Hacker News Reader

Comment by marvel_boy | Hacker News Reader

This is possible on code128 barcode. This kind of barcode accepts not only numbers but also chars. Usually consumers deal with EAN13 barcode on the supermarket, they only accept numbers and this attack is impossible.

View on HN

I've written barcode processing software specifically for the retail market. There is a wide array of barcodes that will be used in the retail grocery store. UPC-E, EAN-8, UPC-A, EAN-13, EAN-14, GS1, GTIN, CODE128, and PDF417 (for drivers license scanning or smart phone apps, e.g. Starbucks app barcodes).

Most barcode scanners are programmed by scanning special barcodes provided by the manufacturer. You can enable/disable any barcode standard. Then you can use the barcode scanner as a slow keyboard.

This was something I wasn't sure of. How do you know this for a fact?

Because the "A" variant of Code128 allows you to have control characters in there. Many barcode readers act like keyboards to the computer - so the clerk/user positions their cursor to the item number field, waves the item in front of the scanner, and the scanner hardware inserts what it read into the field. Fast, reliable, and easy.

But if the barcode contains control characters, it acts like a keyboard macro and will send them to the application. So if I embed a Ctrl-S in my hostile barcode, I can tell the software to save the record with data I supplied.

I actually wanted to know how marvel_boy knows that consumers usually deal with EAN13 barcode instead of code128. As he or she states, EAN13 barcodes would make this kind of attack impossible so I wanted to know if this is a real everyday problem concerning most of the stores or only a minority of them.

Look at the products you buy at the store (supermarket, Walmart, Target, etc) - the barcode is almost always EAN (now IAN)¹ There are exceptions for smaller items like packs of gum, which use UPC-E² encoding (if the manufacturer portion ends in zeros). Hundreds of thousands of products being purchased by billions of people mean they're the dominant barcode system.

So far as attacks via UPC/EAN/IAN, they're not really possible as it only encodes digits, and only 13 of them.

¹ https://en.wikipedia.org/wiki/International_Article_Number_(...

² http://www.barcodeisland.com/upce.phtml

Reply on news.ycombinator.com