Cracking the Code: A Study on Exploitable Weaknesses in QR Code Technology

Year : 2024 | Volume : 12 | Issue : 02 | Page : 9 17
    By

    Aiswarya Dwarampudi,

  • Yamuna Mundru,

  • Manas Kumar Yogi,

  1. Assistant Professor, CSE Department, Pragati Engineering College, Near Kakinada, Kakinada District, Andhra Pradesh, India
  2. Assistant Professor, CSE –AI & ML Department, Pragati Engineering College, Near Kakinada, Kakinada District, Andhra Pradesh, India
  3. Assistant Professor, CSE Department, Pragati Engineering College, Near Kakinada, Kakinada District, Andhra Pradesh, India

Abstract

This study investigates the exploitable weaknesses inherent in quick response (QR) code technology, aiming to provide insights into potential security risks and mitigation strategies. QR codes, ubiquitous in modern society, serve various purposes ranging from marketing to authentication. However, their widespread utilization also renders them vulnerable to exploits by malicious actors. The research identifies common vulnerabilities such as data tampering, code injection, and phishing attacks, which can have significant consequences, including financial losses, data breaches, and privacy violations. To address these vulnerabilities, the study proposes a multifaceted approach encompassing authentication mechanisms, secure QR code generation practices, and user awareness programs. Furthermore, emphasizing compliance with industry standards and regulations is highlighted as a crucial aspect of QR code security. Through a comprehensive analysis of QR code weaknesses and their implications, this study underscores the importance of proactively addressing security risks to maintain trust and integrity in digital transactions involving QR codes. By enhancing QR code security measures and fostering collaboration among stakeholders, organizations and individuals can mitigate risks and ensure the reliability of QR code–based interactions in an increasingly interconnected digital landscape.

Keywords: Quick response (QR) code, pattern, security, data protection, encoding, decoding

[This article belongs to Journal Of Network security ]

How to cite this article:
Aiswarya Dwarampudi, Yamuna Mundru, Manas Kumar Yogi. Cracking the Code: A Study on Exploitable Weaknesses in QR Code Technology. Journal Of Network security. 2024; 12(02):9-17.
How to cite this URL:
Aiswarya Dwarampudi, Yamuna Mundru, Manas Kumar Yogi. Cracking the Code: A Study on Exploitable Weaknesses in QR Code Technology. Journal Of Network security. 2024; 12(02):9-17. Available from: https://journals.stmjournals.com/jons/article=2024/view=152690


References

  1. Dabrowski A, Krombholz K, Ullrich J, Weippl ER. QR inception: barcode-in-barcode attacks. In: Proceedings of the 4th ACM Workshop on Security and Privacy in Smartphones & Mobile Devices, Scottsdale, AZ, USA, November 7, 2014. pp. 3–10.
  2. Han X, Zhang Y, Zhang X, Chen Z, Wang M, Zhang Y, Ma S, Yu Y, Bertino E, Li J. Medusa attack: exploring security hazards of in-app QR code scanning. In: 32nd USENIX Security Symposium (USENIX Security 23), Anaheim, CA, USA, August 9–11, 2023. pp. 4607–4624.
  3. Tribak H, Gaou M, Gaou S, Zaz Y. QR code recognition based on HOG and multiclass SVM classifier. Multimedia Tools Appl. 2023; 83 (17): 1–30.
  4. Lin D, Stamp M. Hunting for undetectable metamorphic viruses. J Computer Virol. 2011; 7: 201–214.
  5. Mannan M, Barrera D, Brown CD, Lie D, Van Oorschot PC. Mercury: recovering forgotten passwords using personal devices. In: Financial Cryptography and Data Security: 15th International Conference, FC 2011, Gros Islet, St. Lucia, February 28–March 4, 2011. Revised Selected Papers 15 Berlin, Germany: Springer; 2012. pp. 315–330.
  6. Kals S, Kirda E, Kruegel C, Jovanovic N. SecuBat: a web vulnerability scanner. In: Proceedings of the 15th International Conference on World Wide Web, Edinburgh, Scotland, May 23–26, 2006. pp. 247–256.
  7. Ali H, Kharade KG, Kamat RK. An analysis and evaluation of vulnerability assessment tools. Cyberpsychol Behav Soc Netw. 2022; 25 (4): 448–456.
  8. Vuagnoux M, Pasini S. An improved technique to discover compromising electromagnetic emanations. In: 2010 IEEE International Symposium on Electromagnetic Compatibility, Fort Lauderdale, FL, USA< July 25–30, 2010. pp. 121–126.
  9. Elbaz L, Bar-El H. Strength Assessment of Encryption Algorithms. White Paper. Kefar Netter, HaMerkaz, Israel: Discretix Technologies Limited; 2000.
  10. Viega J, Bloch JT, Kohno T, McGraw G. Token-based scanning of source code for security problems. ACM Trans Inform Syst Security. 2002; 5 (3): 238–261.
  11. Phillips SK. Creating Feedback Channels with Optical Communications for Information Operations (IO). Doctoral Dissertation. Monterey, CA, USA: Naval Postgraduate School; 2016. Available at https://core.ac.uk/download/pdf/45464713.pdf
  12. Blaze M. Election integrity and technology: vulnerabilities and solutions. Georgetown Law Technol Rev. 2019; 4: 505–522.
  13. Black PE, Kass M, Koo M, Fong E. Source code security analysis tool functional specification version 1.0. Washington, DC, USA: US Department of Commerce, National Institute of Standards and Technology; 2007.
  14. Bletsch T, Jiang X, Freeh V. Mitigating code-reuse attacks with control-flow locking. In: Proceedings of the 27th Annual Computer Security Applications Conference, Orlando, FL, USA, December 5–9, 2011. pp. 353–362.
Regular Issue Subscription Review Article
Volume 12
Issue 02
Received 29/02/2024
Accepted 25/04/2024
Published 02/07/2024
544

Login


My IP

PlumX Metrics