Optical Delusions: A Study of Malicious QR Codes in the Wild

Abstract

Abstract-QR codes, a form of 2D barcode, allow easy interaction between mobile devices and websites or printed material by removing the burden of manually typing a URL or contact information. QR codes are increasingly popular and are likely to be adopted by malware authors and cyber-criminals as well. In fact, while a link can "look" suspicious, malicious and benign QR codes cannot be distinguished by simply looking at them. However, despite public discussions about increasing use of QR codes for malicious purposes, the prevalence of malicious QR codes and the kinds of threats they pose are still unclear.In this paper, we examine attacks on the Internet that rely on QR codes. Using a crawler, we performed a large-scale experiment by analyzing QR codes across 14 million unique web pages over a ten-month period. Our results show that QR code technology is already used by attackers, for example to distribute malware or to lead users to phishing sites. However, the relatively few malicious QR codes we found in our experiments suggest that, on a global scale, the frequency of these attacks is not alarmingly high and users are rarely exposed to the threats distributed via QR codes while surfing the web.

Quick Response Code Secure: A Cryptographically Secure Anti-Phishing Tool for QR Code Attacks

“…Kharraz, Kirda, Robertson, Balzarotti and Francillon conducted an empirical analysis across 14 million web pages to discover the extent to which QR codes are leveraged by attackers in the wild. Their results showed that QR codes are being abused by attackers to distribute malware or direct to phishing sites on the public web [3]. The results not only revealed the malicious use of QR codes, but also identified 145 malicious QR codes out of 94,770 QR codes.…”

“…The most prevalent attacks employing QR codes are phishing and drive by downloads [3] that trick users to disclose confidential information. QR codes enable users to open web pages via scanning, without typing the URL.…”

“…With millions of QR codes displayed by companies in public places its not difficult for a malicious author to replace or modify them. The rapid pace of smartphone adoption and usage [3] has not only enhanced QR code popularity and usage over a much wider range of applications [4], but also introduced newer QR code attack vectors for malicious users [5]; thus, posing a serious threat to unsuspecting smartphone users. With mobile phone usage crossing the two billion mark in 2016, outnumbering personal computers [6], this threat assumes greater significance.…”

No Escape From Reality

“…The attacks described in Section 6.2 exploit the deficiencies of user interfaces in AR browsers, not software vulnerabilities. Other related work includes security threats involving QR codes [15] and the use of QR codes for malware distribution and phishing [17]. Dabrowski et al [5] recently demonstrated numerous attacks involving hiding a QR code inside of another QR code, similar to our our attacks in Section 6.2.…”

Techniques and solutions for addressing ransomware attacks

“…The author was also involved in a set of research papers which are not directly related to this thesis [19,20,55], and would like to thank the collaborators for producing great work in this area.…”