Counterfeit QR codes

Overnight, it seems like all the advertisements sprouted QR codes.  It seems like a fun way for people to find out more about a product or service.  That seems harmless enough, but I wondered it this wasn’t a way for cyber criminals to use these.  After a quick google, I found that the cyber criminals are already working on new ways to use this technology.

The Hacker News posted that there was a QR code that installed a Trojan on their smart phone and subsequently sends texts to $6 premium rate message service (which could add up quickly, if you do not know about it).

An article in Scientific America reported that cyber criminals could increase the scope of their attacks by printing the counterfeit QR codes and pasting them over already-existing tags on posters in public places.  Counterfeit QR codes could be combined with typo-squatted URL which looks an acts like the original website, thereby tricking the web surfer into a false sense of security.

And the Cyveillance website predicted that smart phones could be used as botnets.  These botnets could lay dormant for long periods of time before being employed as foot-soldiers in a denial-of-service attack.

These are just a few of the ways that cyber criminals are utilizing QR technology to infiltrate the security of our smart phones.  But the way to avoid falling prey to these deceitful tactics is to treat QR codes for what they really are – a way for encoding URLs.

And URLs can be used safely by following the rules we learned in class Cyber Self Defense class:

Never click on links directly from an email.
Use File/Properties to find out which website you are really on.
Look for the proper symbol to indicate you’re on a secure web site.
Secure web sites use a technique called SSL (Secure Socket Layer) that ensures the connection between you and the web site is private.
This is indicated by “https://” instead of “http://” at the beginning of the address AND by a padlock icon which must be found either at the right end of the address bar or in the bottom right-hand corner of your browser window.
A padlock appearing anywhere else on the page does not represent a secure site.
Sources (don’t forget the rules before you click!):

3 thoughts on “Counterfeit QR codes

  1. Now I don’t have a smart phone so I’m not entirely sure how these things work. Do they automatically take you to whatever they’re associated with, or does it prompt you with information on it and ask whether to load it or not?

  2. I also have a “not-so-smart” phone, but it looks like scanning the QR Code is the same as clicking on a bar code (and you will be sent there). You’ll be sent there once you scan it.

  3. Yup, I talked to my sister and the phones automatically go to the website once the QR code is scanned. Hopefully it isn’t the site with the virus that calls the “premium” phone number… repeatedly.

Comments are closed.