If you regularly use your phone to scan QR codes, be careful — you may not be headed to the site you think you are.
iOS 11 brought us many wonderful features, including the ability to read QR codes using the iPhone's native camera app instead of a third-party QR code reader. Unfortunately, according to a report by Infosec, there is a vulnerability in the iOS camera's reader that is pretty easily exploited, taking you to a malicious website without your knowledge.
Basically, when you scan a code that's meant to lead you to a certain site, the site's URL will appear in a pop-up that you need to tap in order to visit the page displayed. However, Infosec found that if you embed a URL in a QR code in a certain format, you can essentially fool the reader, causing it to display one URL but take you to another one entirely. By inputting the "fake" URL and actual URL into the QR code like this ...
https://xxx\@facebook.com:443@infosec.rm-it.de/
... individuals can exploit the vulnerability and — in this particular case — make the user believe that they're headed to Facebook when in reality, they're headed to the Infosec website.
The article hypothesizes that this occurs because the hostname is able to slide under the radar of the URL parser of the camera app in a way it isn't able to in Safari:
It probably detects "xxx\" as the username to be sent to "facebook.com:443". While Safari might take the complete string "xxx\@facebook.com" as a username and "443" as the password to be sent to infosec.rm-it.de. This leads to a different hostname being displayed in the notification compared to what actually is opened in Safari.
Apparently, Infosec made Apple aware of this vulnerability in December of last year, but the company has yet to provide any sort of fix or response.
If you want to (safely) try it for yourself, you can scan Infosec's QR code below.
Questions?
Have you encountered this exploit while scanning a QR code? Share in the comments below.
Betas never stop: The fifth developer beta for watchOS 8.7 is out now!
The fifth beta of watchOS 8.7 is now available to developers.
Buying a Mac monitor comes down to whether you like tiny pixels or not
Buying a monitor for your Mac can be either infuriatingly complicated or the easiest thing in the world, money notwithstanding. Many of the concerns Mac buyers had were fixed when Apple announced the Studio Display in early 2022 — but that isn't the end of the story.
Terrifying AirTag tracking saga detailed by actor who was being followed
Apple's AirTag item trackers are again at the center of a report that claims that one of the coin-sized devices was used to track an actor as she walked around Disneyland.
Deck your dorm with the coolest stuff
Dorm rooms can be plain, so you're going to want to deck it out with as much cool stuff as you possibly can - here are our picks for the essentials!