This. Just, this.

[mainec@fromm.social]

@cstross not a QR code, but human readable. Not a malware, but legal language, so arguably worse than malware:

https://shop.digitalcourage.de/kleidung/t-shirt-keine-bilder-gerade-geschnitten.html?xoid=lt8ol9en1l2066nuepuu2sfdnm

Refers to German privacy laws related to photographing people.

[voxel@infosec.space]

@cstross Didn't expect to see this again, could you provide the original source?

[heppycat@mastodon.social]

@cstross @stefan an EICAR test code would be a good start

[nblr@chaos.social]

@mbirth @cstross We tried. To no avail. Will have to try another iteration with an endless pattern fabric/print. So it is presented in multiple and different orientations.

[rrb@infosec.exchange]

@cstross AI data centers are this at scale. Only, they are reducing the whole planet to a useless brick.

[amazing_helenab@mastodon.social]

@cstross it should be called the Medusa virus.

[n1xnx@tilde.zone]

@cstross
Bonus points for bricking facial-recognition cameras.

[gulfie@mastodonapp.uk]

@neurovagrant @cstross @unknownbinaries anyone nosey enough to scan it deserves all they get

[stevendbrewer@wandering.shop]

@cstross just remember not to take any selfies, amirite?

[ireneista@adhd.irenes.space]

@cstross oh, but this exists. someone on here did a small batch of sew-on patches a few years ago that were QR codes of the EICAR test file. we have a couple...

[ireneista@adhd.irenes.space]

@cstross it isn't technically a virus, it's a file that virus scanners per their spec are supposed to treat as if it's a virus. so, for example, if a badly-written surveillance camera decodes the QR code and stores it in a way that a virus scanner can see (which is not what it should do, but...), then the virus scanner will quarantine the file which may break the camera

[earthshine@masto.hackers.town]

@flippac @neurovagrant @cstross @unknownbinaries if you're executing arbitrary code from a QR code, I think a zip bomb is the least of your worries.

[ireneista@adhd.irenes.space]

@cstross that said, to know whether it actually works and when would require a lot of testing, which to our knowledge nobody has done

[flippac@types.pl]

@earthshine @neurovagrant @cstross @unknownbinaries it doesn't need to be executed - just mishandled by careless AV

[jmvars@mastodon.social]

@cstross my phone does not automatically scan QR codes, is this a feature on newer phones?

[cstross@wandering.shop]

@earthshine @flippac @neurovagrant @unknownbinaries QR code to download a PDF containing Javascript (which the PDF standard now incorporates) to dynamically generate a zip bomb containing infinite copies of itself.

[cstross@wandering.shop]

@Jmvars If so, it's a mis-feature. (iOS recognizes QR codes but then tells you to tap to confirm you want to open the URL it points to.)

[agathos@mastodon.babb.no]

@neurovagrant @trainguyrom @anotherdaniel @cstross @unknownbinaries I am not saying that a huge grocery store chain in norway is vulnerable to this "attack" in their self service tills, I would not know anything about that, no need to ask any further questions

[lydialurch@mastodon.social]

@cstross Fuck yeah, I want one too and accessories as well!

[lispi314@udongein.xyz]

@cstross @alice Arguably if their camera does that it's /already/ infested with malware, a dropper specifically.