Editor's note

QRjacking
A malicious sticker can be pasted over the original
sticker, e.g. on public advertisement in the street or
other public spaces, simply replaced where possible
– websites, brochures etc.
Scanjacking
The scanned barcode would redirect to malicious web
site or run any malicious code. Hence, various attacks
can be executed, e.g. phishing, man-in-the-browser
(form of man-in-the-middle attack), SMS abuse (social
engineering is required) etc.
IPhone users and application permissions
IPhone devices can be divided into two main categories
– legal (factory default configuration) and jailbroken
(running a hacked, modified operating system version).
On one hand, legal iPhone devices can execute only
Apple-approved applications, which may lower the total
risk of getting malicious software on the device. On the
other hand, the jailbroken devices are more vulnerable
to malicious applications since these devices allow
installation of applications which had not been checked
and verified by Apple.
There are several options to install applications on
iPhones: App Store, iTunes, iPhone configuration
utility and over-the-air (from a web server). Of course,
Cidya and Installous are also available on jailbroken
devices.
One thing is certain about both the legal and most of
the jailborken devices – they have a default password
for the root user; by default it’s alpine (without the
quotes, of course).
Why is this interesting? By default, applications
don’t have root access to the iPhones but instead are
provided with a limited access by the user mobile (for
which the default password is dottie). In order to get root
privilege access, we need to do some coding as will be
explained later in this article.
starterkit 02/2011(2)
QR botnet
After understanding QR threats and iPhone limitations, I
can explain the idea behind the title of this article.
In order to build a botnet we need to combine
the threats of the QR code readers with the iPhone
limitations.
The main idea of this attack is to install a malicious
application from a web server directly on the iPhone. It
almost does not matter whether the iPhone is legal or
jailbroken with default root password.
Step 1: Locate vulnerable QR reader
Since we would like to install an application from a web
site, the QR reader should have automatic redirection to
URL. I have been testing the following 10 applications
on my iPhone with iOS 5: QRReader, RedLaser,
QR+, ShopSavvy, Scan, ConnectMe, HP CodeScan,
ATTScanner, ScanLife and i-Nigma. To make it close
to the reality, I searched the word QR in App Store and
downloaded the first 10.
I generated a QR code for a website and scanned
the code in each application. The following applications
have automatic redirection: QRReader, ShopSavvy,
Scan, HP CodeScan, ScanLife and i-Nigma. Summary:
6 of 10 were vulnerable to automatic redirection, e.g. i-
Nigma opens Safari automatically and redirects to the
requested page, see screenshot in Figure 2.
What should appear when automatic redirection is
disabled? See screenshot of RedLaser’s question in
Figure 3.
Figure 2. Automatic redirection in Safari Figure 3. Popup on non-redirecting QR reader
Page 7 http://pentestmag.com