You’re in a car and driving past that vehicle. If you don’t have your phone ready already, you won’t get it out in time and won’t be able to scan the code. You didn’t read the code and didn’t need to (because you weren’t rubbernecking).
You’re in a car with your phone already out (because you’re expecting a crash) or you’re a pedestrian who takes out their phone to film the crash site. You do read the code and you should see it, because you’re rubbernecking.
I can't think of a single phone that automatically opens links that are in QR codes. The worst it would do is just show a link to malware, wish you would have to manually click in order to download the malware.
This was a few years ago (so I hope there have been patches since then) but I watched a video which was trying to make an entire game within a QR code: they don't have to just be links, they can be binaries that some devices will immediately run without question!
Quite the opposite. That video by mattkc (iirc) repeatedly and unequivocally says that to make this work, he made his pc save the binary and explicitly run it using a python script, because doing it natively would be fucking insane
Strongly reminds me of Old MacDonald Had a Barcode, E-I-E-I CAR. Basically put a standard anti-virus test string into various sorts of barcode and see what breaks.
Well, yes. You could bury code or malicious data in an image, QR or otherwise, and leverage an exploit that during processing of the visual data within the camera subsystem or inter subsystem calls could hypothetically trigger an execution path that results in a different outcome than expected, all without user permission. There is a lot of sw and hw sec controls in play at internal system boundaries and it would be very very difficult to gain privilege enough to fist fuck a phone but not impossible.
With the outstanding level of FR, NFR and Sec testing that companies perform these days it is not likely to happen. It's not like they push out minimal viable products or something, right? /S
Well that's one layer, but when you decode a url, you're probably going to get a url, and then it's going to go to that url
So now you just made them to to a website. What's there? Whatever you want. Maybe you ask them for Facebook/Google/GitHub or whatever authorization to see their name and email, which a lot of people would do. Then redirect them to a page saying "now I know who you are, delete the photo, <user>"
Or you could send them a payload based on fingerprinting their request, you could give them a fake page to steal their password, etc