Generations of QR codes and are they safe to use
By: Mohammad Hanief
While they may look simple, QR codes are capable of storing lots of data. But no matter how much they contain, when scanned, the QR code should allow the user to access information instantly – hence why it’s called a Quick Response code.
A QR code is a type of barcode that can be read easily by a digital device and which stores information as a series of pixels in a square-shaped grid. QR codes are frequently used to track information about products in a supply chain and – because many smartphones have built-in QR readers – they are often used in marketing and advertising campaigns. More recently, they have played a key role in helping to trace coronavirus exposure and slow the spread of the virus.
The first QR code system was invented in 1994 by the Japanese company Denso Wave, a Toyota subsidiary. They needed a more accurate way to track vehicles and parts during the manufacturing process. To achieve this, they developed a type of barcode that could encode kanji, kana, and alphanumeric characters.
Standard barcodes can only be read in one direction – top to bottom. That means they can only store a small amount of information, usually in an alphanumeric format. But a QR code is read in two directions – top to bottom and right to left. This allows it to house significantly more data.
The development team behind the QR code wanted to make the code easy to scan so that operatives did not waste time getting it at the right angle. They also wanted it to have a distinctive design to make it easy to identify. This led them to choose the iconic square shape that is still used today.
Denso Wave made their QR code publicly available and declared they would not exercise their patent rights. This meant anyone could make and use QR codes.
Initial uptake of the idea was slow; however, in 2002, the first mobile phones containing built-in QR readers were marketed in Japan. The use of smartphones led to an increase in the number of companies using QR codes.
In 2020, Denso Wave continued to improve on their original design. Their new QR codes include traceability, brand protection, and anti-forgery measures. There are many new uses for the QR code, from transferring payments to determining objects’ positions within augmented reality.
Most smartphones have built-in QR scanners, which are sometimes built in the camera. A QR scanner is simply a way to scan QR codes. Some tablets, such as the Apple iPad, have QR readers built into their cameras. Some older devices may require a particular app to read QR codes – these apps are readily available on the Apple App Store and Google Play.
Are QR codes safe?
Attackers can embed malicious URLs containing custom malware into a QR code which could then exfiltrate data from a mobile device when scanned. It is also possible to embed a malicious URL into a QR code that directs to a phishing site, where unsuspecting users could disclose personal or financial information.
Because humans cannot read QR codes, it is easy for attackers to alter a QR code to point to an alternative resource without being detected. While many people are aware that QR codes can open a URL, they can be less aware of the other actions that QR codes can initiate on a user’s device. Aside from opening a website, these actions can include adding contacts or composing emails. This element of surprise can make QR code security threats especially problematic.
A typical attack involves placing malicious QR codes in public, sometimes covering up legitimate QR codes. Unsuspecting users who scan the code are taken to a malicious web page which could host an exploit kit, leading to device compromise or a spoofed login page to steal user credentials. Some websites do drive-by downloads, so simply visiting the site can initiate a malicious software download.
Mobile devices, in general, tend to be less secure than computers or laptops. Since QR codes are used on mobile devices, this increases the potential risks. QR code-generating software does not collect personally identifiable information.
The data it does collect – and which is visible to the code’s creators – includes location, the number of times the code has been scanned and at what times, plus the operating system of the device which scanned the code (i.e., iPhone or Android).
The QR codes themselves can’t be hacked – the security risks associated with QR codes derive from the destination of QR codes rather than the codes themselves. Hackers can create malicious QR codes which send users to fake websites that capture their personal data such as login credentials or even track their geo location on their phone. This is why mobile users should only scan codes that come from a trusted sender.
How do QR codes work?
The patterns within QR codes represent binary codes that can be interpreted to reveal the code’s data. A QR reader can identify a standard QR code based on the three large squares outside the QR code. Once it has identified these three shapes, it knows that everything contained inside the square is a QR code.
The QR reader then analyzes the QR code by breaking the whole thing down to a grid. It looks at the individual grid squares and assigns each one a value based on whether it is black or white. It then groups grid squares to create larger patterns.
They can also be used to link directly to product pages online. For instance, if you were searching for the exact dress a model was wearing in a poster, a QR code could directly take you to the web page where you could purchase it.
The coronavirus pandemic has supercharged the use of QR codes. For example, in the UK, visitors to hospitality venues such as bars and restaurants are invited to scan a QR code upon arrival using the NHS Covid-19 tracing app. This is to help trace and stop the spread of the virus. If someone tests positive for Covid-19 at that venue, other visitors to the location are alerted by an app, thanks to the data accumulated from QR code scans.
You may also find QR codes on the packaging for some of your favorite products. These QR codes can reveal information about the product, such as nutritional information or special offers you can use next time you make a purchase.
QR codes were initially invented to help track parts in vehicle manufacturing, and they are still used throughout the manufacturing industry. You’ll also find QR codes used by other businesses that need to keep a close eye on products and supplies, such as the construction, engineering, and retail industries.
Postal services around the world also use them. Because they can contain a large amount of information, they are often relied upon to track parcels. For example, global fashion brand ASOS have moved entirely to QR codes for tracking refunds.
QR codes are also used in schools and colleges to help engage with students. They have appeared everywhere, from the classroom to the library, for tasks such as helping students find the books they are searching for.
With this network, India has shown on a previously unseen scale how rapid technological innovation can have a leapfrog effect for developing nations, spurring economic growth even as physical infrastructure lags.
The IDs ease the creation of bank accounts and are the foundation of the instant payment system, known as the Unified Payments Interface. The platform, an initiative of India’s central bank that is run by a nonprofit organization, offers services from hundreds of banks and dozens of mobile payment apps, with no transaction fees.
In markets where digital payments have taken hold, the raw excitement of the newly converted is palpable. App companies are working to ensure ease of use across a wide spectrum of digital literacy. Merchants on the same sidewalk help one another. And because this is technology we are talking about, children come to the aid of parents.
Small voice boxes provided by payment apps are a fixture at snack carts and tea stalls, where vendors are too busy to check phone messages after every small transaction. A Siri-like voice declares how much money was instantly received with each payment by QR code. This has helped bridge mistrust among merchants long used to cash transactions.
(The author is a regular columnist and can be mailed at [email protected])
