QR code vulnerability allows attackers to hijack branded domains

A security flaw in QR Tiger's custom domain feature, dubbed "QR Jacking," allows threat actors to hijack abandoned branded QR code domains. This vulnerability can redirect users scanning legitimate, previously printed QR codes to malicious websites, even though their phones initially display the company's authentic domain, with further coverage provided by Cyber Insider.

Security researcher Farzan Karimi discovered that QR Tiger's "Own Short Domain" feature does not adequately verify domain ownership when a custom domain is added. If a business stops using QR Tiger but leaves its DNS record pointing to the platform, an attacker with a separate QR Tiger account can claim that subdomain. This allows them to redirect traffic from existing QR codes, such as those on packaging or signage, to their own controlled sites.

Karimi identified hundreds of exposed subdomains across various sectors including manufacturing, healthcare, financial services, and technology. The technique could be used to direct users to phishing pages to steal credentials or personal information. While Karimi reported the issue to QR Tiger, no fix has been implemented. Organizations are advised to review their DNS records for QR platforms and remove unused integrations. Users should exercise caution when scanning QR codes, verifying the destination URL before entering sensitive information.

Source: Cyber Insider