210
submitted 1 month ago by poVoq@slrpnk.net to c/privacy@lemmy.ml
all 44 comments
sorted by: hot top controversial new old
[-] ohwhatfollyisman@lemmy.world 84 points 1 month ago

scanning a random qr code has to be this generation's plugging in an unknown usb drive.

[-] captain_zavec@sh.itjust.works 53 points 1 month ago

I mean, unless somebody is burning browser zero days on random public QR codes I'm not too worried.

[-] SkyeStarfall@lemmy.blahaj.zone 6 points 1 month ago

Browser zero days are some of the most valuable exploits in existence, so I highly doubt it would happen in practice

[-] ChaoticNeutralCzech@feddit.org 28 points 1 month ago* (last edited 1 month ago)

It's easier to take precautions though. You probably don't have an insulated USB port or throwaway host device but handling QR codes safely just takes basic tech and skill.

Important advice:

  • Don't use apps that auto-open URLs in QR codes when pointed at!
  • Make sure the app shows the full content of the QR code and lets you peruse it indefinitely before you open the link!
  • Know the structure of URLs and common pitfalls!

Recommendations:

  • Be extra suspicious if there is no URL printed next to the code, or if the printed URL is different.
  • Use an open source reader app (most QR codes don't contain secrets but it's got permission to use either camera!) that does not resolve Punycode (Unicode in TLDs).
  • Strip any tracking parameters you spot before following any URLs.
  • Be careful if the QR code could have been easily tampered with (on a sticker over the original one, or on a plain sheet of paper inserted into a plastic wrap together with the rest)

I think today's generation's equivalent is free Wi-Fi networks. Kids without mobile data in an area without an established public network will connect to just about any open one unless the SSID includes "LaserJet" or similar.

[-] Zagorath@aussie.zone 5 points 1 month ago

Strip any tracking parameters you spot before following any URLs.

If it's one of these QR codes at a restaurant for ordering, the parameters could possibly be necessary to properly connect your order to your table, depending on how they're set up.

[-] ChaoticNeutralCzech@feddit.org 1 points 1 month ago

Then it's not a tracking parameter of course.

[-] krolden@lemmy.ml 4 points 1 month ago

WiFi and cellular networks as well. Using cellular data without some kind of tunneling for traffic/dns is nuts IMO.

[-] tiredofsametab@fedia.io 2 points 1 month ago

I keep meaning to look more into how qr codes work. I always wondered if there were possible attack vectors if a bad actor exploited a flaw in the decoding of the image. My mind went to a zip bomb for no apparent reason (a tiny file that unzips to a massive amount of data on disk)

[-] ChaoticNeutralCzech@feddit.org 4 points 1 month ago* (last edited 1 month ago)

That is very decoder-specific. The most common QR reader apps are the Camera app on iPhones and Google Lens for Android so you'll want to target one of these (though Google Lens might be using cloud processing for that). There probably won't be any exploits in the image processing part but you obviously can write arbitrary data (including ASCII control characters such as CR, LF, null) into the "data" part of the QR code, as the encoding mode and data length is stored in the first 4+(n*8) bits of where data would be instead of null byte termination. Normally, the data is then right-padded with repeating 0xEC11 (or not) and then error correction follows (number of bytes in the error-correction part is defined by the size and ECC mode indicated in another region).

[-] possiblylinux127@lemmy.zip 8 points 1 month ago

You just don't open the link

[-] EngineerGaming@feddit.nl 5 points 1 month ago

You would at least be able to examine the link first.

[-] MonkderVierte@lemmy.ml 3 points 1 month ago* (last edited 1 month ago)
[-] shaserlark@sh.itjust.works 44 points 1 month ago
[-] ChaoticNeutralCzech@feddit.org 56 points 1 month ago
[-] Quacksalber@sh.itjust.works 13 points 1 month ago

Probably smart to take it down. What he did could be construed as hacking.

[-] Zagorath@aussie.zone 27 points 1 month ago

I have no idea what the law is in India, but if he got a "hacking" charge for this it would be a gross miscarriage of justice, considering he never once did anything resembling social engineering, brute forcing passwords, any sort of injection attack, or anything else that might actually be involved in hacking.

However, assuming he never tried to reach out to the company themselves first (and I saw no indication in the article that he had), this is really quite a horrible irresponsible disclosure. It's pretty obviously a significant leak of sensitive data—both customer and business data—and giving them 90 days to fix it before alerting the public to what you found is pretty basic security ethics.

[-] dylanmorgan@slrpnk.net 9 points 1 month ago

I also don’t know the laws in India, but in the US nearly every major “hacking” case for decades has been a miscarriage of justice to some degree or another.

Like Kevin Mitnick who simply figured out that a major early ISP was keeping customer payment information in plaintext on an internet-connected server.

[-] thesmokingman@programming.dev 4 points 1 month ago

That’s a huge misrepresentation of what Mitnick did and how the government mischarged him. He did a bunch of dumb stuff that was illegal. He was overcharged in very bad ways supporting ridiculous lies from the companies he broke into.

[-] ITGuyLevi@programming.dev 3 points 1 month ago

Well there was that one part where he turned off his laptop after (not wanting to drop what he did here as the article was pulled), but I could totally see a company freaking out and going nuclear. That being said, I'm just looking through the FreedomGoggles that recently saw a "hacker" using F12 to compromise a bunch of teacher data. You know, their important sensitive data that was definitely not sent to their device where it could be seen by right clicking and hitting view source.

[-] kbal@fedia.io 1 points 1 month ago

Self-censorship working a little too well.

[-] NegativeInf@lemmy.world 26 points 1 month ago

Absolute insanity.

I would have abused this great and terrible power in just the same way he described. Random orders for random tables at random restaurants at random times in small quantities for as long as they aren't protected. Just enough to be an inconvenience/awkward but not enough to raise alarms.

And now I will check every QR code I scan at a restaurant.

[-] Psychodelic@lemmy.world 2 points 1 month ago* (last edited 1 month ago)

That seems kinda fucked up. Why would you do something like that?

I mean, I at least get fucking with people for money. Doing it for fun, not so much

Also, anyone know what they meant with this line?

I still loved my life so I didn't want to use the Google custom search API.

[-] NegativeInf@lemmy.world -1 points 1 month ago* (last edited 1 month ago)

Because you can or to prove a point.

As to the quoted text, I assumed it was a reference to not getting more deeply involved in it that would cause legal issues for himself.

[-] Psychodelic@lemmy.world 2 points 1 month ago

Interesting. I thought that was just in movies. lol

Ok, yeah I figured the same thing

[-] acockworkorange@mander.xyz 25 points 1 month ago

I scanned the API calls to get all the details I needed. I did my thing and I was in.

Hackerman

[-] psmgx@lemmy.world 2 points 1 month ago

I was hoping for the Mr robot guy

[-] acockworkorange@mander.xyz 2 points 1 month ago

I only trade in the finest, unadulterated, originals.

[-] lukecooperatus@lemmy.ml 18 points 1 month ago* (last edited 1 month ago)
[-] Bezier@suppo.fi 17 points 1 month ago* (last edited 1 month ago)

The main event here was pretty interesting, but I'd just like to say that

It asked me for my name and Whatsapp mobile number.

Why not just the mobile number. Do they also operate drive-ins that only accept BMWs?

[-] Mountaineer@aussie.zone 12 points 1 month ago

In certain places like India, WhatsApp is the default means of communication for everyone.
You can use it without phone data if you are on wifi, it supports better quality than sms for sending images, you can video chat with it, it's cross platform, etc etc.

What's more amazing to me is that it's not more popular in western countries.

[-] JustTesting@lemmy.hogru.ch 9 points 1 month ago

It's the most common communication tool for friends and family in much of europe

[-] Bezier@suppo.fi 5 points 1 month ago

I know it's dominant, but it just sucks. To go back to the previous analogy, Whatsapp should have a monopoly on communication as much as BMW should have a monopoly on transportation.

[-] nameisnotimportant@lemmy.ml 14 points 1 month ago

error 404: 'Page not found'

[-] ChaoticNeutralCzech@feddit.org 29 points 1 month ago

Has been taken down. See archived copy

[-] LunarLoony@lemmy.sdf.org 11 points 1 month ago

Brilliant article - but it looks like it's now been removed. Would be impressive if someone at Dotpe got wind in such a short space of time...

[-] poVoq@slrpnk.net 7 points 1 month ago

Huh, it was still working when I posted it one hour ago... unlucky I guess 🤷‍♂️

[-] EngineerGaming@feddit.nl 4 points 1 month ago* (last edited 1 month ago)

It asked for your phone number? That is the thing that angered me the most. I wonder why you would share this rather than ask a waiter and say you don't have Whatsapp, for example.

this post was submitted on 23 Sep 2024
210 points (97.7% liked)

Privacy

31974 readers
229 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS