Web Insecurity: Barcodes for breaches

[terriko]

This post is so short that I figured I might as well copy the whole thing from Web Insecurity. Sorry about the full duplicate!

Barcodes for breaches

Barcode: <script>alert("test")</script>

I'm highly amused by the XSS, SQL Injection and Fuzzing Barcode Cheat Sheet. Who knew security attacks could look almost... pretty? It's just standard XSS and SQL injection test code translated to bar codes, so they could be used as injection vectors. I know I've scanned codes to grab an app I want faster on my phone, and I'm seeing codes popping up in the free daily papers, which I find somewhat interesting given that early attempts to get people to use barcodes have met with commercial failure and ridicule. Oh well, it's all ok now that we have smartphones, right?

Anyhow. This is still an entertaining attack vector. Maybe governments (such as my own!) will ban bar codes as hacking tools next?

Comments

[ivy]

That's hilarious! I'm totally going to have to link that; I'm discussing QR barcodes on my post about ShmooCon. Thanks!