Invisible QR Code Hijacking Using Smart LED

Quick response (QR) codes have found versatile usage in numerous applications, but have also posed severe security threats such as privacy leakage, phishing and even payment inception if the codes are hijacked. The hijacking is often assumed to be preventable by physically isolating the codes from possible attackers, e.g., putting the QR code inside a glass cabinet distant to outsiders. In this paper, we explore a new QR code hijacking attack, named Li-Man, that can subvert such protection using smart LED. The key idea is to illuminate a target victim QR code from afar using specialized flickering light waveforms, which can transform the code to be any other predefined malicious ones when being captured by smart-phone cameras, while keeping the attack invisible to human visual perception. Li-Man builds on a modeling framework that harnesses the disparity between camera and human imaging mechanisms. We develop a Li-Man simulator and also implement a prototype to verify the feasibility and threat level of Li-Man. Experiments demonstrate that Li-Man can successfully realize the invisible hijacking of QR codes from multiple hidden positions in constrained space. On the other hand, we propose and verify a primary countermeasure that is promising to defeat the Li-Man attack.