Remember QR Codes? They’re More Powerful Than You Think

Re:Remember QR Codes? They’re More Powerful Than You Think by shakna on Friday November 01, 2019 @07:51PM (#21424908)

This has actually happened before. [0]

> An exploitable code execution vulnerability exists in the QR code scanning functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted QR Code can cause a buffer overflow, resulting in code execution.

[0] https://talosintelligence.com/vulnerability_reports/TALOS-20...

[ Parent | on HN ]

Re:Remember QR Codes? They’re More Powerful Than You Think by theamk on Friday November 01, 2019 @11:53PM (#21425793)

Note that it was not in the QR scanner itself -- the parsing part was fine, the image was always decoded safely. It is the network setup script which parsed the extracted text which was vulnerable.

And this is not unique to QR codes -- the correct setup string looked like "b=USmtPf6GnLZYDuR9&s=PCheX14pPg==&p=AbCD123465". This already looks like gibberish to most people; if this was replaced with evil string, I am not sure user would realize that.

[ Parent | on HN ]