Back to basics

What is a QR code?

QR codes, short for Quick Response codes, are digital barcodes made up of a pattern of black squares arranged on a white background. Think of them as a way for your phone to quickly read and understand information.

When you scan a QR code, your device translates the pattern of squares into useful information, like a website link, a text message, contact details, or even a Wi-Fi network login. So, instead of typing a long web address or manually entering information, you can simply point your phone at a QR code, and it instantly gives you access to whatever information or action the code is linked to.

It is a quick and convenient way to connect digital content with the physical world. In an age where convenience is key, QR codes have become an increasingly common sight, leading to them becoming a new avenue for cyber criminals to exploit.

What is quishing?

Quishing involves the use of QR codes to trick unsuspecting users into revealing sensitive information or downloading malicious software onto their devices. Attackers create fraudulent QR codes that appear legitimate but actually redirect users to malicious websites, fake login portals, or malware-infected apps. These malicious sites or applications are designed to steal personal information such as login credentials, financial data, or even install ransomware on the victim’s device.

Quishing attacks are increasing in frequency and success, with incidents cropping up in every sector.

How does quishing work?

The process of quishing typically follows these steps:

• Creation of fraudulent QR codes: attackers create and plant QR codes that mimic legitimate ones. Once users enter their credentials or personal information, it is harvested by the attackers for fraudulent purposes
• Social engineering tactics: attackers employ social engineering tactics to entice victims into scanning the QR code within phishing emails, text messages, or physical materials. This could involve offering fake incentives, such as discounts or prizes, to encourage users to scan without suspicion
• Redirect to malicious content: upon scanning the QR code, users are redirected to a malicious website or prompted to download a malicious application disguised as a legitimate one
• Data theft or malware installation: once on the malicious site or app, users may be prompted to enter sensitive information, which is then harvested by the attackers. Alternatively, malware may be silently installed on the user’s device, compromising its security and integrity

Staying safe: how to prevent quishing

To protect yourself and your organisation from quishing attacks, it’s important to stay vigilant while considering cyber security best practices:

• Scrutinise before scanning: before scanning any QR code, examine it closely for signs of tampering or suspicious elements. If it looks dubious or out of place, don’t scan it
• Verify the source: only scan QR codes from trusted sources. Avoid scanning codes from unknown or unsolicited sources, such as random emails, texts, or advertisements. Before visiting any website linked to a QR code, inspect the URL for signs of suspicious or misspelled domains. Be cautious of shortened URLs, as they can conceal the true destination
• Use QR code scanning apps wisely: most smartphones come equipped with built-in QR code scanners, so if a QR code requires you to download a scanning app it may be a scam that requires a third-party application to download malware
• Stay updated: keep your device’s operating system, antivirus software, and apps up to date to mitigate security vulnerabilities that cyber criminals could exploit through quishing attacks
• Enable two-factor authentication (2FA): whenever possible, enable two-factor authentication on your online accounts. This adds an extra layer of security, making it more difficult for attackers to gain unauthorised access even if they manage to obtain your credentials through phishing
• Educate others: spread awareness about quishing among your friends, family, and colleagues. Educating others about the risks associated with scanning unknown QR codes can help prevent them from falling victim to such attacks

In today’s world, threat actors will do anything to get a hold of your data or exploit your devices with malware. Quishing is easy to fall victim to, so make sure you stay vigilant and put in place proactive measures to mitigate the threat. By staying informed, exercising caution, and following best practices for online security, you can help protect yourself and others from falling victim to quishing attacks.