Did you ever wonder why scandals get the suffix “-gate” in the media? You know, issues like queuegate – Phillip Schofield and Holly Willoughby getting to the front at Queen Elizabeth’s lying-in-state – or Kategate – the 2024 Mother’s Day photo featuring the Princess of Wales. But what have these controversies got to do with gates? Nothing at all, of course!
The original case dates back to the 1970s when a burglary at the Watergate Complex resulted in a scandal which led to the resignation of President Richard Nixon. Thus, the handy shorthand to denote unethical behaviour was coined.
The IT world has its own suffix – -ishing! The thing all these terms have in common is cyber-crime. Probably the first one you will have heard of is phishing – just as you might fish for compliments, the hacker dangles bait to phish for victims. Our blog explains how phishing works in practice.
More recent additions are smishing – communicating via SMS text messages – and vishing – criminals using (voice) phone calls to trick you.
Can you guess what quishing is?
Quishing is a cyber attack which uses QR (Quick Response) codes.
The beauty of using QR codes (from the hacker’s perspective anyway) is that the web address (URL) is hidden in a pattern of black and white boxes within a square so you cannot read it without a smart phone camera. You are probably more likely to be trusting of a QR code than a website; it’s such an easy way to access a website quickly.
What was your reaction to the QR code at the top of this story? Were you curious enough to whip out your phone and follow the link? Fortunately for you, this was simply a link to the Computer Troubleshooters website.
It is startlingly easy to create a QR code. In Chrome, you visit the desired website, then click on the 3 dots at the top right-hand corner. Select “save and share” then choose the option “create a QR code”. You can see how efficiently cybercriminals could generate QR codes to their dodgy sites.
So, how does quishing work?
You are invited to follow the QR link to a site where you have to enter your password and other personal information. The reason that your data is useful to a scammer is that it allows them to impersonate their victim, along with all the access that this grants them.
There have been cases of malicious QR codes being adhered over the top of legitimate stickers on car park ticket machines; you think you are paying to stay for 3 hours but you are actually giving your money – and card details – to a criminal instead. An article in The Telegraph reported that this scam has also been found on electric vehicle charging points.
When quishing joins the world of phishing it can be difficult to detect, even for sophisticated spam filtering systems. The QR code could turn up within the text of an email or it might appear in an attachment which would not have been scanned.
How can you avoid being quished?
Just as you are always warned to stay alert to anomalies in the spelling of email addresses, or whether they match the purported sender, you do get an opportunity to review the web address before you click on the contents. When you hover your smartphone over the QR code, it should tell you the connected URL. Even if you click through to the website, you should be able to check the address before handing over your personal data.
The moral of the story: as technology evolves, so too do cyber-attacks. Stay circumspect and consider getting your team some security awareness training.
If you would like to beef up your cyber security, contact Computer Troubleshooters – just use the QR code above!