Brian Jackson - Fotolia

Q
Problem solve Get help with specific problems with your technologies, process and projects.

How is Apple iOS 11 affected by a QR code vulnerability?

A QR code vulnerability was recently discovered in the Apple iOS 11 camera app. Learn how an attacker could exploit it and how to avoid the issue with Judith Myerson.

A QR code vulnerability was discovered in the camera app of the first version of Apple iOS 11. How could an attacker exploit this vulnerability? What precautions should users take?

An attacker could exploit the QR code vulnerability in the reading function of the camera app included with the first version of Apple iOS 11 by manipulating the URL that is displayed in the QR code scanning notification on the victim's device. When the victim taps on the notification, they can be redirected to a malicious website and prompted to share sensitive information.

This type attack may be successful if the URL parser of the QR code reader fails to detect the host name the victim enters into the search bar when creating a QR code.

German security expert Roman Mueller discovered the iOS camera app was misreading certain URL formats and selecting the wrong part of a URL as the main domain, such as https://xxx\@facebook.com:443@infosec.rm-it.de/. When Mueller scanned the QR code, he received a notification asking him to tap facebook.com to visit the website in Safari. After tapping the notification, he was redirected to https://infosec.rm-it.de. The camera app then failed to detect facebook.com as the host name and he visited a different URL than was displayed in the notification.

The URL parser detected xxx\ as the username to be sent to facebook.com:443, while Safari detected xxx\@facebook.com as the username and 443 as the password and sent it to infosec.rm-it.de -- the browser didn't recognize port 443 for HTTPS. After this realization, Mueller reported the flaw to Apple in December 2017 and it was fixed in iOS 11.3.1.

If users are scanning QR codes with iOS 11.2.1, they should take several precautions to avoid this QR code vulnerability. These precautions include checking the URL when they are redirected to another website, clearing out cookies or any history of connecting to the website, and not entering sensitive information into a suspicious website.

Ask the expert:
Want to ask Judith Myerson a question about security? Submit your question now via email. (All questions are anonymous.)

This was last published in July 2018

Dig Deeper on Alternative operating system security

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

Join the conversation

1 comment

Send me notifications when other members comment.

Please create a username to comment.

How have QR code reader vulnerabilities affected your iOS devices?
Cancel

-ADS BY GOOGLE

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly.com

Close