Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #400

Re: New Metasploit module gets a shell using just a QR code; affects 70% of android devices.

Show all headers | View raw

cykros@devio.us wrote:
> cykros writes: New "WebView" exploit module for Rapid7's Metasploit
> creates QR codes that, when scanned by any Android device running
> version 4.2 or earlier (70% of Android devices) return the creator
> of the QR code with a shell for remote code execution. Questions
> arise as to who should be leaned on to provide a fix for this, as
> Google already has fixed the code in the most recent version of
> Android.
>
> https://community.rapid7.com/community/metasploit/blog/2014/02/13/weekly-metasploit-update?et=watches.email.blog
>
>
>

Those QR codes always seemed like a bad idea to me.  Shortened URLs are 
bad enough (though I sometimes use them), but a graphic image provides 
no clear information, almost like it's binary.

Seems like QR codes and goat.se links would be a match made in heaven. 
Kind of the iphone version of chatroulet: click on the link with your 
smartphone camera, and if you're unlucky, you're face to face with a 
brown-eye seconds later ...

Back to comp.misc | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

New Metasploit module gets a shell using just a QR code; affects 70% of android devices. cykros@devio.us - 2014-02-13 21:04 +0000
  Re: New Metasploit module gets a shell using just a QR code; affects 70% of android devices. RS Wood <rsw@therandymon.com> - 2014-02-14 11:12 +0000

csiph-web