QRishing: The Susceptibility of Smartphone Users to QR Code Phishing Attacks

Abstract

Abstract. The matrix barcodes known as Quick Response (QR) codes are rapidly becoming pervasive in urban environments around the world. QR codes are used to represent data, such as a web address, in a compact form that can be scanned readily and parsed by consumer mobile devices. They are popular with marketers because of their ease in deployment and use. However, this technology encourages mobile users to scan unauthenticated data from posters, billboards, stickers, and more, providing a new attack vector for miscreants. By positioning QR codes under false pretenses, attackers can entice users to scan the codes and subsequently visit malicious websites, install programs, or any other action the mobile device supports. We investigated the viability of QRcode-initiated phishing attacks, or QRishing, by conducting two experiments. In one experiment we visually monitored user interactions with QR codes; primarily to observe the proportion of users who scan a QR code but elect not to visit the associated website. In a second experiment, we distributed posters containing QR codes across 139 different locations to observe the broader application of QR codes for phishing. Over our four-week study, our disingenuous flyers were scanned by 225 individuals who subsequently visited the associated websites. Our survey results suggest that curiosity is the largest motivating factor for scanning QR codes. In our small surveillance experiment, we observed that 85% of those who scanned a QR code subsequently visited the associated URL.

QR Code Security: A Survey of Attacks and Challenges for Usable Security

“…This survey contained a set of questions to identify the initiatives and the behavior of the people that scanned the QR codes. Similar to Seeburger et al [35], Vidas et al [42] found that curiosity is the main motivation for smartphone users to scan a code. Their findings highlight the need for further research on adequate tools to support the user in detecting potential threats as they are mostly scanning unverified codes because of their curiosity.…”

“…The importance of human-computer interaction aspects in QR code security has been acknowledged by the research of Seeburger et al [35] and Vidas et al [42]. Seeburger et al [35] investigated how users interact with QR code stickers in urban spaces with so called PlaceTagz.…”

“…With curiosity being the main motivation to interact with an unknown source, users are ignoring the security threats associated with QR codes from unverified sources or are unaware of them. Vidas et al [42] described QR code-initiated phishing attacks by conducting two experiments in the city of Pittsburgh, a surveillance and a QRishing experiment. Within their surveillance experiment, they observed how users interacted with the code and if they scanned the codes or not.…”

“…As the results by Seeburger et al [35] and Vidas et al [42] suggest, scanning a QR code is not a safe practice. One of the main reasons for this is that users need to decode the QR code at first in order to decide whether the content is trusted because they are not human-readable.…”

“…Their findings alongside with the differences in consumer acceptance of QR codes amongst different nationalities suggest that people have different concerns regarding security vulnerabilities when interacting with QR codes. Based on the studies by Seeburger et al [35] and Vidas et al [42], another important challenge is to investigate intercultural differences in security awareness. To do so, the deployment of stickers with QR codes (similar to PlaceTagz [35]) in public places like university cafeterias, bus stops and public toilets would be beneficial to investigate the differences between European and Asian users.…”