Quishing scams dupe millions of Americans as hackers turn QR code bad
QR codes were once an interesting innovation that provided a fun scanning by phone. Initially, you may have seen a QR code in a museum exhibition, and you’ve scanned more about woolen mammoth’s eating habits or Cengiz Khan’s military strategies. During the PANDEM, QR codes became the default restaurant menu. However, as QR codes became a basis in the urgent aspects of American life, their computer pirates were found everywhere, from boarding passage to park payments.
“As in many technological progress that begins with good intentions, QR codes have become increasingly target for malicious use. Because everywhere – from gas pumps and garden signs to television advertisements – it is useful and dangerous at the same time.” He said.
Brewer says that attackers benefit from these harmless symbols to deceive people to visit malicious websites, or that they share special information without knowing it is a deception known as “Quinging”.
The increasing prevalence of QR code deception A warning from the Federal Trade Commission Earlier this year, when scanned, “You can also download you with an unintentional or unexpected packages shown by a QR code that can take you to a identity hunting website that stole your personal information such as credit card numbers or user names and passwords. You can also download malware to your phone and access your computer pirates.”
This summer, state and local recommendations have reached the USA. New York Ministry of Transportation And Hawaii Electric Warn customers about avoiding QR code fraud.
The objection to cyber criminals lies in a relative convenience in which the deception operates: slap a counterfeit QR code label to a parking mist or an ancillary invoice payment warning and rely on urgency to make the rest.
Gaurav Sharma, a professor at the Department of Electrical and Computer Engineering at the University of Rochester, said, “Frauds are relying on hurry and you need to do something,” he said.
On the rise because traditional identity hunt fails
Sharma expects QR fraudsters to increase as the use of QR codes spreads. Another reason for increasing the popularity of QR codes with fraudsters is the application of more assurance to force traditional E -Post Identity Campaigns. This year, a study of cyber security platform Keepnet laboratories 26 percent of all malicious connections Now it is sent through the QR code. According to the cyber security company, NordvPN scanned 73% of Americans without verifying QR codes and was directed to more than 26 million malicious sites.
“Cat and mouse security game will continue and people will find solutions and fraudsters will either find a way, or the grass will look at other places where it is greener.” He said.
Sharma is trying to develop a SDMQR (self -authenticated double -modulated QR) with a safety of safety to prevent frauds. However, first, the companies that build cameras and control the camera infrastructure, Google and Microsoft needs to buy. Companies that put their logos in QR codes are not a correction because they may cause a wrong sense of security, and criminals can often copy the logos, he said.
Some Americans are careful against increasing dependence on QR codes.
Iowa, Cedar Rapids’ten Denise Joyal, “I’m in my 60s and I do not like to use QR codes,” he said. “I’m absolutely worried about security problems. One, I don’t really like it when you have to use a QR code to participate in a promotion that has no other way to connect. I don’t use them for entertainment type information.”
Institutions are also trying to strengthen QR codes against the attack.
Natalie Piggush, a spokesman for Indianapolis Children’s Museum, hosting more than a million visitors a year, said that CT staff has become an increasing threat a few years ago to protect the QR codes to protect against.
“In the museum, we use stylized QR codes with our logo and colors unlike standard monochrome codes. We also detail that users can expect to see one of our QR codes and examine our existing QR codes regularly for off -ground codes.” He said.
Museums are often less vulnerable than places like a train station or parking, because fraudsters want to collect cash from people waiting to pay for something. In a museum, a boss is less likely to wait to pay, but even in these environments, Sharma can be distributed to install malicious software of counterfeit QR codes.
Apple, android user trust is a problem
QR code deception is likely to access both Apple and Android devices, but iPhone users may be a slightly higher. a study It was completed by Malwarebytes earlier this year. The users of iPhones said their devices more trusted than Android owners, and that researchers could disappoint their protection. For example, 70% of iPhone users scanned a QR code to start or complete a purchase compared to 63% of Android users who do the same thing.
David Ruiz, a researcher of Malwarebebytes, is that iPhone users do not feel the need to change their behavior while making online purchases, and they are not less interested in additional cyber security measures such as antivirus (or they may not know). Fifty -five percent of iPhone users rely on their devices to keep them safe against 50 percent of Android users who express the same idea.
Low investment, high return pirate tactic
A QR code is more dangerous than a traditional identity hunting E -mail, because users often cannot read or verify the coded web address. Although QR codes normally contain human readable text, attackers can change this text to deceive users to rely on the connection and to rely on the website they direct. The best defense against them is to scan unwanted or unexpected QR codes and to search for those who view the URL address when you scan.
Brewer says cyber criminals also benefit from QR codes to infiltrate critical networks.
“There are also reliable reports that nation-state intelligence organizations use QR codes to endanger the messaging accounts of military personnel and use software such as a signal that is open to consumers.” He said. The Nation-State attackers even used QR codes to distribute Trojan horses (rats), a type of malware that is designed to work without the consent or knowledge of a device owner, to distribute Trojan horses (rats)-allowing the pirates to gain full access to targeted devices and networks.
Nevertheless, one of the most dangerous aspects of QR codes is a cyber threat stored at a simple view that they are part of the texture of daily life.
“What is particularly interested, posters, advertising boards or official documents can be easily endangered. The attackers can simply print their QR codes and paste them real or digitally, which can make the average user detect the deception.” He said.
At the Sans Institute -oriented Sans Institute, Rob Lee, Rob Lee, says that the QR code reconciliation is another tactic on a long line of similar strategies in the Cyber Criminal Game book.
“QR codes were not built considering security, it was built to facilitate life, which made them perfect for scammers.” He said. “We’ve seen this game book with identity hunting e-mails before, now comes with a smiling pixelli square. Not yet worthy of panic, but exactly low effort, high return tactical attackers like to scal.”
