Ask HN: How to protect yourself from QRishing attacks? | Hacker News Reader

Ask HN: How to protect yourself from QRishing attacks?

3 pointsmodinfo8 comments

Today a friend told me about a phishing attempt he almost got caught in, he got an email with a link and qr along with the message, "if the domain doesn't work, please scan the QR code", of course this domain wasn't even registered, so he took his phone and scanned it, reaching the phishing site.

This attack is so dangerous that it bypasses all security and email scanners on the server and tells us to scan the QR code with the address to the hacker's site, and most browsers on the phone even hide the URL.

Now the question arises, how to protect against this? Add a QR code scanner to the mail servers?

View on HN

Don't scan random QR codes from unknown emails?

because you won't see the url prior to the page opening, the only way to protect against this kind of thing is a browser addon that warns against the phishing sites. no kind of filter on the QR reader is going to know if the sticker is fake or not.

You didn't mention the make of the phone but here [1] is how to disable automatic QR code scanning on a Samsung. Here [2] are more generic options.

Some things that could be done to reduce risk, depending on how much friction one is open to would be:

- Do not open emails from anyone you do not know, no matter how official or interesting the email title is. low friction

- Alternately, open the email later on a locked down and hardened PC using Thunderbird with remote html/javascript disabled and then scan links in VirusTotal [3] and UrlScan [4] accepting that these sites will not catch everything.

- Disable javascript in the mobile browsers and only enable it for sites one has a binding contract with and/or know where the site operators sit. Firefox + uBlock are a decent browser and addon for this. In uBlock settings -> Filter settings -> enable all 3 Malware lists. one-time high friction per trusted site or adding sites to uBlock to trust

- Disable automatic QR code scanning. Method varies by browser. medium friction

- Block attachments in email per account, or site wide if one hosts their own server. high friction

- If the email server supports this, convert or strip mime encoded content to plain text server-side. This applies to people hosting their own mail server. low friction for a postmaster [5]

[1] - https://www.youtube.com/watch?v=LxdoC2sG1i4 [video]

[2] - https://www.qr-code-generator.com/guides/scan-qr-code-androi...

[3] - https://www.virustotal.com/old-browsers/

[4] - https://urlscan.io/

[5] - https://mimedefang.org/documentation/

>and most browsers on the phone even hide the URL

I've never seen (on any of my iPhones) the URL behind a QR code hidden, nor is it hidden once loaded in the mobile browser

What browser(s) exhibit that behavior?

I had LG and later Samsung. I'm pretty sure both would show the URL and ask if you wanted to visit it too.

How about a malware filter in the QR code app?

The Camera app on the iPhone can even scan the QR code itself and offer the user to open this link. But a dedicated app for scanning suspicious QR codes would be really interesting.

Ask for a paper menu or gasp talk to the waitress a bit and keep it simple since often you won't need one if you know a bit about lunch.

(Also, try not to be insufferable to whoever presents you with something so poorly designed, but I think if you don't at least clearly print the URL, folks may assume it's a scam and look more intently than they would if you'd be open and transparent.)

Reply on news.ycombinator.com