It's called quishing when a criminal gets you on the hook via a QR code and you hand over personal information such as credit card details, passwords and your home address.

There are many hooks in our everyday environment today.

QR codes are found in hotels, gas stations, museums, restaurants, medical centers and many other places you trust. It takes a second for a criminal to cover a QR code with his own sticker. How would you tell the difference?

Via the fake QR code you are guided through a flow that feels like what you expect. It's just controlled by someone with nefarious intent.

The German magazine Auto Motor Sport reported earlier this week about how this affects gas stations. per.ax/autoqr

Imagine scanning a QR code at a charging station to start charging your electric car. You enter your credit card details and press start. But the charging doesn’t start. Because you just gave your card details to a criminal who put their own QR code sticker on the charging station.

A clever criminal will perhaps display an error message on the web page and redirect you to the real supplier, enabling you to start charging for real. In which case you may not even notice that money is being covertly withdrawn from your account until much later... or blame the charging supplier who is completely unaware...

But of course it doesn't just affect charging stations. It can happen anywhere.

Queuing systems at sampling locations increasingly rely on QR codes here in Sweden. Let's say a criminal covers this code with their own. You will arrive at a page that asks if you want to join the queue or pay the patient fee of 50 kronor in advance. You may know that you do not have to pay a patient fee. But does everyone know that? Maybe some will bite and pay.

If you join the queue, you will be directed to the correct queue. So not much to react to. And if you have paid the 50 kronor, you will then also be led to the correct queue.

The fake QR code can therefore go undetected for a long time.

As a company, do you know if someone perhaps has already covered your code and is quietly using it to create intermediate flows that steal personal data, or money? Do you have routines to check this? In some places, fake QR codes may live on year in and year out. Like a dripping data leak.

QR codes are in many cases a really, really bad idea from a security and privacy perspective. And it can be a real setback for your brand if people are duped on your premises. Or on your products.

So, do you encourage people to scan, or do you warn?

If I see a QR code in everyday life, I also see many ways to intercept and abuse it.

How did this vulnerability appear just about everywhere? It's as if QR codes have completely gone under the radar of security departments.

I will restructure this post for my blog/newsletter later, but didn't want to wait with my warning, after seeing the clear example from charging stations.

Quishing-Betrugsmasche bei Elektroautos

Eine neue Betrugs-Masche richtet sich gegen Elektroauto-Besitzer. Kriminelle versuchen, an Ladesäulen die Bankdaten zu klauen. So schützen Sie sich!

^{Claudius Maintz (auto motor und sport)}

It's time for ice cream! 🍦 😎

Enjoy your weekend and the sun. 🌞

#AndroidAppRain at apt.izzysoft.de/fdroid today brings you 12 updated and 2 added apps:

* Interstellar: client for Mbin & Lemmy
* SubTypo: a video subtitle editor/maker

Enjoy your #free #Android #apps with the #IzzyOnDroid repo

IzzyOnDroid F-Droid Repository

This is a repository of apps to be used with F-Droid. Applications in this repository are official binaries built by the original application developers, taken from their resp. repositories (mostly Github, GitLab, Codeberg).

^{IzzyOnDroid App Repo}

what a great idea for embedding software. that simplifies building by a ton!

„Over 100 separate source files are concatenated into a single large file of C-code named "sqlite3.c" sqlite.org/amalgamation.html

Dogs CAN climb and hers is some obvious proof of this.

Did some climbing at my local center yesterday ☺️

El juez imputa al presidente ultra del Parlament balear por un delito de odio por romper la foto de la republicana Aurora Picornell

eldiario.es/illes-balears/poli…

> Así lo ha acordado el magistrado tras admitir a trámite la querella interpuesta por el colectivo Estimada Aurora, impulsada por el abogado Sebastià Frau, quien decidió aunar a decenas de personas indignadas por el gesto de Le Senne (Vox), movidas principalmente por “un sentimiento de dolor y pena”

El juez imputa al presidente ultra del Parlament balear por un delito de odio por romper la foto de la republicana Aurora Picornell

Así lo ha acordado el magistrado tras admitir a trámite la querella interpuesta por el colectivo Estimada Aurora, impulsada por el abogado Sebastià Frau, quien decidió aunar a decenas de personas indignadas por el gesto de Le Senne (Vox), movidas pri…

^{Esther Ballesteros (ElDiario.es)}

#QT mas.to/@farbel/112938047573131… it NEVER fuckin fails…y’all will run through a minefield, losing limbs along the way, JUST to tone police someone else’s TL…if y’all don’t get a fuckin life things are gonna get very uncomfortable for you moving forward

Also, scrolling the fuck passed is ALWAYS the better option that is RARELY chosen

David Scott Moyer

2024-08-10 13:50:45

Why amplify Xitter trolls?

This is how white supremacy AND anti-Blackness indoctrinates

When I was growing up in the ‘70s & ‘80s ALL I saw was color…I saw white spaces and places where it was LITERALLY unsafe for me to enter; where ONLY white folx were respected as “Americans”

Two different realities 🤷🏾‍♀️

Oh hey, forgot about this open issue lol. ChromeVox on ChromeOS is so dead. I made an issue for a feature to jump to the next/previous spelling error detected in a text edit area, and well, it's as dead as the ChromeVox What's new document. Oh wait they've not been sending out what's new emails to the ChromeVox email list since like version 94 or so.

More seriously though, a ton of schools, and jobs, are switching to ChromeBooks. I'm not saying one cannot be productive on a ChromeBook, because I was able to. But *only* with the help of Chrostini (Linux support) and Android apps. So like, you seriously have to use every single feature to get work done that's more than just Email and Google Docs.

issuetracker.google.com/issues…
#ChromeBook #ChromeOS #ChromeVox #accessibility #blind

Kajakář Josef Dostál ovládl na olympijských hrách závod na 1000 metrů, zkompletoval svoji sbírku a vybojoval pro českou výpravu v Paříži třetí zlato. irozhl.as/rDZ

(📷 Yara Nardi, Molly Darlington / Reuters)

Im EU-Projekt #TREEADS wurde erstmals die #Selbstentzündlichkeit von #Waldböden nachgewiesen. Höhere #Temperaturen, längere #Trockenperioden und veränderte #Vegetationsmuster erhöhen das Risiko. Experimente zeigten, dass #Waldböden mit hohem organischen Gehalt sich selbst entzünden können. Die Erkenntnisse sollen zur #Waldbrandprävention und -bekämpfung beitragen. und in computergestützte Modelle zur Vorhersage von Waldbränden integriert werden.
#Klimawandel #Baumschutz

bam.de/Content/DE/Pressemittei…

Aktuelles - Waldbrandprävention: Neue Erkenntnisse zur Selbstentzündung von Waldböden

Im EU-Projekt TREEADS entwickelt die BAM gemeinsam mit der Otto-von-Guericke-Universität Magdeburg und weiteren EU-Partnern ein innovatives Brandmanagementsystem, um Waldbrände zu verhindern bzw. ihre Auswirkungen zu minimieren.

^www.bam.de

1/ So, so. Die #Bundeswehr möchte sich also mehr Vorbilder aus der Nazi-Zeit genehmigen. Es war nicht alles schlecht an der #Wehrmacht. Oder? Vielleicht bin ich in die falsche Schule gegangen, aber für mich klingt es wie ein absurde Idee, Menschen als Vorbilder einzustufen, die einen #Angriffskrieg befehligt haben.

taz.de/!6028911

Traditionserlass bei der Bundeswehr: Mehr Wehrmacht wagen

Die Bundeswehr erweitert den Kanon ihrer Soldaten, in deren Tradition sie stehen will. Bei manchen Wehrmachts-Soldaten will man es nicht mehr so eng sehen.

^www.taz.de

#Blakes7 Series D, Episode 10 - Gold

AVON: He may have, or he may not. That's what we are going to find out. I need hardly remind you to stay on your guard at all times.
DAYNA: Personally, I'm more worried about the in-flight link-up.

blake.torpidity.net/m/410/9 B7B1

Nearly everyone working on Nova Launcher has been laid off

theverge.com/2024/8/9/24217077…

Nearly everyone working on Nova Launcher has been laid off

Branch.io, which owns Nova, laid off more than 100 people, including most of the Nova Launcher team. It’s now down to just the original founder, Kevin Barry.

^{Jacob Kastrenakes (The Verge)}