156
"Scan to Verify You're Human": Google's reCAPTCHA is trialing a new "experimental challenge type" which requires desktop users to use an Android or iOS device to be able to pass it (thelemmy.club)
submitted 3 months ago* by to c/privacy@programming.dev
30 comments fedilink hide all child comments
 

I encountered this for the first time today while attempting to read something on archive.today.

I confirmed that decoding the qrcode using a computer and following the URL it contains is insufficient; the error it gave directed me here which is what the linked screenshot is of.

The old type of captcha remains available too, for now:

screenshot of text: Important: Mobile verification for Google Cloud Fraud Defense is an experimental challenge type in Preview. Visual and audio challenges are available as alternatives for users who can't complete mobile verification. To use them, click the Visual or Audio buttons.

OC writeup by @cypherpunks@lemmy.ml

you are viewing a single comment's thread
view the rest of the comments
[–] 56 points 3 months ago (6 children)
  1. Bad actors will start using clones of it with malicious QR codes to try and compromise your mobile device as well as your desktop one
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 2 points 3 months ago (3 children)

    I keep hearing about malicious QR codes, but how does it actually work? Unless there's a serious vulnerability, how is it different from clicking on any link?

    It has been a few years since I worked as a junior in offensive security, but that has been something I could never figure out when I looked into it.

    Hmm, I guess you could use it for a pretty good phishing attempt. Just show a fake google login page and you're set, or maybe a fake .apk download "to confirm the captcha", but other than that, I don't really see a vector of attack.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 8 points 3 months ago*

    This example might shed some light on how malicious QR codes can work.

    There's a lot of car parks in my area which have had QR codes stickered to the payment meters, instructing people to use the QR code to pay for their parking. These are council or private car parks, but the code takes you to a site that accurately mimics a usual carpark payment site. So people think they've paid for parking, but have actually sent money to a scammer, and they also end up with a fine for non-payment from the entity that actually owns the carpark.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 3 months ago

    Remember, not everyone is as tech savvy as us Lemmings.

    For some of them, who mainly use their phones for Facebook or whatever, if they go to log into a website, it pops up a QR code, they’d scan it, install whatever potentially malicious software it told them to, then give it whatever access it wanted. Boom, compromised phone.

  • permalink
  • fedilink
  • source
  • parent