9.6 The Emergence of Quishing (QR Code Phishing)
What a QR Code Really Contains
A QR code is not a link object; it is a bit stream drawn as squares. Byte mode (indicator 0100, raw ISO-8859-1 or UTF-8 bytes) writes a character-count field, lays the URL's ASCII bytes into data codewords, then appends Reed-Solomon error-correction codewords at one of four levels, L through H. Those codewords are placed module by module along a zigzag path, XORed with one of eight masks, and framed by finder, timing, and alignment patterns so a tilted camera still registers the symbol. Capacity is tiny: about 62 bytes in a version-3 (29x29) symbol at ECC L, 78 at version 4, so long URLs balloon the matrix. Nothing inside is a URL per se: the payload is a plain string handed to whatever OS handler runs -- possibly tel:, WIFI:, or vCard data.
Error Correction Is the Feature Abusers Want
Reed-Solomon redundancy lets ECC H recover roughly 30 percent of codewords, why a scratched or faded code still scans -- and why an attacker's sticker pasted over a legitimate code on a parking meter or printed invoice decodes cleanly. The same slack enables inversion, rotation, a code inside an illustration, or structured-append halves that concatenate into one URL.
Why Gateways Cannot Inspect a Raster
Secure email gateways are text machines: they walk MIME parts, extract URLs from text and HTML bodies, score them against reputation feeds, rewrite them through a click-time detonating proxy, and sandbox attachments. A PNG or JPEG QR contains none of that: no URL string to score, nothing to rewrite, no proxied click to detonate. QR decoders exist now but are evaded by embedding the code in a PDF screenshot or composite image, and legitimate business-card codes make blunt blocking a false-positive engine. The body text reads as ordinary routine, leaving content heuristics little to grab.
Delivery Mechanics and the Shifted Perimeter
Templates lean on tasks with an implicit mobile answer: mailbox quota exceeded, MFA re-enrollment, an invoice, a redelivery notice -- always "scan with your phone camera". That instruction is the exploit: it routes execution to an unmanaged handset outside corporate proxy, DNS filtering, browser isolation, and EDR. Landing pages serve mobile-only content (an APK with a fake store badge), mint a unique one-time path per scan so blocklists see only single-use URLs, geofence access, and present a free ACME certificate so the padlock reassures. Against federated login an adversarial relay proxies the real identity provider, so OTP assertions get forwarded and the session token is harvested.
Moving the Perimeter Back
Policy must cover the endpoint the message chooses: never act on an unsolicited code, use a scanner that shows the decoded string before opening, or type the address yourself; scan only on a managed, filtered device. Report QR-only mail so the pretext text becomes the detection signal.
Architecture Diagram
Key Takeaways
- A QR code is a bit stream: mode indicator, byte-mode codewords, Reed-Solomon ECC, mask, and finder patterns -- the "link" is just a plain string.
- Error correction is the abuse feature: damaged, overlaid, or sticker-swapped codes still decode reliably.
- Gateways score text; an opaque raster gives them no URL to reputation-check, rewrite, or detonate.
- "Scan with your phone" deliberately moves execution to an unmanaged device outside proxy, DNS, and EDR coverage.
- Decode to text and verify the domain, or type it yourself; report QR-only mail so the pretext becomes the detection signal.