1mo ago

'Quishing' scams dupe millions of Americans as cybercriminals turn the QR code bad

www.cnbc.com

KEY POINTS

Almost three-quarters of Americans (73%) scan QR codes without verification, and more than 26 million have already been directed to malicious sites, according to NordVPN.

The FTC warned earlier this year about scanning QR codes on unexpected packages.

New York City’s Department of Transportation issued a warning that scammers are posting QR codes on parking meters that are not legitimate payment links.

24 comments

I quite dislike the word "quishing"
- It sounds like the "shart" equivalent but with a queef instead of a fart.
  
  It describes the water breaking
- qhy?
- It sounds like I stepped on a slug.
  
  On cam. For money.
  Or at least for a loot box, if the AI likes you.
- It sounds like an old timey STD, like chlamydia but instead of having the clap ya have the quish. Quick someone help me come up with symptoms, I'm going with necrosis since it can make flesh squishy and that sounds about right for the name.
- Took me a while to figure out what it meant, « QR Code Fishing »
  
  I still think it might be a sex act.
malicious qr codes have always been around. i remember the local news reports of them plastered to store directories at the mall. ya, that long ago.
- I remember going to defcon in 2016 and there was a guy wielding a foam sword with a qr code t-shirt that said "scan me", and when you scanned it and told him it said "arrrr", he'd beat you with the sword while berating you for scanning an untrusted code.
  Damn I'm just realizing that was almost 10 years ago
- Yeah. Took like a day after they were publicly available , lol
- Yup, they were always a terrible idea
I'm confused, isn't this just as risky as seeing a URL in the wild and typing it into your phone? Don't all phones display the URL you are about to visit?
The problem isn't the QR code itself, correct? It's a lack of education, and an incurious public that has no interest in learning about the technology that they depend on.
Seems like a skill issue.
- No, because phones don't show the URL you are going to. I can go to a restaurant and scan the menu, but the link that it shows me is "qrl.io/asccand....." because A) the restaurant used a URL shortener, and B) the phone truncates the URL to fit in the space.
- My phone gives me about 20 characters.
Please note: Le source is le NordVPN
Just saying:
The statistic can not be applied to the wider population, since People who use such Services on a day to day Basis are usually the same ones who believe the lies NordVPN is throwing at them.
It would be like going to a ecstasy dealer and asking them how many people like drugs. Of course they will answer everyone, first because they have an incentive to advertise their services (nord advertises their VPN + Antivirus for blocking Malware) and even if they try to be neutral, they just don't have the data, since people who go to a Dealer are likely to like drugs, the same way people who believe Nord are the same ones who are likely to fall for such things
- It really does irk me that they pretend their service makes the internet safer for their users.
  They have a good product in their VPN+Meshnet, but it wouldn’t have nearly the broad appeal it does if they were honest about it.
I find it difficult to have sympathy for people who suffer predictable consequences after scanning unknown QR codes left in public.
- What about the loads of restaurants that use them for menus?
  
  Clearly those restaurants are cheap shitholes and don't deserve business. What ever happened to having a board, if you don't want individual menus just put up a couple boards that are visible from the tables and booths.
  
  A QR code handed to you by a restaurant employee would not be "unknown." I was thinking of codes found left at a bus stop or something.
  Also, QR code menus are a dick move by a restaurant, and I would just walk out, personally.
- I don't go around scanning random codes, but often times I have to scan a code for something like paying for parking. How can I know if someone put a sticker over it with a malicious URL?
Wow that’s a great (criminal) idea to make money. I guess that’s fraud? I suppose it depends on the wording and the fine print.

24 comments