An Exploration Into QR Codes And Their Prevalence As An Unexpected Phishing Vector by Josh Hill

### Overview In this presentation, fourth-year ethical hacking student Josh Hill explores how Quick Response (QR) codes function as an unexpected real-world phishing vector. Originally invented in 1994 by Denso Wave for manufacturing, QR codes store data such as bits, numeric, alphanumeric, and kanji characters, but are overwhelmingly used today to encode URLs. Because users are increasingly trained to identify suspicious hyperlinks on desktop browsers, physical QR codes exploit human trust, complacency, and curiosity by embedding malicious links into everyday physical environments like restaurants and public venues.

### Key Topics - **Mechanics and Normalization of QR Codes**: QR codes feature positioning squares, data storage, and error-correction capabilities. Public adoption has accelerated via parking meters, contact tracing (such as Test and Protect), package tracking, and marketing (e.g., Coinbase's Super Bowl ad). - **Malicious Use Cases**: Threat actors can deploy QR codes to redirect victims to cloned login or ordering pages, execute reflected cross-site scripting (XSS), run a BeEF (Browser Exploitation Framework) server to harvest browser details, or deliver malicious JavaScript. - **Human Behavior and Inherent Trust**: People inherently trust QR codes placed in locations where they expect them. Hill cites a study from a university in Pennsylvania where 61% of distributed flyers were scanned (resulting in 225 hits), with roughly 60% of surveyed scanners admitting they acted out of curiosity and 14% for fun. A surveillance experiment on a bulletin board revealed that out of 18 people observed scanning a code, 15 proceeded to follow the link. - **Scanner App Deficiencies**: QR scanner applications handle links inconsistently. While Google Lens displays the complete destination URL, other apps show vague disclaimers or display only the base domain, hiding potentially malicious query parameters. Testing a dedicated scanner from Kaspersky revealed that it automatically opened destination links in the browser without user confirmation.

### Technical Details - **Restaurant App Skimming Scenario**: Hill outlines a practical attack scenario against restaurants using web apps for table ordering (such as Nando's). An attacker could swap table QR codes with malicious duplicates that proxy orders to the legitimate backend while skimming a fee (e.g., pocketing £2 per transaction), leaving the customer and restaurant largely unaware. - **On-Site Conference Experiment**: Hill deployed test QR codes throughout the conference venue. Two codes mimicked official Test and Protect portals and received multiple scans in less than half a day. Three innocuous posters featuring a security logo and a QR code each received several scans, proving that even security professionals succumb to curiosity. - **URL Analysis**: Hill demonstrated a typosquatting example used in his experiment, showing the difference between the legitimate conference domain (`secure-tay.co.uk`) and his tracking URL (`secure-tay.uk`).

### Takeaways - **End-User Advice**: Users should keep devices updated, refrain from scanning arbitrary QR codes out of curiosity, inspect the full destination URL before proceeding, and prefer physical methods when available. HTTPS does not ensure safety, as malicious websites easily obtain TLS certificates. - **Security Professional Advice**: Organizations should secure their web platforms against site cloning, cross-site scripting, and clickjacking. Physical premises should be monitored to ensure unauthorized QR codes are not posted.