Hacker News Reader

Comment by joosters | Hacker News Reader

No, the problem is the QR code, not the URL. More specifically, it's the context in which you see the QR code. For instance, one scam is replacing the QR codes on parking meters with another one, linking to a different payment site - https://www.theverge.com/2022/1/12/22879728/phishing-scam-pa...

Even if the QR code wasn't altered, the payment site for a parking meter is going to be some random company you probably haven't heard of. So is the scam site! Both sites will look legitimate (and the proper site is most likely shoddy and half broken anyway!) There's going to be very little that you can use to tell them apart just by going on the URL.

The problem isn't (just) hackers using dodgy URLs to install malware, it's social engineering.

View on HN

I still don't think this shows a problem with QR codes. Let's compare with the case where a malicious entity sends an unauthorized parking toll collector to a city-managed parking lot. As someone parking there, I will pay the fake toll collector some money that the city should have received instead, and I will perhaps pay a little more than the city would have required. If the police later checks parked cars, they may tow/bill my car if there was some security system I missed.

How is this different from someone replacing the legit QR code with a fake one?

First of all, there's a difference with payments infrastructure if I can't make a payment to a dodgy site content in the knowledge that I will l, at the very worst, lose the amount of money I am paying there (hopefully 3D secure will help with this, but not 100%). In practice, a site having my credit card details may well steal far more money from me, and depending on my bank I may or may not be able to contest the charges. Much worse than handing some cash to a fraudulent toll collector.

Second of all, the chance that the my parked car will be seen as invalidly parked by automated systems is greater, since the system is definitely automatic (whereas regular parking may simply rely on access to the parking area to decide if you apyed or not). However, I will likely have proof that I did pay for my part, since I have my bank statement, and I can show a picture of the fake QR code showing I am a victim. The city will have to go after the ones who replaced the QR codes and the dodgy site to recover their money, and I will be no worse for wear (though I may need to get here through a court, depending on how good faith and competent the police was). The same or even better than the fraudulent toll collector case.

So, I would say the biggest problem is neither the QR code nor the URL, the biggest problem is the payments infrastructure. I should actually feel secure sharing my payment details with any site whatsoever, and know that at worst I will not get the service I though I was paying for, just like with cash.

This is just the age-old oblivious user problem. An educated user will always go out of their way to link the identity of the service provider to the app that initiates the payment. It was executables in the noughties and now it is QR codes. Little difference.

Say you get a QR code that sends you to yourparkingspace.co.uk. In the footer it claims 'Member of the British Parking Association'. BPA website lists the url in the QR code, and the BPA website URL is linked from Wikipedia. This took ~ a minute, and you only have to do it the first time you encounter this parking provider. Then there are app reviews on the mobile marketplaces and a dozen other ways to verify the QR code/URL.

Most users are not educated enough to protect themselves from bad actors. It's our (government, industry, whitehats, etc.) moral responsibility to protect those users from those who would exploit them.

Not that I have a solution, but I don't believe blaming the victim is the solution.

Most users are not educated enough

It's not to do with education, that's just another form of victim blaming. The QR code is not the focus of the users' attention, they are trying to do some other task (parking, or whatever) and the QR code is just another irritant getting in their way. If you could magically 'educate' people to distrust everything in their everyday life, nothing would ever get done.

I've not heard of the BPA, how am I to know whether this is a real organisation, or just one that the scammers have made up, with a quick official-looking website? Do you really check wikipedia for every website?

Maybe the real group is the 'British Parking Meter Association', BPMA, and the BPA is a scam, and the wikipedia article is one that the scammers just made up? How can I really tell the difference?

You know, and I know, that practically no-one is going to do in-depth company research when scanning a QR code, or following a link, this security argument is junk.

The above isn't an in-depth verification, but it's something most people can do, and enough to prevent the vast majority of scams.

Of course there is no protection from a dedicated attacker or someone who targets you specifically; I'm not suggesting there is a reasonably convenient protection in that case.

To answer your question regarding whether I really check, I followed a similar process when I was using a digital launderette earlier this week, and when I was renting a flat, I verified the agency's URL through checking out their shop window on Street View, apart from checking out the landlord and land registries. It is a habit that I'd expect everyone to develop.

> For instance, one scam is replacing the QR codes on parking meters with another one, linking to a different payment site

How's that different from printing an URL on the parking meter which can be replaced by an attacker with a different URL?

Nobody, and I mean nobody, punches in URLs by hand. They put keywords into a search box, and sometimes those keywords have .com at the end for some obscure geeky or marketing reason they don't understand or care about.

So an attacker just needs to be better at SEO, or they need to register a domain. The problem still lies with visiting untrusted domains rather than the obfuscation of the URL by a QR code.

I definitely enter urls into my address bar. It would be absurd to assume I’m alone. My meters are ppprk.com (for Passport Parking) so I type in ppprk.com.

You just proved my point: that's a domain, not a URL.

Reply on news.ycombinator.com