trying a new thing, have 3D printed a QR code and put it on the front porch

[viss@mastodon.social]

@SecureOwl crafty!

[trashpanda@m.alittlenook.net]

@SecureOwl Definitely interested to hear if (and which)!

[threatresearch@infosec.exchange]

@SecureOwl Would like to know how to replicate this at my own home

[iagox86@infosec.exchange]

@SecureOwl neat idea! Although if I was visiting I might scan it out of curiosity

[cr0w@infosec.exchange]

@iagox86 @SecureOwl How do QR canaries work? Is it based on the DNS query? The GET when they click the link? Or do the QR scanners try and retrieve something like a preview even without clicking the link?

[darfplatypus@infosec.exchange]

@cR0w @iagox86 @SecureOwl the birds in the phone are just snitches

[cr0w@infosec.exchange]

@darfplatypus @iagox86 @SecureOwl I fukkin knew it.

[yazad3@techhub.social]

@SecureOwl interesting idea! If I were to guess they probably are using the drop of pics to train AI. Question: how would the QR code canary get triggered during image training? Are you expecting the link in the WR code to be invoked during the training process? Would
Love to learn more. Cheers!

[aburka@hachyderm.io]

@SecureOwl my neighbor's whole doormat is a qr code

yes it's a rickroll obviously

[drwho@masto.hackers.town]

@SecureOwl I need to try that.

[drwho@masto.hackers.town]

@aburka @SecureOwl

[secureowl@infosec.exchange]

@cR0w @iagox86 get request i believe

[amd@gts.amd.im]

@SecureOwl I love the question that you’re asking but I really don’t know how this would prove it…

Are AI image scanners known to parse out QR codes?

[secureowl@infosec.exchange]

Whelp, sample size of 1 so far, but about 50 minutes after an amazon delivery - where a picture was taken - got a hit on the canary

i just checked the delivery photo and the QR code was visible in it

User agent was not a phone and clearly some sort of crawler

IP address was a CDN

but we are 1/1, lets see how it goes with a few more

(i get a lot of random work deliveries)

[secureowl@infosec.exchange]

@amd thats what i want to find out

i found out that ai text summarizers happily summarize base64, so wanted to try to see if this is similar: https://mike-sheward.medium.com/recruiting-google-geminis-email-summarizer-as-a-phishing-aid-417055295ba7

[douglasvb@m.ai6yr.org]

@SecureOwl you could have a lot of fun with this

[ai6yr@m.ai6yr.org]

@SecureOwl Ha! I have a great idea, make a front mat which is all QR code tricks!

[secureowl@infosec.exchange]

@ai6yr do it do it

[nitinkhanna@mastodon.social]

@SecureOwl thanks for introducing the concept of Canary tokens to me!

Just saw their website and there doesn't seem to be a Canary Token for SSH. Would love to receive a push update if any of my VPS servers are logged into!

[alesandroortiz@infosec.exchange]

@SecureOwl Now try some blind XSS payloads...