{"id":38363,"date":"2024-07-04T14:52:13","date_gmt":"2024-07-04T13:52:13","guid":{"rendered":"https:\/\/www.intelligentcio.com\/north-america\/?p=38363"},"modified":"2024-07-23T09:52:54","modified_gmt":"2024-07-23T08:52:54","slug":"qr-codes-are-an-official-form-of-digital-access-to-olympics-locations-and-that-spells-potential-trouble","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/north-america\/2024\/07\/04\/qr-codes-are-an-official-form-of-digital-access-to-olympics-locations-and-that-spells-potential-trouble\/","title":{"rendered":"\u2018QR codes are an official form of digital access to Olympics locations – and that spells potential trouble\u2019\u00a0"},"content":{"rendered":"\n

Morey Haber, Chief Security Advisor, BeyondTrust on\u00a0the danger of Games-goers scanning one-too-many QR codes.\u00a0<\/strong><\/em><\/p>\n\n\n

\n
\"\"
Morey Haber, Chief Security Advisor, BeyondTrust<\/figcaption><\/figure><\/div>\n\n\n

This month\u2019s Olympic Games in Paris is notable because a quick response (QR) code is needed to pass physical security perimeters around the opening ceremony and competition venues. <\/p>\n\n\n\n

That goes for all people attempting to access the zones: workers, drivers, riders, attendees and more.  <\/p>\n\n\n\n

The QR code can either be stored in a smartphone app or printed out in hard copy and be presented for a scan. <\/p>\n\n\n\n

And that, for authorities, athletes, attendees, organisations and sponsors, is where a new attack vector may surface. <\/p>\n\n\n\n

Ever since the pandemic, when contact tracing, venue check-in and contactless ordering at hospitality venues thrust QR codes into the spotlight, there\u2019s been a proliferation in QR code use.  <\/p>\n\n\n\n

QR codes have become normalized and people are mostly unaware of how they can be misused – until after they scan one. <\/p>\n\n\n\n

And by then it\u2019s too late.  <\/p>\n\n\n\n

We have ultimately become trusting of their diverse and potentially malicious capabilities. <\/p>\n\n\n\n

In the case of Paris, the fact that QR codes are the official format for digital passes to the inner-city will legitimize them in the eyes of Games-goers. It also likely means third parties, within and outside the secure zones, will also display QR codes to expose visitors to a range of content or offers – some legitimate, others less so, like a simple watering hole attack.  <\/p>\n\n\n\n

The danger for Games-goers is that they could end up scanning one-too-many QR codes in their time at the event – and one of those scans could mask something nefarious. <\/p>\n\n\n\n

And it\u2019s not just Games-goers who are at risk. The same risk applies to authorities scanning QR codes at checkpoints – particularly as they\u2019ll be accepting paper-based printouts of codes. Given the demand for entry to areas, they may be presented with legitimate looking codes that turn out to be anything but.  <\/p>\n\n\n\n

Aside from declining entry to the person presenting that QR code, authorities may be unaware of what they\u2019ve just scanned, and what it has done on their device or to the network they\u2019re connected to. <\/p>\n\n\n\n

In 2020, I wrote an article titled: I Don\u2019t Scan QR Codes, And Neither Should You\u2019. <\/p>\n\n\n\n

The main point was the cybersecurity risks associated with QR code misuse: that by pointing a device at a QR code, you\u2019re trusting it takes you to a link or download that\u2019s genuine and not malicious.  <\/p>\n\n\n\n

But for anyone who\u2019s ever scanned one, they\u2019ll know it often displays a URL generated by a shortener.  <\/p>\n\n\n\n

While shorteners were once useful in character-constrained contexts (such as to achieve brevity in bite-sized social media posts), these days, many people recognise these links as suspicious. The ubiquity of QR codes is training people to override that caution – during the Games that could pose a major problem. <\/p>\n\n\n\n

The bigger challenge faced by Games-goers is that shortened URLs are just one of an ever-increasing variety of avenues to malicious content payloads that can be masked with a QR code. The reality is that QR codes can redirect users to information stored in a variety of formats.  <\/p>\n\n\n\n

For example, a QR code scan may contain contact information in a vCard format that gets automatically added to the user\u2019s address book; or it could more directly prompt the user to call a phone number or send a specifically worded SMS or email message from their device to an unknown recipient.  <\/p>\n\n\n\n

Other malicious uses of QR codes that have been observed include automatically connecting the scanning device to a nearby Wi-Fi network where Man-in-the-Middle and other traffic interception attacks become possible; or purporting to point the user to their app store to download an app – but taking them to a download hosted outside of the security of the official store.  <\/p>\n\n\n\n

In more sophisticated cases of malicious intent, the content displayed to the user might be dynamic, with the redirect based on contextual factors like where and when the QR code was scanned. <\/p>\n\n\n\n

To reduce the risk of falling victim to a QR code scanning attack during the Games, attendees and authorities\u2014as well as those watching the Games or interacting with Games-related content online\u2014can follow some simple rules if they need to scan a QR code: <\/p>\n\n\n\n

    \n
  1. Verify that the QR code is not a sticker or overlay. The poster\/flyer or other place where the QR code is displayed may be genuine, but a malicious actor might generate their own QR code on a sticker and place it over -a legitimate one. For web-based QR codes, confirm that the address of the website is legitimate and not a deliberately mis-spelled \u201clookalike\u201d page.\u00a0<\/li>\n<\/ol>\n\n\n\n
      \n
    1. Exercise care when scanning QR codes tied to performing financial transactions. For a parking meter, for example, only scan a code on the meter with a dedicated app for that parking operator. If the app doesn\u2019t recognise it, it simply won\u2019t accept payment. Scanning a code on the meter with your phone camera could compromise the device if that QR code turns out to be malicious.\u00a0\u00a0<\/li>\n<\/ol>\n\n\n\n
        \n
      1. Check any QR code that asks you to click on a link. This is the same attack vector when you receive a link by email, SMS, calendar invite, or any other format. Just scanning a QR code is similar to clicking on a link and you never know what the payload can be behind the image.\u00a0<\/li>\n<\/ol>\n\n\n\n
          \n
        1. For cyber teams responsible for corporate security, be on the lookout for suspicious behaviour associated with user accounts\u2014especially those accessing sensitive information or systems\u2014that might be attending the Games or sponsoring an event.\u00a0<\/li>\n<\/ol>\n\n\n\n
            \n
          1. Ensure multi-factor authentication (MFA) is enabled for anyone accessing corporate accounts associated professionally or personally with the Games. And remember, SMS text messages are not a secure method for two factor authentication.\u00a0<\/li>\n<\/ol>\n\n\n\n

            For all attendees of the Games, enjoy this historical event. For all cybersecurity professionals, having a view across all of the identities of attendees at the Games and their paths to privilege will allow you to pick up early warning signs that something is wrong.  <\/p>\n\n\n\n

            In this security professional\u2019s opinion, QR as an identity-based attack vector will be the easiest way to date for threat actors to compromise unsuspecting athletes, attendees, and organisations at the event. <\/p>\n","protected":false},"excerpt":{"rendered":"

            Morey Haber, Chief Security Advisor, BeyondTrust on\u00a0the danger of Games-goers scanning one-too-many QR codes.\u00a0 This month\u2019s Olympic Games in Paris is notable because a quick response (QR) code is needed to pass physical security perimeters around the opening ceremony and competition venues.  That goes for all people attempting to access the zones: workers, drivers, riders, […]<\/p>\n","protected":false},"author":58,"featured_media":38853,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[33,43],"tags":[162,164,2135,975,6590],"class_list":["post-38363","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-mobile","category-top-stories","tag-beyondtrust","tag-morey-haber","tag-olympics","tag-paris","tag-qr-codes"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/north-america\/wp-json\/wp\/v2\/posts\/38363","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/north-america\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/north-america\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/north-america\/wp-json\/wp\/v2\/users\/58"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/north-america\/wp-json\/wp\/v2\/comments?post=38363"}],"version-history":[{"count":13,"href":"https:\/\/www.intelligentcio.com\/north-america\/wp-json\/wp\/v2\/posts\/38363\/revisions"}],"predecessor-version":[{"id":38856,"href":"https:\/\/www.intelligentcio.com\/north-america\/wp-json\/wp\/v2\/posts\/38363\/revisions\/38856"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/north-america\/wp-json\/wp\/v2\/media\/38853"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/north-america\/wp-json\/wp\/v2\/media?parent=38363"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/north-america\/wp-json\/wp\/v2\/categories?post=38363"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/north-america\/wp-json\/wp\/v2\/tags?post=38363"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}