How cybercriminals are taking advantage of QR Codes
With attacks predicted to increase exponentially throughout 2022, maybe we should all think before scanning the next QR code we encounter.
Despite eliminating the need to type a URL on your smartphone and explore new innovative ways of engagement, marketers were forced to admit defeat and retire their obsession with quick-response (QR) codes. But a decade later, the two-dimensional barcode enjoyed somewhat of a renaissance as the low-touch economy began to take shape.
From proving your vaccination status in a nightclub or large event to ordering your food in a restaurant and even connecting to a new Wi-Fi network, QR codes thrived as consumers increasingly demanded contactless convenience. It took a global pandemic for mainstream audiences to embrace QR codes. According to Juniper Research, more than 1.5 billion people have used them globally, and cybercriminals are already leveraging this trend.
The types of cyberthreats hiding in QR codes
Most people will have witnessed phishing attempts that trick users into clicking on nefarious links in their emails. QR code-related threats work in a similar way.
One technique is QRLjacking, and attackers use every trick in the book by leaving codes on walls, buildings, and even computer screens that direct users to a malicious site. It could be as simple as placing a sticker on a bus stop advising passengers to scan so they can download an urgent government app update.
Quishing is another method that directs unsuspecting victims to a fake version of a popular website and prompts users to enter their login details.
Although these attacks are easy to set up, they often avoid detection from security systems that are scanning the content of emails for harmful text rather than suspicious barcodes.
As a result, some attackers use both email and QR codes to bypass corporate defences and steal Microsoft 365 usernames and passwords.
Another attack method involves cybercriminals setting up a free Wi-Fi network for anyone that scans the QR Code. This so-called honeypot attack enables attackers to silently steal data such as stored banking and credit card information. There are also more primitive methods, such as replacing QR codes in public places with an alternative sticker that re-directs users to harmful online content.
The Army Criminal Investigation Command’s Major Cybercrime Unit advised that scanning malicious QR codes can also add nefarious contacts to their contact list without their knowledge. But things can quickly escalate when completing telephone calls to premium telephone numbers or sending payments to a destination that cannot be recovered.
Think before you scan
The easiest way to stay safe is not to scan QR codes. Unfortunately, this is increasingly becoming impractical. Before contemplating scanning a QR code in public, take a few moments to verify the company looks legitimate. Does the URL you arrive at match what you are expecting? Any requests to immediately provide personal information or payment details should be avoided for obvious reasons.
If you are sent a QR code in an email, remember to greet it with the same suspicion you have with any links embedded in a message.
In addition, home users should ensure that they install security updates to their devices as soon as they become available rather than selecting ignore or remind me later (you know who you are).
Although most people would never open links sent from strangers or unsolicited messages, when it comes to scanning a code on a lamppost, many are guilty of letting their cyber defences down without even realizing it. The dangers of scanning codes without thinking serve as a timely reminder that everyone needs to be streetwise, both online and offline.
Protecting corporate devices
Business owners and IT administrators have three significant challenges. Firstly, they need to regularly perform integrity checks on their sites and apps, ensure their QR codes have not been hacked, and always display the correct information and links. Secondly, every corporate device should have multi-factor authentication along with a robust mobile defence solution that automatically blocks phishing attempts, phone take-overs, and unauthorized downloads.
Finally, every employer needs to arm its employees with training and awareness around cybersecurity best practices.
When combined, these three areas of focus can play a significant role in improving the security posture across the entire organization while also adding a layer of protection for staff when they are away from the office.
Just like phishing attempts and ransomware attacks, QR codes have been around for well over a decade. But their new mainstream status is increasingly making these small barcodes a top vector for cyberattacks. Although these mobile shortcuts can save time, they can also open users to sophisticated or crude cyberattacks with just one wrong scan.
The arrival of COVID 19 is also responsible for the new ubiquity of the QR code and a successful tech comeback story. However, because they have become so commonplace, users have become a little too relaxed when scanning them. With attacks predicted to increase exponentially throughout 2022, maybe we should all think before scanning the next QR code we encounter.