TOYING WITH BARCODES

The rise of 2D barcodes started to put them into customer hands as authentication, authorization, payment method and other arbitrary data transport. The implicit trust in them is enormous.

Felix Lindner gives a very quick intro into barcodes and then proceeds to review the contents of selected samples, including their usage in the real world.

The rise of 2D barcodes started to put them into customer hands as authentication, authorization, payment method and other arbitrary data transport. The implicit trust in them is enormous.

Felix Lindner gives a very quick intro into barcodes and then proceeds to review the contents of selected samples, including their usage in the real world.

Hacking

Hacking

Programming

Information security

Source

About the speaker

Felix ‘FX’ Lindner is the technical and research lead of Recurity Labs with 18 years computer technology experience. He possesses a vast knowledge of computer sciences, telecommunications and software development.

His background includes managing and participating in a variety of projects with a special emphasis on security planning, implementation, operation and testing using advanced methods in diverse technical environments.

Connect

<div style="width:120px;height:1px;background-color:#f2f2f2;margin:0px auto;"></div>

About the speaker

Felix ‘FX’ Lindner is the technical and research lead of Recurity Labs with 18 years computer technology experience. He possesses a vast knowledge of computer sciences, telecommunications and software development.

His background includes managing and participating in a variety of projects with a special emphasis on security planning, implementation, operation and testing using advanced methods in diverse technical environments.

Resources

<blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr">One of the demos of our talk "BadBarcode: How to hack a starship with a piece of paper". See you in PacSec 2015. <a href="https://t.co/tu8XZjegHP">pic.twitter.com/tu8XZjegHP</a></p>— Yang Yu (@tombkeeper) <a href="https://twitter.com/tombkeeper/status/663730674017300480">November 9, 2015</a></blockquote> <script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>

Barcode attack technique (Badbarcode)

The concept of using barcode to launch attack is raised years ago, but no one digs deep. By using SQL barcode, it’s able to launch SQL injection, XSS and overflow attack. Read more

One BadBarcode Spoils Whole Bunch

“We do not know what the bad guys might do. BadBarcode can execute any commands in the host system, or [implant] a Trojan,” said Yang Yu. Read more

What’s in a Boarding Pass Barcode? A Lot

Two-dimensional barcodes and QR codes can hold a great deal of information, and the codes printed on airline boarding passes may allow someone to discover more about you, your future travel plans, and your frequent flyer account. Read more

Resources

<center><blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr">One of the demos of our talk "BadBarcode: How to hack a starship with a piece of paper". See you in PacSec 2015. <a href="https://t.co/tu8XZjegHP">pic.twitter.com/tu8XZjegHP</a></p>— Yang Yu (@tombkeeper) <a href="https://twitter.com/tombkeeper/status/663730674017300480">November 9, 2015</a></blockquote> <script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script></center>

Barcode attack technique (Badbarcode)

The concept of using barcode to launch attack is raised years ago, but no one digs deep. By using SQL barcode, it’s able to launch SQL injection, XSS and overflow attack. Read more

One BadBarcode Spoils Whole Bunch

“We do not know what the bad guys might do. BadBarcode can execute any commands in the host system, or [implant] a Trojan,” said Yang Yu. Read more

What’s in a Boarding Pass Barcode? A Lot

Two-dimensional barcodes and QR codes can hold a great deal of information, and the codes printed on airline boarding passes may allow someone to discover more about you, your future travel plans, and your frequent flyer account. Read more