QR code security

  • Authors:
  • Peter Kieseberg;Manuel Leithner;Martin Mulazzani;Lindsay Munroe;Sebastian Schrittwieser;Mayank Sinha;Edgar Weippl

  • Affiliations:
  • SBA Research, Favoritenstrasse, Vienna, Austria;SBA Research, Favoritenstrasse, Vienna, Austria;SBA Research, Favoritenstrasse, Vienna, Austria;SBA Research, Favoritenstrasse, Vienna, Austria;SBA Research, Favoritenstrasse, Vienna, Austria;SBA Research, Favoritenstrasse, Vienna, Austria;SBA Research, Favoritenstrasse, Vienna, Austria

  • Venue:
  • Proceedings of the 8th International Conference on Advances in Mobile Computing and Multimedia
  • Year:
  • 2010

Quantified Score

Hi-index 0.00

Visualization

Abstract

This paper examines QR Codes and how they can be used to attack both human interaction and automated systems. As the encoded information is intended to be machine readable only, a human cannot distinguish between a valid and a maliciously manipulated QR code. While humans might fall for phishing attacks, automated readers are most likely vulnerable to SQL injections and command injections. Our contribution consists of an analysis of the QR Code as an attack vector, showing different attack strategies from the attackers point of view and exploring their possible consequences.