Old MacDonald Had a Barcode, E-I-E-I-CAR
Richard Henderson encodes the classic EICAR antivirus test string into QR codes and physical barcodes, triggering unexpected security alarms and system crashes across scanning hardware.
Summary
The Universal Standard of the EICAR Test String
For decades, the standardized EICAR test string has allowed security engineers to safely validate antivirus detection engines without deploying harmful malware payloads.
Encoding Antivirus Signatures into Optical Formats
Richard Henderson encodes the EICAR string into physical barcodes, QR codes, and matrix tags, testing industrial handheld scanners, airport kiosks, and mobile inspection apps.
Triggering Antivirus Interception Across Embedded Devices
Scanning the encoded barcodes causes background endpoint agents to quarantine raw memory buffers, lock up point-of-sale terminals, and crash optical decoding hardware.
Input Validation and Endpoint Resiliency
Henderson highlights the critical need for robust input sanitization and graceful error handling when parsing optical telemetry across enterprise endpoints.
Related talks
Main Stage·45 min
Przemek Jaroszewski
Przemek Jaroszewski analyzes automated airport security checks, demonstrating flaws in boarding pass barcode validation that grant unauthorized airport lounge and fast-track access.
Main Stage·40 min
Kelly Kaoudis · Sick Codes
Kelly Kaoudis and Sick Codes disclose systemic IPv4 address parsing flaws across major programming languages (Python, Go, Rust), enabling SSRF and access bypasses.
Main Stage·53 min
Kevin Spett
Kevin Spett explores sql injection at DEF CON 10, examining sql-injection and practical defenses.


