{"id":28860,"date":"2013-09-04T06:00:31","date_gmt":"2013-09-04T13:00:31","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=28860"},"modified":"2025-08-08T04:02:24","modified_gmt":"2025-08-08T11:02:24","slug":"where-oh-where-does-that-qr-code-lead","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/mobile-security\/where-oh-where-does-that-qr-code-lead\/","title":{"rendered":"Where, oh Where, Does That QR Code Lead?"},"content":{"rendered":"

What is square, flat, and black and white all over? If you answered \u201ca QR Code\u201d, you\u2019re correct. One of the latest trends in consumer advertising, QR codes (short for \u201cQuick Response\u201d) are popping up on everything from billboard advertisements to restaurant menus, business cards and cereal boxes. Some can even be viewed from Google Maps, painted on the roofs of office buildings. They\u2019re everywhere. Used mostly for advertising and promotional campaigns until recently, new research shows that these seemingly harmless square graphics, while fun to scan and follow, may bring about more harm than good.<\/p>\n

A close cousin to the more traditional UPC \u201cbarcode,\u201d the QR code first came into existence in Japan in 1994, as a means of quickly tracking automotive vehicles during the manufacturing process. Unlike conventional barcodes, QR codes are two-dimensional. This means that they can store data both horizontally and vertically, giving them the ability to store more than 100 times the amount of information as a conventional barcode.<\/p>\n

Recently, QR codes have become more commonplace, found in advertisements, on retail items, and a slew of other fun and functional uses that we might not even notice. And with the rise of smartphone ownership, users now have the ability to scan these codes, giving companies additional incentive to use them in more creative and visible manners. By placing QR codes on company promotional material, advertisers are able to direct the user to a website or video, enable them to enter an online contest, or even download an app \u2013 simply with the scan of a code.<\/p>\n

Herein lies the problem. The problem with such simple access to information through QR codes<\/a> is precisely what makes them so much fun \u2013 the element of surprise. Until your QR code reader redirects you to the intended destination, you are in the dark about what that destination will be. In this regard, it\u2019s different from clicking on a link or manually typing a URL into your Internet browser. Simply put, there is a component of blind trust involved, and cybercriminals are beginning to take advantage of this aspect.<\/p>\n

Anyone can create a QR code in roughly 30 seconds. All you need to do is visit any number of free websites that allow for the creation of these codes, enter your intended information (a website, application, virtual business card, GPS map location, or image link) for the code to point to. Smartphone users, it\u2019s even easier for you, as any number of QR scanner mobile apps also have this create-your-own-code function. And then viola, you have yourself a QR code that you can save as an image, possibly to print out for later, send in an email, add to your blog or any other number of uses. All a scammer has to do is insert a link to their malware-laden site or app. Then, once the code is created, the scammer can print some flyers or stickers\u2014even paste the new QR code over another company\u2019s legitimate one\u2014to lure in unsuspecting victims.<\/p>\n

A common tactic for QR code scammers is to point the victim to a website that contains a Javascript Trojan<\/a>. When the website loads, the JavaScript automatically runs, infiltrating your system and embedding the Trojan which can then work to leach your data and send it back to the hackers for oftentimes illegal use. According to CSO Online<\/a>, some malicious QR codes can even enable a hacker to control mobile phones to access your messages and GPS location-tracking data, turn on your camera, and listen in on phone conversations.<\/p>\n

Precautions to Take When Scanning QR<\/h2>\n

Given the apparent inability for you to discern between which QR codes are safe, and which are not, there are certain precautions that should be taken prior to scanning that little 2-D box:<\/p>\n