FREE Report: 12 Stocks to Sell Now
Help
|
Connect
|
Sign up
|
Log in

Andy Greenberg, Forbes Staff

Covering the worlds of data security, privacy and hacker culture.

Follow Following Unfollow

##### Security

###### |

###### 7/17/2013 @ 7:02AM |15,398 views

# Google Glass Hacked With QR Code Photobombs

2 comments, 0 called-out
Comment Now
Follow Comments Following Comments Unfollow Comments
Comment Now
Follow Comments Following Comments Unfollow Comments

Careful where you point your new headset, Google Glass owners: Like a small child, some graphic images have been known to corrupt the young device’s impressionable brain.

Researchers at the security firm Lookout Mobile say they developed an attack last spring that could compromise Google’s device when the user merely took a photo that captured a malicious QR code, the square graphic labels often used to link smartphone users to websites and by Google Glass to set up the headset’s Wifi connections. Lookout’s researchers, who reported the bug to Google and have already helped the company issue a fix for the flaw, found that they could craft malformed QR codes that when photographed crashed Glass or connected the headset to a rogue Wifi hotspot capable of stripping away the encryption on the device’s communications or directing it to a malicious website designed to take full control of the device.

“Google has set up the device so that Glass scans every photo you take for something interesting,” says Lookout researcher Marc Rogers. “While that’s exciting, the fact that Glass can parse photographs opened up a vulnerability. By understanding and reverse engineering the QR codes, we were able to create malicious ones that would silently reconfigure the device.”

Rogers imagines a scenario where someone wearing a T-shirt showing a maliciously crafted QR code could “photobomb” a user, inserting himself in the back of the scene and causing the headset to scan the attacker’s code. Rogers even printed sample malicious QR code stickers that could be planted on top of innocuous QR codes on advertisements or other signs to trick unsuspecting Glass users.

Lookout reported the QR code issue to Google in mid-May, and it was fixed with an automatic software update two weeks later, according to Rogers. Glass now interprets QR codes only in certain modes such as when the user is choosing a Wifi network, rather than by default. “We take security very seriously at Glass,” a Google Glass spokesperson writes to me in an email, adding that one of the goals of its beta-testing “Explorer” program for Glass is to “discover vulnerabilities that we can research and work to address before we launch it more broadly.”

QR code attacks aren’t exactly new: A researcher at the Chaos Communications Congress in 2007 pointed out how malicious QR codes printed in a newspaper could infect users’ devices. And in September of last year a researcher showed that the Samsung SIII could be wiped and reverted to its factory settings by merely loading a link through its QR code reader. But wearable computing devices may be especially vulnerable, as the keyboard-less devices could depend on QR codes for inputting precise text strings like the names and passwords of Wifi networks, as Glass does.

Despite the fact that Glass’s vulnerability to rogue QR codes was patched before it could be exploited outside of a lab, Glass may yet become a tempting target for actual criminal attacks as the headsets are more widely adopted. In April, Android developer Jay Freeman created the first “jailbreak” for Glass that allows any unauthorized software to be installed on the device. He also warned that Glass’s ability to watch a user’s entire life meant that compromising the device could allow serious breaches of privacy. “Nothing is safe once your Glass has been hacked,” Freeman wrote.“A bugged Glass doesn’t just watch your every move: it watches everything you are looking at (intentionally or furtively) and hears everything you do. The only thing it doesn’t know are your thoughts.”

Here’s hoping that when Glass is released to more than a few early adopters, it takes more than a mere QR code to turn it into a 24/7 spying device.

–

Follow me on Twitter, and check out my new book, This Machine Kills Secrets: How WikiLeakers, Cypherpunks and Hacktivists Aim To Free The World’s Information.

Move up http://i.forbesimg.com t Move down
Google Glass Has Already Been Hacked By Jailbreakers Andy Greenberg Forbes Staff
Google Reveals How To Hack Google Glass Device (And Void Your Warranty) Robert Hof Contributor
Lookout Conquered The Consumer Mobile Security Industry--Now It Just Has To Prove One Exists Andy Greenberg Forbes Staff
2 comments, 0 called-out
Comment Now
Follow Comments Following Comments Unfollow Comments
Comment Now
Follow Comments Following Comments Unfollow Comments

Print
Report Corrections
Reprints & Permissions

### Post Your Comment

Cancel reply

### Post Your Reply

Please log in or sign up to comment.
Enter Your Comment
Submit Comment

Forbes writers have the ability to call out member comments they find particularly interesting. Called-out comments are highlighted across the Forbes network. You'll be notified if your comment is called out.

### Comments

- Called-Out
- Expand All Comments

Follow Comments Following Comments Unfollow Comments

- + expand 2 comments

## Most Read on Forbes

- News
- People
- Places
- Companies

+ show more
Andy Greenberg Forbes Staff
Follow Following Unfollow
+ show more

I'm a technology, privacy, and information security reporter and most recently the author of the book This Machine Kills Secrets, a chronicle of the history and future of information leaks, from the Pentagon Papers to WikiLeaks and beyond. I've covered the hacker beat for Forbes since 2007, with frequent detours into digital miscellania like switches, servers, supercomputers, search, e-books, online censorship, robots, and China. My favorite stories are the ones where non-fiction resembles science fiction. My favorite sources usually have the word "research" in their titles. Since I joined Forbes, this job has taken me from an autonomous car race in the California desert all the way to Beijing, where I wrote the first English-language cover story on the Chinese search billionaire Robin Li for Forbes Asia. Black hats, white hats, cyborgs, cyberspies, idiot savants and even CEOs are welcome to email me at agreenberg (at) forbes.com. My PGP public key can be found here.

### Andy Greenberg’s Popular Posts

- An Interview With WikiLeaks' Julian Assange 921,251 views
- This Is The World's First Entirely 3D-Printed Gun (Photos) 901,919 views
- Meet The 'Liberator': Test-Firing The World's First Fully 3D-Printed Gun 550,270 views
- WikiLeaks' Julian Assange Wants To Spill Your Corporate Secrets 513,609 views
- Meet Comex, The 19-Year-Old iPhone Uber-Hacker Who Keeps Outsmarting Apple 472,467 views

### More from Andy Greenberg

- Follow Andy Greenberg on Twitter
- Andy Greenberg’s RSS Feed
- Andy Greenberg’s Profile
- Andy Greenberg’s Recommended Reading