Malicious QR codes
(blog.talosintelligence.com)
from Joker@sh.itjust.works to cybersecurity@sh.itjust.works on 20 Nov 2024 11:42
https://sh.itjust.works/post/28364298
from Joker@sh.itjust.works to cybersecurity@sh.itjust.works on 20 Nov 2024 11:42
https://sh.itjust.works/post/28364298
- QR codes are disproportionately effective at bypassing most anti-spam filters, as most filters are not designed to recognize that a QR code is present in an image and decode the QR code. According to Talos’ data, roughly 60% of all email containing a QR code is spam.
- Talos discovered two effective methods for defanging malicious QR codes, a necessary step to make them safe for consumption. Users could obscure the data modules, the black and white squares within the QR code that represent the encoded data. Alternatively, users could remove one or more of the position detection patterns — large square boxes located in corners of the QR code used to initially identify the code’s orientation and position.
- Further complicating detection, both by users and anti-spam filters, Talos found QR code images which are “QR code art”. These images blend the data points of a QR code seamlessly into an artistic image, so the result does not appear to be a QR code at all.
threaded - newest
Just two days ago there was a warning on the radio that in a few cities, criminals have placed stickers with their own QR codes over the original ones on the parking ticket vending machines. So if you want to purchase a parking ticket online, it sent you to their own website, faked to look like the original one, and requested to enter CC data for the payment.
That’s clever.
Many email providers have a ‘do not load images’ setting. The two I use, Tuta Mail, and Proton Mail, both have it and I keep it on. When your mom sends you a photo of her new kitten you can just ‘Tap to show images’ or something similar. Images will not be loaded automatically, you need to do it case by case.
For QR codes in the wild, don’t scan them, if you do use something like Binary Eye which let’s you see the path before they are executed. At least you will know the domain isn’t cryptoscam.com
Do not load EXTERNAL images, if the image is actually attached as part of the email it will render.
FTFY
Also, good spam filters will “detonate” the email and detect QR code spam. They’ll follow the link in the code and check it out.