QR code security

Quick Response Code Secure: A Cryptographically Secure Anti-Phishing Tool for QR Code Attacks

“…Even though people might fall for QR code leveraged phishing attacks there are other possible weaknesses that QR codes can possibly exploit [7]. Specifically, QR codes can be used for SQL injection and command injection attacks in automated readers-programs that extract information from QR-codes.…”

“…QR codes can be used in several different types of attacks such as social engineering and automated processes attacks. Automated processes attacks are executed by exploiting SQL injection vulnerabilities, command injection, as well as Cross-Site Scripting (XSS) attacks [7].…”

QR Code Security: A Survey of Attacks and Challenges for Usable Security

“…Version 40, which produces the largest QR code, has 23,648, hence 4296 alphanumeric characters [32], [37] can be encoded. Figure 1 shows an example of a version 2 QR code, which is the most commonly used one [27], [34], [40], [15]. In addition to alphanumeric characters, QR codes can encode binaries, Kanjis 1 or control codes.…”

“…The attacker modifies individual modules of a QR code. The main idea of this modification is that the encoded content is modified solely by changing the color of specific modules of the QR Code to which the user will be directed after scanning the code as proposed in [27]. …”

“…These malicious QR codes can be printed on small stickers and pasted over already existing QR codes. Furthermore, attackers can modify selected modules from white to black and vice-versa in order to override the originally encoded content as proposed in [22]. Even though many real world examples have been reported in the media [24], there has been little research conducted on human-computer interaction and security aspects of QR code based attacks.…”