All QR codes used in public places are vulnerable to a hijack attack by stickers.
By generating QR code stickers that are of roughly the same dimension as the targeted advertisements QR code, and laying it over the original QR code, an attacker can hijack any advertisement.
Since a QR code has to be physically accessible to the user to be scanned, all QR codes are effectively vulnerable. While this attack wont work large scale, it could be deployed in targeted high-traffic areas such as bus stops or retail locations.
Given the sudden prevalence of QR codes by retailers and advertisers, we feel its only a matter of time before hacktivists begin exploiting this flaw as a way of culture jamming.
By generating QR code stickers that are of roughly the same dimension as the targeted advertisements QR code, and laying it over the original QR code, an attacker can hijack any advertisement.
Since a QR code has to be physically accessible to the user to be scanned, all QR codes are effectively vulnerable. While this attack wont work large scale, it could be deployed in targeted high-traffic areas such as bus stops or retail locations.
Given the sudden prevalence of QR codes by retailers and advertisers, we feel its only a matter of time before hacktivists begin exploiting this flaw as a way of culture jamming.