News for hackers. Stuff that matters.

A comment on When One App Rules Them All: The Case of WeChat and Mobile in China. Parent comment

Re:When One App Rules Them All: The Case of WeChat and Mobil... by antimagic on Tuesday August 11, 2015 @06:22AM (#10040027)
Oh no. Here's how an attack might go. I'm a shop assistant and show you a QR code to scan to make a purchase. Unknown to you, I'm not actually showing you the real app, but a fake app with fake QR code that will redirect you to a malicious website, which in it's turn will load the proper URL after having executed an unpatched zero-day on your device. You are sad because your device has just been pwned.

You are at the mercy of the source of the QR code, with no real way of being able to validate it before scanning.

[ Parent | on HN ]
Re:When One App Rules Them All: The Case of WeChat and Mobil... by rahimnathwani on Tuesday August 11, 2015 @07:23AM (#10040225)
This attack wouldn't work. Scanning a QR code which goes to a non-WeChat URL will flip to WeChat's built-in browser, which looks very different from the payment dialogue box.

In any case, how are QR codes different from text URLs? Do you check the destination of every web link and/or button before clicking? Do you disable JS so that you can be sure that the URL displayed in the status bar isn't different from the one which will really be launched?

[ Parent | on HN ]
Re:When One App Rules Them All: The Case of WeChat and Mobil... by bouyoul420 on Tuesday August 11, 2015 @07:07AM (#10040179)
In this case, the scanning is done by the Wechat app not some general-use browser. You would assume they check the validity of the data in the QR code and don't do simple redirection to a random web page.
[ Parent | on HN ]
Re:When One App Rules Them All: The Case of WeChat and Mobil... by EliRivers on Tuesday August 11, 2015 @07:00AM (#10040158)
What you say is true, and makes no difference. QR codes are very popular and in very common use in China.
[ Parent | on HN ]
Re:When One App Rules Them All: The Case of WeChat and Mobil... by djyde on Tuesday August 11, 2015 @09:05AM (#10040670)
Yup, now when I wanna pay for some drink, I only need to take out my mobile, then open wechat, then scan the QR code showed on the vending machine screen.

Like this: http://i.imgur.com/mlIr3QP.jpg

[ Parent | on HN ]
Re:When One App Rules Them All: The Case of WeChat and Mobil... by tellthetruth1 on Tuesday August 11, 2015 @10:45AM (#10041416)
Vending machines in the US only take coins, like a post-apocalyptic stone age world. So ahead of time...
[ Parent | on HN ]
Re:When One App Rules Them All: The Case of WeChat and Mobil... by erikb on Tuesday August 11, 2015 @01:20PM (#10042758)
Yeah, but you don't show your QR Code, I show mine. Your trick can be to grab more money from me than you put on your price tag.
[ Parent | on HN ]