Hacker News Reader

Comment by crisp | Hacker News Reader

This was something I wasn't sure of. How do you know this for a fact?

Because the "A" variant of Code128 allows you to have control characters in there. Many barcode readers act like keyboards to the computer - so the clerk/user positions their cursor to the item number field, waves the item in front of the scanner, and the scanner hardware inserts what it read into the field. Fast, reliable, and easy.

But if the barcode contains control characters, it acts like a keyboard macro and will send them to the application. So if I embed a Ctrl-S in my hostile barcode, I can tell the software to save the record with data I supplied.

I actually wanted to know how marvel_boy knows that consumers usually deal with EAN13 barcode instead of code128. As he or she states, EAN13 barcodes would make this kind of attack impossible so I wanted to know if this is a real everyday problem concerning most of the stores or only a minority of them.

Look at the products you buy at the store (supermarket, Walmart, Target, etc) - the barcode is almost always EAN (now IAN)¹ There are exceptions for smaller items like packs of gum, which use UPC-E² encoding (if the manufacturer portion ends in zeros). Hundreds of thousands of products being purchased by billions of people mean they're the dominant barcode system.

So far as attacks via UPC/EAN/IAN, they're not really possible as it only encodes digits, and only 13 of them.

¹ https://en.wikipedia.org/wiki/International_Article_Number_(...

² http://www.barcodeisland.com/upce.phtml

Reply on news.ycombinator.com