the a site that then takes them to another site base on
competitors, and a lot of other informative facts. It is the criteria within the packets of the data transfer.
by far the single most downloaded and effective ap- So, for instance Barclays Bank might offer person-
plication for any single event use, ever. al banking and publish a code in a daily newspa-
per. That code would be scanned by lots of differ-
Background ent people. Apple users want to be taken to the
The QR code system was invented in 1994 by server that gives them Apple software, and the An-
Toyotas subsidiary, Denso Wave. Its purpose was droid users to Android software, etc.
to track vehicles during manufacturing; it was de-
signed to allow high-speed component scanning. Partial Indirect Codes
It has since become one of the most popular types These are a highbred of the two allowing for very
of two-dimensional barcodes. Originally designed fast throughput of the data for consumer applica-
for industrial uses, QR codes have become com- tions (Figure 1).
mon in consumer advertising. Typically, a smart-
phone is used as a QR-code scanner, displaying Real use today, Mobile Engagement
the code and converting it to some useful form Today in Japan they are used much more than
(such as a standard URL for a website, thereby anywhere else in the world, and mostly in indus-
obviating the need for a user to type it manually trial applications. It is a technology that clearly
into a web browser). Today there are three types came out of the industrial sector to be used in
of codes in use: commercial applications. As such its primary ap-

14 07/2013
 Hijacking QR Codes

plication has become connecting consumers with black and white. They are boring and do not
brands via advertising and marketing campaigns. fit into modern media. For most, they are not
Connecting technologies primarily in use now are easily changed
QR codes, mobile sites, mobile apps, and aug- To use one you have to have a scanner, which
mented reality you have to download from any of the app
stores. Easy and simple to get, but requires
Why is the growth in this technology so personal intervention on the smartphone. In
slow? some small countries you might have one in-
cluded on your phone, but not often
Since the invention of the codes was for in- More than 90% of QR codes, even today,
dustrial purposes, 99% of them are plain take you to a companys normal web site that
would be viewed by a normal computer screen.
These are unreadable on a smartphone. If the
site is not mobile optimised people just dont
go to it.
Two companies are choking the market with
their artificial hold on the growth of the mar-
ket. In 1996 Denso made the technology open
source to all. Two US firms, Scanbuy and
NeoMedia have succeeded in patenting in the
US market various bits of the open source
technology and now charge extortionate fees
for anyone who uses them. Most particularly,
NeoMedia makes almost all its revenues by ex-
ploiting its stranglehold on the intellectual prop-
erty. Both firms only control this intellectual
property in the USA, but the USA is the mar-
keting capital of the world Scanbuy and Neo-
Media each have revenues of approximately
$3.5M USD, so not really very much. The total
value of all the companies doing all the work
(outside Japan) is not $25M/ year globally. As
such, a very tiny drop in the worlds marketing
budgets (Figure 2)

Is anyone doing it right?

Ironically, we have only found one company, Azon
Mobile (www.azonmobile.com) that offers easy to
build customer and colour QR codes and hooks
them up with real Mobile Web Sites for a very fair
price. You can change the codes and combine pic-
Figure 1. A real use of QR codes

Figure 2. The future of QR codes

www.hakin9.org/en 15
 THE TECHNIQUES

tures, logos and a myriad of other special effects and putting a code with it is easy. This prac-
right from their site (Figure 3). tice is known as attagging, a slang form of
attack tagging. They are easily created and
Where does it go wrong? can also be affixed over legitimate QR codes.
Most of the disasters with QR codes are self-im- Recently the new Google Glass glasses were
posed by the users and implementers found to be easily subject to malicious codes
and took a pair down with little effort.
If you use a direct code and miss-spell the Diversion tagging. On a smartphone, the read-
name of the web site, like Love Film did when ers permissions may allow use of the cam-
they launched in the UK market 2 years ago. era, full Internet access, read/write contact da-
A scan of the QR code in their brochures took ta, GPS, read browser history, read/write lo-
you to http://http://lovefilm.com. Try it your- cal storage, and global system changes. Diver-
self; you go to a page with an error404 mes- sions of indirect code servers can steer a code
sage. That did nothing but anger the people to the wrong place.
who went to the app store, downloaded a QR Greed tagging. Presenting an offer to consum-
code scanner, and then scanned the code all ers that is too good to be true. A scan of a QR
for nothing Not something you want to do code takes you to a site which draws down a
to consumers, word travels fast Weve seen lot of information about the phone and user.
dozens of examples of this. As with any normal computer virus it can link
Bad presentation as noted in point #3 above. to dangerous web sites with browser exploits,
The technology of QR is impossible to real- enabling the microphone/camera/GPS, and
ly secure, due to the fact that it is in the public then streaming those feeds to a remote serv-
domain and it is being read by a smartphone. er, analysis of sensitive data (passwords, files,
Smartphones are owned by consumers who contacts, transactions), and sending email/
insert SIM Cards into those phones, many of SMS/IM messages. Or DDOS packets as part
which come from a lot of dubious places that of a botnet, corrupting privacy settings, steal-
routinely hack malicious code into them. Un- ing identity, and even containing malicious log-
witting consumers insert them into the phones ic themselves such as JavaScript or a virus.
and get lots of results they hadnt intended. These actions could occur in the background
Malicious QR codes are ones deliberate- while the user is only seeing the reader open-
ly made to look legitimate, but when com- ing a seemingly harmless web page. In Rus-
bined with a permissive reader can put a sia, a malicious QR code caused phones that
phones contents and users privacy at risk. scanned it to send premium texts at a fee of
Pulling down a major brand from the internet US$6 each
Image translation. With a bit of reading of the
original Denso spec, you can see where each
part of the data in QR code resides. Any first
year graphics student can use Photoshop
to insert data in the code to change the data
in the code and send the user to a malicious
site. Then you get all the results in point #5-7
above
Curiosity Tagging: or as I call it, stupidity tag-
ging If you scan a code for no other reason
than the curiosity factor, then you get what you
get. The biggest risk is that people cannot con-
trol their curiosity, and end up facing severe
consequences. Just a few months ago a pro-
American hacker, Jester, was banking on this
when he decided to change his Twitter avatar
to a QR code to craft an attack.

In his blog, he said anyone who scanned the

QR code on his Twitter page was redirected to
Figure 3. Example of a QR Code a jolly little greeting via their default web brows-

16 07/2013
 Hijacking QR Codes

er on their mobile device on some free web host- If an attacker generates a QR code, embedding
ing. The greeting on the page featured the word this protocol with a factory reset service com-
Boo! directly below it. He claimed that he has mand; imagine what havoc it may cause. As soon
exploited the open source Webkit built into the as the victim scans the QR code, the tel protocol
devices default browser. This is the same vul- will be invoked, followed by the service command
nerability which was exploited in Mobile Rat, to reset the mobile phone, and thus youre entire
turning Android mobile into ultimate spy tool, settings and data from your device will be wiped
as was demonstrated at the RSA conference. in a matter of seconds. Detailed instruction about
This curiosity spawned the cat thing which went restoring deleted objects can be found in the mo-
on for five days without being noticed. During bile forensics course offered by the InfoSec insti-
these five days, the QR code was scanned near- tute. These kinds of malicious codes can spread
ly over 1,200 times and over 500 devices reverse though scanning a QR code, a catchy URL, near-
shelled back to the server on listening mode. field communication (NFC) sharing, etc. There
Tom Teller, a security evangelist at Checkpoint, are plenty of vulnerable devices; you just need
said It is a drive-by download attack, where a to find one.
user scans a bar code and is redirected to an
unknown website. Once the website is visited, Conclusions
the modified exploits will affect the system soft-
ware and additional malware will get deployed, QR codes were designed primarily for industri-
such as keyloggers. If you think this is the end, al use
you are wrong. Attackers have gone ahead with Growth of the use of QR which was only ev-
exploiting vulnerabilities on mobile platform by er a very small market, has primarily been con-
misusing the various protocols and invoking ser- strained by poor implementation and in the US,
vice set commands on the mobile device. This the two firms choking the market by protecting
approach is called a Telpic attack. Telpic attack their intellectual property as they see it
applies a similar technique, using a QR code as A QR code as such, is a one dimensional flat
an attack vector. As described in Tech Experi- image that is not by itself hack able, but there
ments, it is a malicious way of tricking an An- are many points of contact around it where it is
droid user into reading a QR code through a mo- easily compromised
bile camera redirecting it to malicious URL. This There is still a very bright future for QR codes
technique is not just limited to malicious URLs, if made graphically appealing and implemented
but also executing USSD or the Unstructured properly
Supplementary Service Data, which is a vendor-
specific command.

So where does it all lead??? David Allen

The possibilities are endless There are tons David is a joint UK/US citizen with a glob-
of service list commands, starting from display- al career in the IT business spanning over
ing the IMEI number to executing a factory reset 30 years in all phases of the business from
command. Google it and you will find plenty of the birth of the PC right through to the
service list commands for various platforms and most sophisticated mobile apps of to-
various models. These service list commands day. His most fun experience was heading
are executed by exploiting the vulnerability of the up the QR deployment for the mobile app experiences at the
tel protocol available on mobile platforms. You London 2012 Olympics. Over 80 codes were deployed in every
must have seen various mobile websites offer- venue and for every sport in the games. It set the standard for
ing call button option, and when you click on one all mobile enabled games in the future.
of those, you are redirected to the dialler of your dra01@btconnect.com
phone. Here is where the tel protocol is used to @mobileengage
call the number from the mobile phones dialler. www.mobileengage.co.uk
 THE TECHNIQUES

Qrcode a Real Threat or

Not?
Qrcode has been around since a quite long time and, from
time to time, they comes out as a vector of threats.
A QR (quick response) code is a two dimensional barcode
invented by the Japanese corporation Denso Wave in 1994.
Information is encoded in both the vertical and horizontal
direction, thus holding up to several hundred times more
data than a traditional bar code in a singular QRcode it is
possible to store up to 7.089 number or 4.296 characters,
binary (8 bit): up to 2.953 byte and Kanji/Kana up to 1.817
characters.

D
ata is accessed by capturing a photograph in all corners of the QR Code except the bot-
of the code using a camera or a scanner tom right one. Each pattern is based on a 3x3
(e.g. built into a smartphone) and process- matrix of black modules surrounded by white
ing the image with a QR reader software. modules that are again surrounded by black
The Qrcode has been developed in several sec- modules. The Finder Patterns enable the de-
tion where can be found data, sync pattern and so coder software to recognize the QR Code and
on. Generally speaking it can be divided into: determine the correct orientation.
Separators: The white separators have a width
Finder Pattern: The finder pattern consists of one pixel and improve the recognisability of
of three identical structures that are located the Finder Patters as they separate them from
the actual data.
Timing Pattern: Alternating black and white
modules in the Timing Pattern enable the de-
coder software to determine the width of a sin-
gle module.
Alignment Patterns (4): Alignment Patterns
support the decoder software in compensating
for moderate image distortions. Version 1 QR
Codes do not have Alignment Patterns. With
growing size of the code, more Alignment Pat-
terns are added.
Format Information (5): The Formation Infor-
mation section consists of 15 bits next to the
separators and stores information about the
error correction level of the QR Code and the
chosen masking pattern.
Data: Data is converted into a bit stream and
then stored in 8 bit parts (called codewords) in
Figure 1. QRCode I Use in my business-cards the data section.

18 07/2013
 Qrcode a real threat or not?

Error Correction: Similar to the data section, This way the user has not Idea about the real Qr-
error correction codes are stored in 8 bit long code content, but has to rely on the application
codewords in the error correction section. that read the code. In most of the case, think of
Remainder Bits: This section consists of empty a URL as an example, the application can redi-
bits of data and error correction bits cannot be rect directly the browser without any warning or
divided into 8 bit codewords without remainder prompt, this way the user can be directed to-
(Figure 2). wards some malware site.
The Qrcode can be found not only on elec-
Now the immediate threat of a QR code is related tronic form (Webpage, PDF document and so
to 3 main factors: on) but also on posters, newspaper and maga-
zine and any kind of advertisement, that make
The Qrcode itself is not readable in Human terms its exposure wider that usual infections vector,
and need to be translated by an application. and make easier to be tampered or modified.
The Qrcode readers usually do not include se-
curity features, besides the great number of
freeware Qrcode readers and generators avail-
able on the internet made quite easy to avoid
controls.

A concerning point is its easy to understand that

the way Qrcode transport data allows it to easily
hide any kind of info.
For example, we could easily create a related to
a malware infection, convert this URL through a
Figure 2. QRCode cannot be read by human but need a shortened URL service, associate it to a common
device able to capture a picture and a software to decode it in logo and embed this info in a QRCode (Figure 3).
order to read the data
A normal User would check the code through its
application and would find a familiar logo to click
on; although he would check the URL he would
probably see the short version that is anyway not
readable. Unless the user is using on its smart-
phone or tablet a security suite could be easily
fooled and redirected anywhere.
Point two is a sneaky point, since for its nature
QRcode are quite easy to be modified. Reason for
that is Qrcode has embedded Reed-Solomon er-
ror correction code. So even if tampered or par-
Figure 3. Qrcode can be generated from an URL or the
shorter version. When using a URL Shortener service we loose tially damaged the Qrcode reader is able to read
readibility of the URL address thous is easier to be redirected the modified Qrcode. The reason behind this be-
to a fake site haviour is simple, a printed code can lose colour,

Figure 4. A QRCode can be on a Advertisement in a crowded city street and watched by anyone with a smartphone

www.hakin9.org/en 19
 THE TECHNIQUES

not be in the perfect shape or position to be scanned, The second case means that the target of the
have dirty on the surface and the systems should be attack is the user device itself, to be able to moni-
able to detect anyway data. That makes it possi- tor, download malware or change configuration of
ble so modify the data area of the Qrcode and fool the device. We can again consider the risk relat-
the reader to deliver different data than the original ed to vulnerability that can be exploited or worse
ones. If you think that those codes can be printed the reader as a co component of the infection. This
on paper, posters and even T-Shirt is quite easy to way could be easy to think Qrcode as one of the
imagine how many ways to change the info exists main vector used to spread a botnet. We can think
(Figure 4 and Figure 5). You do not need to change of SQL injection, Command injections and so on.
any QRCode, just think to be able to modify an ad- The third case is the most commonly used, and
vertisement on a poster in a highly visible area, as the modified Qrcode lead the user to a fake site or
an airport, and you could attack a lot of users. And info, the best vehicle for phishing, pharming, fraud
believe me is not easy to see the difference be- or, generally speaking, social engineer attacks.
tween the original one and the modified one not us- The 3 areas are, as often happen in security,
ing a proper reading tool. Human eye is not the best mixed together in more sophisticated blended at-
tool to detect those modifications. tack that can leverage one or more techniques.

What can a Qrcode attack lead to? A real threat or not?

Taking into consideration the things discussed in All the things that have been discussed before just
the previous chapter is now easy to imagine how a showed us that Qrcode can be an efficient and ef-
Qrcode can be used as an attacking vector. fective vector of attack that it is quite easy to put in
I can divide the attack into 3 main areas: place. Now the question is if the danger is real and
how much we should worry about.
Third part hacking
Device\user hacking
User hacking

The first case is quite simple, we can assume that

the attacker does not want to hit the user whos
reading the QR code but want, instead, attack a
third part. Would be easy, as an example; insert
a SQL code into the URL data in order to perform
an attack on the destination site. We can imag-
ine performing SQL, Ddos and other kind of attack
this way, may be using a vulnerability of the qrcode
reader. On the other hand, as for point 3, the read-
er itself can be a part of the attack itself, so, for ex-
ample, it can use URL found on the QRCode to Figure 6. QRcode could simply make users to send request to
start a SQL injection and so on (Figure 6). a site even if the user does not this. if the users are enought we
could have even a DDOS effect (theoretically)

Figure 5. An attacker can simply change the qrcode or cover the poster with a modified one

20 07/2013
 Qrcode a real threat or not?

Its hard to give an answer at the moment, since SQRC is Densos variation of QR Code technolo-
analysis by security vendors start reporting the gy that allows users to encode both public and pri-
threat, so it is still not clear the actual extension of vate data where security and confidentiality is an
the problem. For sure users should pay attention on absolute requirement. While a SQRC Code looks
what kind of Qrcode readers are using, trying to use just like any other QR Code, SQRC codes con-
software coming by trusted source. The rest of the is- tain two additional data components. The first is
sues are common to the ones related to the browsing the private data which is protected by the second
activities, so the usual antimalware and web security component which is a password (Figure 7).
options should be effective. QRCode are still far to be Only a specific scanner, which is with the same
widely appealing as other infecting vectors are more setting of the encryption key that is set with the
immediate, so its hard to see a quick expansion, we SQRC is made can read SQRC. The SQRC con-
should also consider that not all geographic areas sists of mixed public data and private data (data
are so QrC-addicted. QRCodes were born in Japan encryption key). Scanner that supports the SQRC
QRCode found a great diffusion in Japan, Korea and is able to read both thepublic data(e.g. persons
closest areas. Widely used in Europe as well are less name) andprivate data(persons age, health de-
commonly used in USA. tails and identification number). The security QR
code has the same figure as normal QR Code and
Protecting tips only the public data can be read as QR Code by a
QRcode are a smart and efficient way to transport general scanner.
information, and can be really useful to make easy
to people to reach website, promotions and so on. Remarks
Marketing is the perfect user for this technology. But SQRC Encryption Key is of 8 bytes in size. The
how we can protect ourselves? Its quite simple: generator (software) will specify a unique encryp-
tion key for each set of SQRC is generated, while
End-User the scanner is able to specify max. 8 SQRC read-
only encryption key.
Use a QRC Reader coming from a trusted
source Table 1. QR Code v.s. SQRC
Verify if the QRC reader has a minimum set of Features QR Code SQRC
security issues as the possibility to check the Code Type
URL before running.
ISO Yes (ISO/IEC No
Use a security tool in your smartphone-tablet- Standardization 180004)
computer to protect you from unwanted and
Security Function No Yes
malicious activities.
Data Capacity Numeric: 7,089
characters Alpha
numeral: 4,296
Publisher characters Binary
(8 bit): 2,953
characters
Use a trusted QRC generator
When possible suggest a trusted QRC reader Readabliity Yes
Check the result both online and printed to see Durability Yes (Max. 30%)
if everything work fine before wide spreading it.
Antonio Ieran
Antonio Ieran is an IT professional, market-
What next? ing specialist, and tech evangelist with over
Meanwhile something is moving on the market, it 16 years of experience serving as a commu-
starts to appear the so called Secure QR Code or nity liaison, subject matter expert, and high-
SQRC. profile trainer for key technologies and solu-
tions. Mr Ierans experience includes acting
as the public face of Cisco security technolo-
gies; leading pan-European technical teams in development of
new Cisco security products; and serving as a key public speak-
er and trainer on behalf of new high-tech products. His expertise
spans IT development and implementation, marketing strategy,
Figure 7. Security QR Code legal issues, and budget / financial management.

www.hakin9.org/en 21
 THE TECHNIQUES

QR Codes: Convenience
or Minefield?
Imagine that you are walking in the street in the town
where you live. You need to find a new place to live, and
dont really want to use an estate agent, because they
usually lie about the places they have available, and charge
a commission too. But you pass a tree with a sheet of paper
stapled to the bark, reading beautiful two-room apartment,
lots of light, modern kitchen and bathroom no agents.

I
n the past, that home-made ad would probably
have had a telephone number for you to call.
But this one continues scan QR code for de-
tails. So you scan the code, and hope that your
smartphone will immediately show you a web page
with photos, details, and a contact telephone num-
ber or e-mail. What you had expected was some-
thing like this:

Figure 2. Fake QR code

This translates into an SMS message go daily

quiz that your phone will send to the local cell-
phone number 050-999-9999. But the number
Figure 1. Real QR code
may easily be a premium-rate SMS or phone ser-
which when decoded by the QRcode app on vice, and you end up being defrauded through a
your phone translates to http://www.greatapart- bloated cellphone bill. And of course, if there re-
ments.com/london (for the sake of argument), and ally is a phone quiz that sends you new ques-
you see what you were expecting. tions every day, you may end up being tempted to
But what if the code were actually this one, spend even more money trying to win some non-
without you realizing it?: existent prize.

22 07/2013
 Worse still, what if the code is this ones:

Figure 3. Fake QR code hacking the data

This sends your cellphones browser to the ad-
dress http://hackmylaptop.com, where the web page
looks like a real advertisement for an apartment for
rent. But the photos of the living room and kitchen
have been doctored to hide a piece of malware that
is automatically downloaded into the phones mem-
ory when you open the page; and next time you
synchronise the phone with your computer to down-
load photos you have taken, that malware transfers
itself to the computer alongside the legitimate con-
tent, and then calls home to a control site, in order
to download additional malware that hacks into your
bank account, or steals your credit card details, or
turns your computer into part of a botnet that ends
up being used for DDOS attacks. Or, for that matter,
the drive-by malware that you unknowingly down-
loaded inside the photo turns out to download addi-
tional man-in-the-middle malware that steals money
from your bank account every time you log on to
carry out legitimate transactions. And if the phone is
synchronized to a corporate network, which is more
and more common, then the entire network can be
compromised by an unsuspecting employee trying
to use a QR code to get access to what he or she
things is a perfectly innocent web page.
These are only two types of potential scenarios
for a security issue that is becoming steadily more
common with the spread of QR codes across al-
most every type of printed media, and even the In-
ternet. There is no question that these codes an
extension of the much older barcodes are use-
ful to anyone, whether individual or business, who
wants to attract web traffic or just make it easier for
others to make contact. More and more business
cards have a QR code printed on them so that you
can just scan them instead of typing the contact de-
tails into your phones contact list. Newspaper ad-
vertisements include QR codes so that you can go
straight to the right information page without having

www.hakin9.org/en
 THE TECHNIQUES

to type the URL on a small and fiddly keyboard. A rus software, even though that is only a partial se-
QR code can point to an instant download of an au- curity solution. By contrast, far fewer smart phone
dio or video clip or full-length recording. Even exclu- owners understand that they also need to install
sive banking services, such as Switzerlands UBS security software; and even then, there is a small-
private banking, have QR codes on their newspaper er selection of security software for all the different
and magazine advertising, both to make it easier for operating systems. Only a very few, more sophisti-
potential clients to access their web pages and to cated, users realise that carefully-written malware
show that they, too, are part of the modern high-tech can instruct Android phones to open up root access,
world. In short, almost every kind of information that which essentially allows hackers to get remote con-
marketers want to get in front of their public is be- trol of the phone. Even fewer users know that mal-
coming accessible through QR codes. ware is available to enable hackers to use smart
But this convenience carries risk. Part is because phones as bugs to listen in remotely to conversa-
of the inherent opacity of QR codes you dont tions: this is one of the reasons why many govern-
know what information is actually hidden behind ment offices insist that both visitors and staff leave
the code, whether a URL for a normal web site, or their cellphones at a security checkpoint (the other
one hiding drive-by malware, or one that looks like risks, of course, include people photographing sen-
your real banks site but is really a replica designed sitive documents, whether or not they then send the
to make you input your account number and pass- photos immediately or just use them after leaving).
word so that a fraudster can steal your money; And although some apps do exist that will show you
whether a legitimate telephone or SMS number, all the tasks running on your smartphone, which
or one for premium services that defraud you, at could be a clue that something unwanted is hiding
least until you get a nasty surprise in your next bill. in memory, they are less easily available than Win-
This inherent opacity also means that fraudsters dows Task Manager on PCs.
can take advantage of legitimate QR codes print- So are there solutions? The most important is
ed, for example, on advertising posters for con- simply education: the technology journalists re-
certs, shops and restaurants at bus stops or rail- viewing new smart phones, apps and services al-
way stations: it takes very little work for criminals to so have a duty to remind the public that all the cool
print stick-on labels with QR codes that direct the new technology carries risks, and that there are
publics cellphones to completely different servic- ways to protect against them. In particular, every
es, and stick them on top of the original code. You smart phone user needs to install security apps
wanted to book tickets for a rock concert? What that protect against malware, and of course keep
you got instead was a piece of malware that will them updated. Network operators should also play
empty your bank account, and you only find out a role in educating their users about the risks, and
when its too late that the QR code that even has should be obliged by communications regulators
the rock groups logo designed into it actually di- to block access to premium phone and SMS ser-
rected you to www.evilwebsite.xxx. vices as a default setting. But the programmers
This risk is made worse by the nature of smart and software companies that publish QR code ap-
phones and their operating systems, and it doesnt ps can also play a very important role: instead of
really matter whether they are iPhones, Androids, giving instant access to whatever service the QR
Blackberries or anything else, although most secu- code conceals, they should automatically pop up a
rity experts regard the Android as the least secure screen that asks the user to confirm access to that
system. Part of the problem is that the size and res- service: if you think that youre just saving time by
olution of smart phone screens make it more difficult scanning the code for www.realbank.com, and the
to see if the web page you landed on after scanning QR app asks you do you really want to access
the QR code is actually the one you expected. An- www.fakebank.com?, then you are much less
other part is that, unlike Internet-linked computers, likely to end up with an empty bank account and a
cell phones can connect directly to premium servic- lot of headaches.
es, whether you expected it or not. Most importantly,
the level of security against malware of every kind David Nordell
is much lower than on laptop or desktop comput- David Nordell is CEO of New Global Mar-
ers, even though most modern smart phones are kets, a start-up developing solutions for
really miniature computers in their own right with far financial crime intelligence and compli-
more processing power and memory than PCs had ance, and a consultant on cyber security.
only a couple of years ago. Most PC owners real-
ize that they need to install at least some anti-vi-

24 07/2013
 THE TECHNIQUES

QR Codes Hacking,
Cracking and Other
Security Considerations
Fear and uncertainty are running deep in the QR Code
space regarding the possibilities of data hijacking, hardware
manipulation or other malicious attacks on mobile devices
delivered by way of QR Codes. Can a QR Code really be
cracked or hacked in such a way as to do this kind of
damage? Lets talk...

T
he popularity of QR Codes in North Amer- position regarding protection from such attacks.
ica continues to grow at an incredible rate The antivirus software industry now had its first
as these 2D bar codes become increasingly truly legitimate example of the need for antivirus
more popular with marketers, advertising agencies software. John McAfee was well on his way to
and name brand companies, all of whom want to making millions.
deliver revenue generating data into the hand held No such awareness exists in the mobile and
and mobile spaces. According to ScanLife (http:// hand held spaces, making these hardware envi-
www.scanlife.com/blog/2013/02/qr-code-adoption- ronments ripe for the picking by those that wish to
2013-trends-and-statistics/) 1 in 5 Americans have inflict harm, steal data or attack a device for some
scanned a QR Code in 2013. This figure is actu- other malicious purpose. People simply dont have
ally a drop in the proverbial bucket considering that the same awareness of the potential of attacks on
America is still just over 50% saturation with smart these devices as they do with their personal com-
phone or tablet devices. There is no doubt the use puters and the bad guys are exploiting that to their
of QR Codes will continue grow dramatically over own advantage.
the next several years and this one fact is the key We dont see this kind of media coverage any-
ingredient to similar growth of malicious attacks more when it comes to malicious computer hacks.
delivered through QR Codes. They just arent news worthy. Everyone is too busy
downloading apps, email and other instant gratifi-
Ignorance of the problem cation events onto their mobile devices without giv-
On March 6th of 1992, the world waited for the ing a second thought to the potential risks. For the
Michaelangelo Computer Virus (http://abcnews. moment, at least, no one has really been bitten by
go.com/Archives/video/march-1992-computer-vi- a truly malicious attack in the mobile space. That
rus-scare-13056853) to strike hundreds of thou- reality has lured us into a sense of complacency
sands of computers across the planet. The threat where we think it will never happen to us, but we
was so great this one computer event received do believe that if it does happen, it will happen to
massive and widespread media attention in vir- some one else. This ignorance of the problem is
tually every industrialized country. Ultimately, the further exacerbated by the fact there are only a
virus did little actual damage but its media cover- hand full of operating systems running on these
age frightened the world into a more pro-active devices. A crafty hacker only needs to write one

26 07/2013
 Hacking, cracking and other security considerations

set of code to cause a widespread problem. Deliv- cific functionality directly into the hardware of the
ering a virus to a mobile device through email isnt scanner. Keep in mind DENSO is the inventor of
a big problem, just at the moment, because anti- QR Code technology so it makes perfect sense for
viral apps for these devices are becoming more them to directly incorporate hardware access with
available. This is not to diminish the possibility of QR Codes. In DENSOs case, its a feature and not
emails delivering a virus or Trojan horse. Its just to an exploit of a weakness in the hardware or OS of
say that this hasnt been a critical issue until now. a particular device, as was the case in the Google
That will change. QR Codes however, have direct Glass issue.
access to the hardware on these devices, thereby You must keep in mind there are three absolute
making QR Codes exponentially more dangerous conditions in the world of QR Codes that you sim-
as a potential delivery vehicle for a malicious at- ply can not control or impact in any way whatso-
tack. Its exactly like leaving your personal com- ever. You cant control the device being used to
puter, turned on and logged in, on a busy street scan your code, the OS on that device or which
corner. Having direct access to the hardware is in- reader app is being used. All three of these indi-
deed the key issue. This can not be overstated, vidual conditions have their own unique behav-
QR Codes have direct access to the hardware and ioral characteristics. These three conditions, as
this is a HUGE problem. variables, yield millions of possible conditional
opportunities that can indeed be exploited to do
Hacking the Hardware harm in the mobile space. OS updates will hap-
Standard UPC codes are based on a table of da- pen much more often in the future specifically to
ta which provides some form of unique identifica- prevent these exploits. As an example; scan this
tion. These codes describe something but they code on this device running this OS and using this
dont necessarily cause an action to be taken by particular app and you will get result A. Scan the
the hardware unless that specific functionality is al- same code on the same device but with another
ready built into the hardware. The hardware does reader app and you will get result B. By simply
something specific because that specific action is changing a function in the OS and this problems
programmed into the hardware. The code itself is goes away. Again, the potential combinations of
not necessarily the trigger of that action. exploits are virtually limitless. They are simply
QR Codes are very different in that they do in- waiting to be discovered by smart people that
deed trigger specific hardware and software ac- want your information.
tions on a mobile device. Scan a code and get a And therein lies the true nature of the problem.
browser to launch and populate the URL address. A smart hacker can create a QR Code that ex-
Scan a code and get vCard data for your address ploits a specific weakness in the OS running on
book. Scan a code for a map and see that location the hardware. Such exploits could include things
on your screen. All of these actions are actually like surrendering access of your contact database
triggered by the code itself making QR Codes the to a hidden URL, invisibly tracking your move-
key to the door for those wishing to steal data, in- ments through on board GPS, keystroke duplica-
flict harm or damage a device. tion, installing a Trojan, phishing or even grabbing
One such example targeted the much sought af- up your financial and credit card information. The
ter Google Glass technology in July of this year. sky is the limit!
According to an article in Forbes Magazine (http:// It isnt a question of will it happen, its a question
www.forbes.com/sites/andygreenberg/2013/07/17/ of when. With more and more internet bandwidth
google-glass-hacked-with-qr-code-photobombs/) being consumed by mobile devices it is simply a
researchers at the security firm of Lookout Mobile matter of time before the first real and dangerous
were able to create a QR Code that actually repro- hacks will appear through QR Codes that cause
grammed the Google Glass hardware itself! This widespread damage.
was accomplished by exploiting the method that
Google Glass used to captured an image of a QR The Anatomy of a QR Code
Code. One small loophole and the hackers jumped Let me cut right to the chase. A printed QR Code
right through it. is virtually impossible to hack, at least in the
DENSO Wave Inc. of Japan also uses the same sense of taking an existing QR Code and moving
approach to program its huge variety of bar code its modules around to get the code to behave in
scanning devices. In the box with your DENSO a way not originally intended. To the best of my
scanner is an instruction book that contains doz- knowledge, there is no scanning app that will tell
ens of QR Codes that are used to program spe- you which modules in a specific code are respon-

www.hakin9.org/en 27
 THE TECHNIQUES

sible for any one character. The thought being that Three Elements of Hijacking Part One
a hacker would want to re-arrange the modules Covering a code
of a deployed QR Code to their own specific re- Again, once printed, changing the operation of
quirements. Keep in mind that QR Codes are ba- a QR Code by manipulating modules within the
sically ink on a substrate so hacking or crack- printed code is nearly impossible and not at all
ing them on a wide spread scale isnt a practical an efficient option for hackers. The only way to
consideration. The only efficient and effective way have a direct effect would be to completely re-
to alter an existing, printed QR Code is to cover place the valid QR Code with an invalid code
it with another QR Code that has alternate intent. through the use of a sticker! This would be very
This would be impossible to do in any wide spread impractical from a hackers perspective because
print distribution like magazines, news papers or of the sheer volume of single codes that would
direct mail pieces. That being said, some of these need to be replaced. I therefore submit that a QR
codes are still vulnerable to being re-routed be- Code in a magazine advertisement, when con-
cause of the URL shortening engine that was used nected to a name brand that is accountable, is
to embedded a web destination into the QR Code. most likely very safe to scan. I would say the
More on short URLs in a moment. same for newspapers, direct mail and other
mass distribution systems. The only exception
here is that I personally would not scan any QR
Code in the personals section of any magazine
or newspaper or a QR Code that is printed in
some other format that is singular in its nature.
For example, a QR Code in the personals sec-
tion, a one off code in the income opportunities
advertisements or anywhere else that the code
is not backed up with name brand recognition
and direct accountability.
All of that being said, what are the conditions
under which a QR Code can be easily replaced?
Here are some examples. Movie posters with QR
Codes are commonly distributed. I personally
wouldnt scan one unless its in the window of the
theater and behind glass. The vast majority of QR
Codes at bus stops are perfectly legitimate but I
wouldnt scan one unless I could run my fingers
over it to be sure there isnt some sort of sticker
in place. I think you see where I am going with
this. Any QR Code in a public space, at eye level
can easily be covered with a malicious QR Code.
If the code is not under a cover of some sort and
can clearly be identified as an integrated part of
the total distribution, I just wont scan it. Keep in
Figure 1. Anatomy of a QR Code Courtesy DENSO Wave, Inc.
mind however, that I am enlightened. The same
cannot be said for the vast majority of QR Code
Once printed, how does one change a specific consumers and that is where bad people have a
module from black to white or white to black? Its wide open target.
simply not a practical consideration so I believe that
we really dont need to worry about our QR Codes Hijacking Part Two URL Shorteners and
getting hacked or cracked. I believe that we ab- Redirection
solutely must worry about hijacking of QR Codes This is the one that frightens me the most and that
where a malicious code replaces a good one. Where is having the URL encoded into the QR Code high-
hijacking means fraudulent data base manipula- jacked to resolve to a different destination. In terms
tion of the short URL. Where hijacking means tak- of URL access there are two different types of QR
ing a branded QR Code, by its nature believed to be Codes, direct and indirect. Direct QR Codes arent
safe, and replacing it with another similarly branded a potential problem because the absolute final des-
QR Code with malicious intent. tination URL is in the code itself. If you are in con-

28 07/2013
 Hacking, cracking and other security considerations

trol of the domain, then you are in complete control cial media are a standard and virtually all the exist-
of the URL you put into your QR Codes making ing URL shorteners came to exist strictly because
hijacking of the URL impossible. That is both good of the specific social media needs and require-
and bad. Its good because you are in direct con- ments. None of these engines have contractual
trol of the URL embedded in the QR Code. Its bad agreements for data privacy, none of them guar-
if the URL is very long which would yield a larger antee their uptime, and not a one of them can ab-
and more dense QR Code. The greater the density solutely keep your private information concealed
(more modules) of your QR Codes the greater the from the public at large.
likelihood of a failed scan. This goes back to the On top of that, many of these URL shortening
three conditions in the QR Code reality you cant systems are hosted through off shore servers
control. Its a best practice to have the lowest pos- that are under the control of foreign governments.
sible density in a QR Code for the greatest likeli- One of the most popular URL shortening services
hood of a successful scan on the widest possible in North America is hosted in the .LY Top Level
variety of devices. Domain (TLD). The .LY domain is the exclusive
Indirect QR Codes have their advantages and property of, and is under the complete control of
their potential issues. An indirect QR Code will the Government of Libya! Would any self respect-
contain a short URL so that there will be less data ing entity in the free world want their data pass-
to be embedded into the QR Code and therefore, ing through and residing on servers that are in the
you will have a much lower density QR Code. Low hands of the Government of Libya? Other URL
density is a lowest common denominator consider- shortening services are based in TLDs owned
ation for insuring that QR Codes are successfully by Greenland, Turks and Caicos, Montenegro
scanned as often as possible. and other countries, some of which may not have
Short URLs point to a database that contains the the best relationship with the government of the
long URL. For example, http://goo.gl/AbC123 (not United States. Americans are up in arms over the
a real URL) might redirect, through that database, National Security Administration (NSA) possible
to a URL that would be much longer, like http://my- reading their emails or listening to their phone
fantasticwebsite.com/firstdirectoy/seconddirecto- calls. Yet many of these same Americans are us-
ry. Obviously this second URL example would re- ing off-shore URL shorteners, allowing their data
quire a much more dense QR Code, reducing the to pass through the hands of foreigners, and they
likelihood of that code to be successfully scanned. do so out of ignorance and without giving it a sec-
Another advantage of short URLs is the oppor- ond thought.
tunity to have a QR Code run through an analyt- Using these off shore URL shortening services
ics engine that ultimately redirects to the clients is a substantial potential breach of security of truly
desired final destination. These engines can de- epic proportion. Your audit trail is gone, there is no
liver exceptionally robust information about the chain of custody that can be documented and you
scanning performance of the code. Things like are complete exposed to the wishes and desires
GPS based, opt-in location services, mobile of others. Here is a potential scenario. You are a
page drill down, accurate measurement of the manufacturer of a nationally distributed, prepack-
performance of conversion pages and many oth- aged food product. Your marketing team decides
er important measurements. The mobile space is to put one QR Code on the spine of 70 million box-
an entirely new reality with its own amazing and es of your product that will be deployed on grocery
unique statistical opportunities. Many of these store shelves across the country. That marketing
dedicated QR Code analytics engines are incred- department doesnt investigate QR Codes deep-
ibly sophisticated, most are very much misunder- ly enough and they elect to use one of these off-
stood and they deliver analytic results that far shore URL shortening services. Because there are
exceed the capabilities of other, more traditional now 70 million iterations of a single QR Code, an
analytics solutions. enterprising hacker now is very interested in hav-
So here is the definition of URL shortening is- ing some fun and he cracks the database of the
sues as they relate to QR Codes. Virtually every URL shortening service. Suddenly, this one QR
publicly accessible URL shortening service on the Codes is redirected to a porn site or, worse yet, the
web came to exist as a result of the needs of social new destination eats your phone for lunch. All that
media. If Twitter limits Tweets to 140 characters, remains is to hire a lawyer because someone is
wouldnt it be nice to have a short URL deliver to going to sue you, count on it.
a longer URL, leaving you more characters to per- Here are some tips regarding URL shortening
sonally address in your Tweet? Short URLs in so- engines and how they relate to QR Codes.

www.hakin9.org/en 29
 THE TECHNIQUES

Dont use any URL shortener that is free and as an example to help make the point. The method
open to the public. You dont have a contract I will describe here is used all too frequently and is
with them, you have no idea who they are and a wide open invitation to hackers and scam artists.
their existing Privacy Policies and Statements Branding a QR Code in the following way is not a
will not say a single thing about keeping your good idea, it doesnt achieve any degree of secu-
specific information out of prying eyes. rity and its a giant greeting card inviting hackers to
Dont use a URL shortener that is hosted attack an entity and its precious brand.
through an off shore Top Level Domain. If you Figure 2 is a typical sample of a branded QR
do, you deserve whatever happens to you. Code. The method used to include branding art-
If you cant get a contract that defines security work here is a method that exploits the native
with them, dont use them. Error Correction Code (ECC) of QR Code tech-
Only use short URLs that are created for you nology. ECC is a technology that allows physi-
by the company that is generating your QR cally damaged QR Codes to remain viable re-
Codes. Even then, make sure their shortening gardless of the actual amount of damage to the
engine lives on the same servers as their ana- code. ECC is a native feature of QR, its cant be
lytics tool and their QR Code generator. turned off and it does allow for up to 4 different
Dont want to work with any one company to user defined levels of damage protection. The 4
get your QR Codes? Thats fine. There are ma- levels of ECC are L for Low, where up to 7% of
ny URL shortening scripts out there for you to the code space can be damaged and the code
download and run on your own server where will still scan, Level M for medium, which cor-
you are in control of security. rects for up to 15% damage, Level Q for Quar-
tile, up to 25% damage and finally, Level H for
Hijacking Part Three Branded, QR Codes high that can recover a QR Code with up to 30%
are Not What You Might Think damage. Level L is the default for all codes and
Branded QR Codes, codes with logo artwork as the other levels are user facilitated in the QR
part of the code, have long been thought of as a Code creation engine.
way to transmit a sense of security and comfort to
the person about to scan the code. Many organi-
zations have deployed such codes in an attempt to
link a code to a particular brand with the intent to
imply value, integrity and security.

Figure 3. A Counterfeit QR Code with Unique Branding

Identity

Now that you have a basic understanding of

Figure 2. A Legitimate QR Code with Unique Branding ECC its easy to conceive a process to brand a
Identity QR Code. Simply ratchet up your selected ECC to
Level H and put in your logo making sure that you
Here is an example of a branded QR Code. dont obscure or damage more than 30% of the
Yes, its from my company but I am only using this entire code space and you are in business.

30 07/2013
 Hacking, cracking and other security considerations

Here is the problem with this approach. People ISO:18004 Compliance A Legally
scan branded QR Codes because they perceive Defensible Position
some sense of comfort in doing that. A bad guy can LogoQ isnt the only software out there that can do
create his own QR Code, drop your logo into it and this with a logo. It is, however, the only software
have the code resolve to a destination of his own out there that can do this and produce a QR Code
choice. That counterfeit code transmits the same that is fully compliant to the ISO:18004 specifica-
perception of safety, in that the QR Code appears tion which governs QR Codes. So what does ISO
to be created by a responsible entity. These coun- compliance have to do with malicious QR Codes?
terfeit codes extend the same invitation to scan the Its about the law.
code. Figure 3 is an example of such a counter- Many years ago McDonalds never envisioned
feit QR Code. At first blush its difficult to see any getting sued over a cup of hot coffee spilled in
difference at all between the legit code and this the lap, but it happened and McDonalds paid up.
one. There simply is no visual indication this is a There are countless examples of how people are
code you shouldnt scan. Quite the opposite ac- suing for unbelievable reasons because America
tually happens, especially if your logo is a highly is a very litigious society. If your QR Code is in-
recognized name brand. Scan both codes shown tended to point to a product mobile page but it ulti-
here and see what happens. I promise, this is only mately points to a porn site, guess what, call a law-
a demonstration and nothing will happen to your yer, you are going to need one. Some might say
data or your device. that this belief is paranoid. I prefer to believe it is
professionally responsible, especially when deal-
ing with name brand clients.
Being able to prove that a particular QR Code
did not come from you might be an important
thing if you get sued. DENSO software applica-
tions are the only apps that have a direct and un-
disputed link to the ISO specifications. This isnt
a sales pitch, its a fact. ISO compliance is a topic
worthy of its own article so I will just say that if
you are about to deploy a mission critical QR
Code campaign, this is something you might want
to think about.

The Bottom Line To hack or not to hack

isnt the question
There is no doubt that consumers are going to
have to deal with potentially dangerous attacks
through QR Codes. Marketers, agencies, corpora-
tions or any other entity that deploys a QR Code
for the general public to use has a responsibility to
do everything they can to insure the safest possi-
ble scanning experience. They also have to cover
Figure 4. A Branded QR Code Using DENSO Waves LogoQ their own back sides as well. This problem certain-
ly shows all the signs of getting much worse before
There is a solution to this problem that is very it gets better. So, what can be done to help reduce
unique. In the above samples the logo obscured the risk and not become a victim of a malicious
or replaced a set of modules in the code. This is QR Code? Here are my top 10 tips, tricks and best
only possible because of ECC technology, any- practices to consider.
one with a copy of Photoshop can make this hap-
pen. Figure 4 shows a branded QR Code that Never scan a QR Code if its surrounding con-
was generated through DENSO Wave software tent even remotely appears to be questionable
called LogoQ. Using LogoQ, the logo doesnt ob- or otherwise suspect. Avoid codes in personal
scure any portion of the code at all. In fact, the advertising, codes in public places that appear
logo is now an integrated part of the code itself, to be one-off deployments or any other situa-
making these types of QR Codes exceptionally tion that makes you think twice. Never scan a
difficult to counterfeit. code because its just there.

www.hakin9.org/en 31
 THE TECHNIQUES

The reader app on the device is the door and For the moment the QR Code industry doesnt
the QR Code is the key that opens that door. have a unified trade association so there isnt a
NEVER use a reader app that automatically single source to contact for information. If you
executes without user feedback. For example, do indeed come across or scan a malicious
if the reader app immediately opens the brows- QR Code, please report it to someone! You
er and connects to a URL upon successful- can do this through various QR Code groups
ly scanning a QR Code, without a confirmation on LinkedIn or through QR Code providers on
click from the user, dont use that app! Any- FaceBook. You can even send an email to an
thing automatic is a disaster waiting to happen. existing QR Code provider in the hope they will
Dont install the first reader app you find that is bring this to the attention of their peers.
free. Do some comparison shopping, read cus-
tomer reviews and check out their web sites. Is the potential of a bad QR Code a deal break-
The more you know about the app the less er? For some it might be, but I wouldnt look at it
likely your are to become a victim. Additional- that way. Arguably, there is no such thing as a per-
ly, carefully check all the default setting of the fectly secure web site or an online database, an
reader app immediately upon installing it. If you email address can easily be spoofed, and, with
are installing a reader app that requires you a little practice, I can open an automatic garage
agree to its licensing terms, as a general rule, door without knowing the code. In this digital world
dont install it. Unless of course you are willing there will always be dangerous vulnerabilities and
to take the time to fully read and understand those that wish to exploit them for their own bene-
the license agreement. If you just accept the fit. QR Codes are no exception. If you deploy QR
agreement and continue with the installation, Codes do your homework. Be prepared to deliv-
you will have no idea of what you have agreed er a valuable and positive experience as well as
to and this could be dangerous. You could be learning how to protect yourself from frivolous liti-
giving permission to background processes ini- gation. If you are a rabid scanner of QR Codes you
tiated by the reader app that you might regret. shouldnt scan every code you see just because
If an OS update becomes available for your de- its there. From any perspective its like everything
vice, install it. else in life, a little common sense goes a long way.
Do some research to find out if your QR Code
provider uses short URLs. If they do, question V. Michael Balas
them and make sure they arent using one of Michael has worked with consumer elec-
the free shortening services. tronics and personal computers since he
There is no such thing as a free QR Code that was old enough to understand that putting
has a URL redirect associated with it. Provid- a key into an electrical outlet was a bad
ers of analytics services rely on redirects but thing to do. He spent more than 25 years
that would be a service you pay for. If you cre- in the personal computer industry, culmi-
ate a QR code at one of the free sites, and that nating with a long stretch with Apple Com-
code has a URL that is just the first hop in a re- puter as a Business Development Executive
direct, DONT USE IT! based in the American midwest. After leaving Apple in 2002,
You might think that branding your code by ex- Michael started an entrepreneurial career and has founded
ploiting ECC is a good idea. Please trust me three successful companies. Two of which are in the video pro-
on this, it isnt. I absolutely recommend brand- duction industry and his third, VitreoQR, LLC, is rapidly achiev-
ed QR Codes, just find those professional that ing leadership recognition in QR Code knowledge and exper-
can help you execute correctly. tise. In early 2011, VitreoQR was the very first company to be
Again, as a general rule, I recommend that you awarded a sales and support contract (http://www.business-
should not let your reader app send push notifi- wire.com/news/home/20110224005472/en/DENSO-Appoints-
cations to your device. The same can be said for VitreoQR-Sales-Support-Partner-QR) in the QR space from DEN-
web sites that are delivered to your device through SO Wave, the inventors of QR Code technology. In June of 2013
QR Codes. Due diligence is expected here. the contract was extended for another three years. The new
You should activate and use all the securi- contract also includes a licensing agreement that gives Vitreo-
ty features available on your specific device, QR unprecedented access to a very a substantial library of DEN-
especially any security feature that is unique SOs QR Code patents and technologies, making VitreoQR an
within any app you have installed on your de- exceptionally unique company in the global QR Code space.
vice. Many of these features can help keep
your data secure. QR Code is a Registered Trademark of DENSO Wave, Inc.

32 07/2013
 THE TECHNIQUES

6 Ways To Protect
Yourself From QR Code
Hacking
In todays fast moving times, getting information and
content instantly at our figure tips has become an
increasing necessity. Because of this, Quick Response (QR)
codes continue to be the biggest driver of print to mobile
activations. When scanned, the codes often contain web
links that automatically take a user to a website.

O
ver the last few years, the practice of plac- contacts, credit card, Facebook and GPS infor-
ing this type of matrix barcode on bill- mation as well send SMS messages to premium/
boards, posters, clothing tags, concert tick- paid numbers. These kinds of attacks are just the
ets, business cards, TV ads and magazines has beginning of more sophisticated and problematic
become common practice. According to ClickZ. ways attackers can infiltrate your mobile device.
com, QR scans saw an increase of 400% between In late July, there were reports of Google Glass
June 2011 and June 2012. But while advertisers being hacked. Many functions on Google Glass
have seen this as a great opportunity to provide are actually activated by reading QR codes. Marc
information and content about their services and Rogers, Principal Researcher at the Lookout Mo-
products, cybercriminals see this as an opportunity bile Security, discovered the vulnerability. He no-
to exploit an unsuspecting and uninformed mobile ticed that the camera automatically identifies QR
user base. codes and uses them to trigger WiFi connections
In order to utilize QR codes, all you need is a
smartphone with a camera and a QR reader appli-
cation to scan the code. When the code is scanned,
you are redirect to wherever the QR code creator
has designated. This is obviously a convenient
way to get people engaged with content. However,
the huge downside is that you never know where
you will be redirected until after you scan the code.
Just as users must be careful as to not open emails
from an unknown sender, users must also be care-
ful when scanning QR codes.
Over the last few years, there have been hun-
dreds of reports regarding cyber attacks due to QR
codes leading users to websites that automatically
download malicious software and various types of Figure 1. Be careful what you scan. Source: http://www.
malware. Downloading these applications has al- goegi.org/goegi-web-design/mobile-web-design/the-need-
lowed these cybercriminals to steal your calendar, for-qr-codes/

34 07/2013
and other background operations. By hiding mali-
cious QR codes in images, Rogers was able to get
Glass to connect to a compromised network, show
details of all network traffic from Glass, and even
take full remote control of the wearable device.
Luckily, there are simple (and free!) things that
you can do that can help you prevent your device
from being hijacked (Figure 1).

Ignorance Is NOT Bliss

Not all QR codes are built with the best intentions.
Understand that there are risks to scanning a QR
code. Just because you have a phone running iOS
doesnt mean you are invincible. Know the risks.
Knowledge is power! (Figure 2)

Watch Where You Are Going

If I havent scared you away from scanning QR
codes, then make sure you are using a QR scan-

Figure 2. Suspicious QR codes. Source: http://

barnettmurphydirectmarketing.com/qr-codes.php

Figure 3. Installation of proactive software on your

mobile device. mSource: http://www.qrcodepress.com/nfc-
technology-adds-requirement-for-virtual-credentials-for-
identity-management/853265/

www.hakin9.org/en
 THE TECHNIQUES

ner that that previews URLs. Avoid scanning sus- have built proactive software to help you protect
picious codes and links that dont seem to match your mobile device. Scanning a QR code with Nor-
the ads theyre incorporated in; also avoid short- ton Snap will check the link, and then provide you
ened links (Figure 3). with a clear safety rating. If you want to continue
loading the link, you simply tap on the full link ad-
Protect Yourself dress.
Just like the days of getting an anti-virus program McAfee also provides mobile security software
for your desktop computer, the usual suspects that can be used to protect you from viruses,
worms, Trojans, spyware and other malware that
can be transmitted via QR codes (Figure 4).

Sometimes Open Source Isnt The Best

Source
Even though Googles intentions were good when
making Android an open source operating system,
its open source-ness can be used for evil as well.
Open source materials allow cyber attackers to ex-
amine its source code for easily exploited weak-
nesses. This is why most QR related malware is
target to Android based smartphones. Stay up to
date with the latest app and OS updates to ensure
Figure 4. Open source materials. Source: http://www. current security settings (Figure 5).
xatakandroid.com/sistema-operativo/google-prepara-
caracteristica-de-eliminacion-de-datos-selectiva-en-android-
para-potenciar-byod Use Common Sense
Though the use of QR codes is new, the end tac-
tics are still the same. If you go to a website from
a QR code that asks for your personal information,
logins, or passwords dont give it. I have heard
a great quote about phishing scams If theres
doubt, dont fill it out! (Figure 6)

Think About The Source

Much of the QR phishing scams can be attribut-
ed to stickers with codes covering legitimate QR
codes. So if you see a magazine ad, a poster, a
CD, or any other material that has a QR code stick-
er on it, chances are, its a scammer. If the QR code
Figure 5. Be reasonable. Source: http://yoplayhouse.blogspot. looks more like a scratch and sniff sticker and less
com/2009/01/boy-licks-frozen-light-pole-gets-stuck.html like a part of the original print, be very suspicious
because something doesnt smell right.

Nick Lynch
Nick is the Co-Founder of OakReach, a na-
tive ad and content marketing platform.
With over a decade of ad tech experi-
ence, Nick is a product developer and op-
erational leader with a strong profession-
al track record in digital media and tech-
nology. His opinions and thought leader-
ship have been featured in such industry
publications as TechCrunch, Mediapost
and ClickZ. Former companies include Ad-
Figure 6. Unsafe sources. Source: http://www.fangdigital.
com/54-does-not-constitute-most-and-other-cautionary- conion, Fox Interactive Media, and Spot
tales/ Runner.

36 07/2013
U P D AT E
NOW WITH
STIG
AUDITING

IN SOME CASES

nipper studio
HAS VIRTUALLY

REMOVED
the
NEED FOR a
MANUAL AUDIT
CISCO SYSTEMS INC.
Titanias award winning Nipper Studio configuration
auditing tool is helping security consultants and end-
user organizations worldwide improve their network
security. Its reports are more detailed than those typically
produced by scanners, enabling you to maintain a higher
level of vulnerability analysis in the intervals between
penetration tests.

Now used in over 45 countries, Nipper Studio provides a

thorough, fast & cost effective way to securely audit over
100 different types of network device. The NSA, FBI, DoD
& U.S. Treasury already use it, so why not try it for free at
www.titania.com

www.titania.com
 interview

Interview with
Nick Lynch
Nick is the Co-Founder of
OakReach, a native ad and
content marketing platform.
With over a decade of ad
tech experience, Nick is
a product developer and
operational leader with a
strong professional track
record in digital media and
technology. His opinions
and thought leadership
have been featured in such
industry publications as
TechCrunch, Mediapost and
ClickZ. Former companies
include Adconion, Fox
Interactive Media, and Spot
Runner.

Could you please introduce yourself and manage native ad units (sponsored articles,
briefly? images, and videos) and activate their created
My name is Nick Lynch, Co-Founder & VP of Sales content for brand sponsorships and monetization.
& Marketing for OakReach. I have worked in the We also provide content distribution and content
AdTech space since 2005 and have worn many sponsorship opportunities to brands, advertisers,
different hats: Product development, marketing, and agencies.
sales, and business development.
What is your area of interest?
What is your company responsible for? I have always been interested in disruptive tech-
OakReach is a content marketing and native ad nology. Anything that upsets the status quo and
platform. We provide tools for publishers to create innovates business models peaks my interest.

38 07/2013
 Interview with
Nick Lynch

Anytime you see Elon Musk or Jeff Bezos in the Have you ever used QR codes in business?
news, rest assured I am watching! Yes! QR codes have been a great way to activate
customers looking for product related content. In
How long are you in business? previous roles, I have used QR codes for contests,
OakReach has been in development since early content distribution, as well as lead generation.
this year but our official release was in May. Our
platform is in beta now and we look to be about 45 Do you think they are a good marketing
days out from a public release. tool?
When you used in the right environment, they are
Did you always know what you want to do extremely effective. When used in conjunction with
in the future? content or when consumers are already engaged
We are consistently looking forward to whats next tends to yield the most results. But to utilize QR
and always looking at ways to innovate. In Ad Tech, codes in a passive environment where there is no
you always have to stay nimble and flexible to be real connection with what a person is doing, leads
able to meet new demands and constant change to poor performance.
in the marketplace. We feel well positioned as an
early mover in the space to be able to adapt quick- Are you involved in some extra project
ly to dynamic market demands. that you would like to share with our
readers?
What sort of clients have you got? I have a passion for advising and working with oth-
We work with both advertisers and publishers er start ups. I advisor for a couple different compa-
(website owners). Our goal is to becomeTHEneu- nies in the space: a hyper local mobile advertising
tral, third party marketplace for content and native platform called Pagewoo and a recently acquired
ad distribution. supply side platform named Adaptive Media (Mim-
vi acquired Adaptive back in July).

by Magdalena Gierwatowska

a d v e r t i s e m e n t
 interview

Interview with
Antonio Ieran
Antonio is an IT professional, marketing specialist, and tech
evangelist with over 16 years of experience serving as a community
liaison, subject matter expert, and high-profile trainer for key
technologies and solutions. Mr Ieran's experience includes acting
as the public face of Cisco security technologies; leading pan-
European technical teams in development of new Cisco security
products; and serving as a key public speaker and trainer on behalf
of new high-tech products. His expertise spans IT development and
implementation, marketing strategy,
legal issues, and budget / financial
management.

40 07/2013
 Interview with Antonio Ieran

Specialties and Executive Expertise What is your main area of expertise?

IT Strategy, Technical Audits, Enterprise Architec- I would say technology and security, but I developed
ture & Applications, Systems Integration, Techni- experience also in communication and marketing.
cal Sales Liaison, Solution Architecture, Network
Design, Architecture, & Security, Vulnerability As- What do you think about using QR codes
sessment & Management, Systems Engineering, for marketing purposes?
TCP / IP, Data Privacy, Cisco Technologies, Cloud QRCode is a great instrument mostly because al-
Computing, IT Audits, Marketing Strategy, Bud- low content publisher to break the traditional bar-
get Management, Consultative Sales, Social Me- riers between paper and computer. This way it is
dia Marketing, High-Impact Presentations, Project possible to add to a static media as magazines
Management. and posters dynamic contents. I think it will break
some other barriers in advertising in the future.
You have a very wide experience. Could
you please tell us a little bit about your What are you planning to achieve in the
career development? nearest future?
Well I started as many of us as a developer, may Well Im looking for something new to explore or
be someone remember PDP-11 and ADA, but I something old to develop. Ive been a developer,
turn soon to be a trainer and a system engineer, I a trainer, a system engineer, a product manager,
never liked to double-check the code mostly if you a speaker, a marketing manager now I would like
remember how was done those years. to be . Ill tell you as soon as I find a new career.
I worked for several years as a consultant: proj-
ect management, problem setting and problem Did you writ articles for Hakin9 in the
solving in the IT field working with token-ring and past?
other old network structure. Wireless is so distant As a matter of fact I did, a really pleasant and inter-
from thick Ethernet Ive used in the past (ok now esting experience.
Im feeling very old).
I saw internet growing from BBS and Fido-net What do you think about our Magazine?
to the modern connections exploring quite every- Hakin9 is a reference for the IT, great articles com-
thing. ing from real experts and a strong focus on what
really matter, I do not think we can ask more to a
Did you always know what is you plan for magazine.
the future?
Absolutely not, planning the future is an odd ex- What is your hobby?
ercise, I just did what I was likening and what was When younger I used to play guitars but nowadays
worth to me. I love technology and IT is still an I become lazy, I think my hobby is my daughter and
amazing field to work. my family. But I seldom enjoy wrestling, Ive been an
ICW wrestler, and sooner or later Ill enjoy my bike.
What would you like to specialize in?
Hard to say, but I still think that security is the most Have you got enough time for you
entertaining field, even if I usually have a non-prod- passions? Or you are too busy?
uct approach to security, I always seen it as a pro- Luckily I always did works that were aligned with
cess where products are just a tiny components. I my passions: share knowledge, Technology so
dogged deeper on forensic recently but from a pro- hard to say. For sure I would like to have more time
cess and investigation perspective. to share ideas and exchange experiences.

You currently run your own blog? Am I

right?
Yes actually I run more than one, when I have time
of course. One dedicated to my non IT thoughts,
one dedicated to the tech news I find interesting,
another that is a technical one in English, one ded-
icated to Italian technical news (just a little emp-
ty those last months), one on Italian politics news
and finally one with my 10 years old daughter. by Magdalena Gierwatowska

www.hakin9.org/en 41

Creating Innovative and Unique QR Code Solutions
is our only job and its what we do better than anyone else.

It isnt about the code, its about what the code can do for you, and
it goes so much further than just a marketing idea. VitreoQR has a
complete array of world class solutions, from marketing to
management, that can help you measure and grow your business.
Whatever your challenge might be, inventory control, counterfeit
prevention, access control systems, supply chain management or
any one of countless other business conditions, VitreoQR can
develop a QR Code driven solution to meet your specic needs. As
a licensee of DENSO Wave QR Code patents, we have all the
necessary tools to make your business more efcient and more
protable through new ideas in 2D barcoding systems.

WARNING: If you dont want to learn

more, dont scan this code!

No one understands QR Codes like we do.

Explore the possibilities that QR Code technologies offer as real world solutions to even the most
difcult problems. Convey information, manage issues, reach new markets and move more
people into your perspective as you have never been able to do before. There simply isnt
another technology that can do as much for you, at the same value proposition, as a QR Code.
VitreoQR deploys genuine, DENSO Wave QR Codes that are absolutely guaranteed to be fully
compliant with the ISO:18004:2006 specication, delivering to you security and peace of mind.

QRCode QRPhoto QRLogo QRMotion QRAnalytics QRCustom SQRC

In Partnership With
VitreoQR, LLC
12801 Berea Road, Suite F
Cleveland, Ohio 44111 U.S.A.
P. 440.941.2320
E. info@vitreoqr.com
I N V E N T O R O F
W. http://vitreoqr.com T H E Q R C O D E

QR Code is a Registered Trademark of DENSO WAVE INCORPORATED.

A BZ Media Event

Big Data gets real

at Big Data TechCon!
Discover how to master Big Data from real-world practitioners instructors
who work in the trenches and can teach you from real-world experience!

Come to Big Data TechCon to learn the best ways to:

Collect, sort and store massive quantities Learn HOW TO integrate data-collection

Over 60
of structured and unstructured data technologies with analysis and

how-to sses
business-analysis tools to produce
Process real-time data pouring into
l cla the kind of workable information
your organization
practicautorials and reports your organization needs
and t ose
Master Big Data tools and technologies
to ch o Understand HOW TO leverage Big Data
like Hadoop, Map/Reduce, NoSQL from! to help your organization today
databases, and more

Big Data TechCon is loaded with great networking

opportunities and has a good mix of classes with technical
depth, as well as overviews. Its a good, technically-focused
conference for developers.
Kim Palko, Principal Product Manager, Red Hat

Big Data TechCon is great for beginners as well as

advanced Big Data practitioners. Its a great conference!
Ryan Wood, Software Systems Analyst, Government of Canada
San Francisco
If youre in or about to get into Big Data, this is the October 15-17, 2013
conference to go to.
Jimmy Chung, Manager, Reports Development, Avectra www.BigDataTechCon.com

The HOW-TO conference for Big Data and IT professionals

Big Data TechCon is a trademark of BZ Media LLC.