Skip to content

Old MacDonald Had a Barcode, E-I-E-I-CAR

Richard Henderson

Richard Henderson encodes the classic EICAR antivirus test string into QR codes and physical barcodes, triggering unexpected security alarms and system crashes across scanning hardware.

Summary

The Universal Standard of the EICAR Test String

For decades, the standardized EICAR test string has allowed security engineers to safely validate antivirus detection engines without deploying harmful malware payloads.

Encoding Antivirus Signatures into Optical Formats

Richard Henderson encodes the EICAR string into physical barcodes, QR codes, and matrix tags, testing industrial handheld scanners, airport kiosks, and mobile inspection apps.

Triggering Antivirus Interception Across Embedded Devices

Scanning the encoded barcodes causes background endpoint agents to quarantine raw memory buffers, lock up point-of-sale terminals, and crash optical decoding hardware.

Input Validation and Endpoint Resiliency

Henderson highlights the critical need for robust input sanitization and graceful error handling when parsing optical telemetry across enterprise endpoints.

Related talks

Main Stage·45 min

  • DEF CON
  • AppSec
  • Date: Aug 2016
  • Location: Las Vegas

Przemek Jaroszewski

Przemek Jaroszewski analyzes automated airport security checks, demonstrating flaws in boarding pass barcode validation that grant unauthorized airport lounge and fast-track access.

boarding-passpdf417airline-security+2

Main Stage·53 min

  • DEF CON
  • AppSec
  • Date: Aug 2002
  • Location: Las Vegas

Kevin Spett

Kevin Spett explores sql injection at DEF CON 10, examining sql-injection and practical defenses.

sql-injectionweb-application-securitydatabase-exploitation+1