Bitcoin Forum

Here's another privacy issue and extra-carefulness is always needed!
There are a lot of people who use QR codes to share different data (also to share bitcoin or other cryptos) from their smartphones and the article below states the risks of using QR codes.  

https://www.forbes.com/sites/billybambrough/2019/09/12/researchers-have-issued-a-serious-bitcoin-qr-code-warning/#3254ef2c6d12

One thing for sure, nothing can be safe anymore as long as we are something that is connected to online and gadgets. Soon scammers can find their way even if we are staying offline. Such is the genius and great creative skills these people are using and employing so that can be able to get to people's hoard of money and cryptocurrency. QR codes which we thought to be safe and can't be cracked are now becoming a victim of the shenanigans scammers are infecting the world of cryptocurrency. This should really be serving as a big warning never to be complacent when it comes to securing one's wallet and digital assets.

"Researchers calculated that some $20,000 had recently been lost to QR code scams, calling their findings "just the tip of the iceberg," as thieves likely regularly change their bitcoin and crypto addresses to avoid detection and blacklisting.

Last month, it was found bitcoin and cryptocurrency fraudsters stole over $4 billion of digital currency from investors and users in the first six months of 2019, a significant increase on the $1.7bn stolen in 2018." (https://www.forbes.com/sites/billybambrough/2019/09/12/researchers-have-issued-a-serious-bitcoin-qr-code-warning/#4606ddf6d123)

I would never use a third party service to generate a QR code for financial - bitcoin transactions. Even if I do I would triple check that the QR code is representing the correct address and not a scame one. One should know that the internet is full of scams and conmne. Especially when dealing with cryptocurrencies you need to be very careful with your funds' security. Triple check everything and be extra cautious, that's all you need to do

this topic aint new but worth a mention
other tricks are that these qr readers may actually have a list of 200k-11m addresses preloaded of vanity gen addresses of every first 3-4 characters of an address. but where the scammer has all the privkeys of.

because some people only check the first few characters the destination of a tx appears to match where you hope it should go, so people are easily duped if in a rush

best advice after scanning an address. check the destination. its best to check the whole address matchs, but if in a rush check the final few characters. not the first few. this is because its harder to vanity gen the final few characters than it is to gen the first few

also some wallet apps themselves has issues. where the user viewing display shows what you want, but the code signing a tx is signing for a different destination

in short be careful with all apps, whether just a reader or a wallet or even an unrelated app that can be a trojan

Indeed, you can literally find scammers everywhere and that is enough reason for us to be more attentive particularly these days. Scammers and hackers are the reason why we need to be aware of everything, we don't want our funds and assets to be wasted for nothing. Its better if we look for some information that might help us to avoid having some problems on making transactions. Its better to check everything before doing a transaction than losing your funds since bitcoin is the currency that is usually used by cyber criminals.

Nothing new. Most of the new tricks and scams that a lot of people are seeing nowadays just prey on the careless and stupid, and just try profit off people who think downloading random apps would work.

This is a lot worse though. Even though I am not a huge Apple fan, they do manage their app system very well and they have always rarely let intrusive and malware on their systems. Android's play store is very open and they don't really aggressively delete and alter apps as much as Apple and it's pretty apparent with these QR code users being so popular.

Just avoid QR codes in general. I've only ever copy pasted addresses and then checked the last 3 digits and first 3 before confirming a transaction.

This is actually a known issue, although it is good to be reminded of it every once in a while. New users can definitely use all the hints they could get.

Though this news is not that new anymore, but as you all noticed, there were a lot of way a hacker would replace the recipient's Bitcoin address to their own. It's not just the QR code which has the risks of this kind of attack, but there also downloadable malware virus through emails that are capable of bitcoin address manipulations.
Best, thing to do is to check the first few characters and If necessary (for extra security) the last few characters before sending it to someone.

There are no invulnerable assets. Funds from your Bank card can also be stolen by a special device. Cash is also unsafe to carry around — man can be robbed. Cryptocurrencies are not safe, as it turned out, even when using technology such as QR codes. All security is shifted to the shoulders of a person one way or another. It is necessary to strictly follow all existing recommendations for the safety of any money, to increase the degree of their protection.

This is not about bitcoin security, It is a user's responsibility to be careful not to use some random QR code generator from 3rd party and suspicious websites. In fact, Almost all bitcoin wallets have built-in QR code generator why use these untrusted generators? This article news does not make sense and has nothing to do with bitcoin security.

That's not quite surprising. Online and hot wallets are one of the most vulnerable wallets in the market. And this exploit, though clever, should be pinned down. A seemingly harmless bitcoin address generator could steal your precious bitcoins in an instant. It's a good read and warning for newcomers. Storing bitcoin should be treated as a real asset, that is, to carefully store and manage your bitcoins. Cold storage and hardware wallets are still more secured than these hot wallets.

This teaches us to be wiser and more careful in installing and choosing trusted apps.  nothing is really safe on the internet, hackers are always looking for loopholes to be able to take over your wallet.  only use the official app, don't try the new app even though it offers many advantages.
as you explained, on some devices it is not very powerful in filtering crime from the device app.

You really need to be incredibly wary with everything related to cryptocurrencies. It's an incredible risk and incredible income, that scammers want to get hold of.

where do we go from here?almost everything that accessible to crypto has been surrounded by this scammers and hackers,almost everyday there is expositions of their bad activities until when this can be stopped?
sometimes i am afraid of checking my wallets because was thinking that something or someone already hacked me though i am always keeping all the precautions,but we knew how great these bad elements in victimizing people,how i wish they could be poked by their conscience and stop this doings

This isn't just about crypto dude, everything that is been use by human is attracted to vulnerability, people engage in bad activities in every aspect of life i don't see why it is different in crypto, the only thing one can do is to apply extra security if you can or know how, the only sad news is that the more people try to protect themselves by increasing security the more this scammers, hackers get even better.

it is true that there are no assets now for us that are truly safe because current technology is increasing with advanced technology now it is very easy for criminals to steal our assets let alone digita currency assets like bitcoin they use technology like making bitcoin third party qr address codes so we are more careful when sending bitcoin.

In any ways be careful, though QR is a fastest way to send our address which happens not to be fully secured, it's better to use the normal sending of address but just double check it and send only on verified users. Be careful not to be pushed by any websites and in putting our QR and address, scammers always find their way to tricked us.

This is really terrible because the technology is as sophisticated as bitcoin and using QR code can have loopholes that can be used to steal the assets of the owner, but for the moment I have never experienced this incident because I do not use other applications to make transactions using bitcoin.

and after the CTRL-C controversial now the next target is QR code?wow these hackers are best of all best in creating everything that can take advantage the weaknesses of every individuals.i'm just thinking why this people did not use their skills and abilities in doing things legally.why not instead of getting money from others is they work to help others
but we already knew the answer and that is impossible for them to change because that is their life and thats what they choose to do

I remember this was the case when I was about to share some methods about convenient payment using Bitcoin in our local board. The site that I was getting on how to get an easy QR code for a Bitcoin address is a scam. because when I am getting the QR code for my BTC address, a different address would appear if I tried to scan the QR code I made from that site. That's why when I read this, I can relate because I was closed to get scammed by that site.

I am not aware of this but I'm not using a QR code and there is a warning
This will cast a bad light in using QR code for now on because it is not readable, there is no way to know if the code is real of from a different address, I will not advise people to stop using it, but they know that something like this exists and they have to take extra precaution when dealing with QR code.

Extra caution.is always a good thing, it can't never be too much. Even before that information I always double checked. New technologies often exclude human factor or  put it to minimun and it's good to use advantages that gives us but  always be aware of potential issues.

You can't encourage people to stop using QR code , instead  encourage them to use only the QR code from the trusted provider ... not from a random free websites,  it must be well known provider/generator so whenever there's something wrong you can take something further.

It's not secret anymore, it's not surprised ... your data is never safe online. Instead blaming the tool or something else, how about to level up your personal ability to defend your own data in this digital era? in this interrelated computing era? It's inevitable that you are at risk once you get connected to internet, once you get connected with other devices.

QR code is fine , the users not .

QR codes has been giving people the very convenience people had been looking for, Imaging making transactions just by scanning a code. But this QR codes are also prone to counterfeiting and manipulations especially if handed to the wrong hands. So for people to avoid being victimized by QR code scams, make sure to only use QRs that are from a trusted source and are not from anywhere around the internet. No one is to be blame if you've got yourself into scams for you are the one who decides what will you let to happen.

I tried once using QR codes somehow it reflects different address also. This proves that we are many experiences this kind of situation. Good thing there’s someone who shared awareness to us users in bitcoin. Hence, we must be cautious for us not to be a victim of scam.

I have seen a mobile application on Android that lets you scan a QR code so he or she can get the password of any WIFI of the phone or mobile device that are connected to that specific WIFI, I guess this is what the QR code has been doing for people to hack their personal profile,  Identity, and even Password this is a sure fair warning to everyone to be very cautious of anything that they will do, We are really not safe anymore anything can be used as a means of phishing and hacking anything, I guess even mobile application and games can sometimes become a phishing modulator for hackers as well.

definitely this. when in a hurry for smallish amounts i at least check the 1st few, last few and something in the middle. there are almost always 3 or 4 consecutive characters in the middle of the addy somewhere that stand out well due to whatever reason. so easy to spot and compare.

for larger amounts of course i would check more that that.

This is something new that people need to know, especially those who often use QR codes. For the future, we need to be careful to use this, especially if we use an application that provides this feature and has a bad rating. Technology is increasingly sophisticated and there are people who use this as their personal interests by committing fraud. The internet world is already insecure.

anxiety comes not only from third-party QR applications, but from non-crypto applications that unconsciously have access to the possibility of hacking personal wallets. As we know, many popular applications today increase access options for managing personal data management systems on smartphones during installation. At this level, the smartphone will be automatically accessed from the inside.

Good thing that I don't really use it and I would never used any QR payment I am more comfortable on using the BTC address.
I think it is much more easier that way since it is how I get to know how to send my crypto.
Besides I am using my phone so using QR to pay would mean that I need to download some app.

I remember some similar stuff going on a month ago or so. It's terrible that QR-code misdirections work like this. I've never used a QR code to perform a financial operation and I don't intend to do that. I cannot distinguish one QR-code from another, which means I cannot be sure whether I'm sending money to the right person. When I see an address, I'm always checking it a couple of times before finalizing the operation. I think it's easy enough to use addresses, so why generate something you might not understand or use it to put the operation at risk? With these troubling QR-code cases I hope people will start using them less.

The thing is why do we need to use a third party apps to create a qr code? As far as I know electrum had it already.  Exchanges and other legit third party platform also implement qr code for the bitcoin address.  I do not know why do someone have to bother himself to look for QR code generator just to send a transaction.  Isn't it too much of an effort to give scammer an opportunity to steal our sent out bitcoin?

Day by day, hackers and other nefarious entities within the bitcoin and crypto ecosystem are becoming smarter and smarter and are looking for ways/vectors onto which they can propagate their plans. I have always considered QR codes to be somewhat scary to scan especially if it can be easily altered into something else and regular people cannot easily notice unless someone tells them that that is already an unsafe QR code to scan. Knowing how it can be instructed to do something else to your smartphone the moment you scan it makes it even scarier, though of course not to the point that it can instruct your wallet to send coins automatically. The only way to prevent being tricked with this is to not scan codes unless you are sure that it really is the one that you need, or at least it was generated by a trusted entity.

I read these things few months earlier where QR codes were manipulated from what it supposed to be with device security issues so always prefer to use bitcoin address over QR codes and double check the address even if you copy pasted it because of clipboard bugs can cause to lose bitcoins as well.

many ways for hackers to try to steal crypto assets that we have. the basic principle is that we think of 1 or 2 security steps, whereas hackers think of 10 or 20 hacking steps. the simple prevention that I have been applying is only accuracy. I always check the compatibility of QR codes and wallet addresses when sending bitcoin or altcoin

You and Forbes are seriously misleading people here. I hope you reflect and change your thread title.

A quick skim at this article you bring, and here is the REAL content:


Just reading this alone within the article proves:

• Forbes is using a sensationalist header
• You are helping them reproduce the FUD

If you type "bitcoin" in google, chances are you are going to find countless scam and phishing sites. This has nothing to do with:

• Bitcoin
• QR codes
• Security regarding either

Please stop spreading this nonsense, and get to the facts, even if the media you pull the article from does not in the header, READ the content and extract the truth. This is NOT even "news", scammers and phishers have existed even before Bitcoin. And this is not a security warning, but a social one, as it still takes for someone to get convinced to go to one of these sites...

Just how you think most malware gets spread anyway? Most use bait like this...

This is just a mobile equivalent of the Windows copy/paste Bitcoin address swapping malware. So don't install it in the first place...

No technology can be absolutely invulnerable. Everything invented in the digital world can be hacked by more advanced technology. Therefore, in the world of digital technology, we can never feel safe, especially if we are connected by a single network with others.
If I need to pass a specific code to someone, I send it with some changed letters or numbers. After that, I inform him of these changes by telephone. It is very difficult to control all communication channels at the same time.

No matter how much others try to improve technology to make our life easier, others will always find a way to use it for their own profit. The purpose is to help people but cons always occur because of others greediness. QR code provides easier access by just scanning it. Less-hassle, but because in today's world, evilness is growing, it cause more fear to everyone. Instead of making things easier, they will just doubt it.

Old news already, it has been shared many times in this community: [Alert! Alert] Bitcoin QR Generator” lead to scam websites. (https://bitcointalk.org/index.php?topic=5182249.0) (recent one).

I wouldn't even consider this a serious security warning though, you just need common sense and check everything before you send your funds over. That is the first thing you have to learn in case you want yourself to be involved in this market.

1. It's not too old to be posted again!
2. It's impossible to follow after all the posts and obviously there are still a lot of people who would find it helpful.

Basically Before reading this post, I am trusting QR codes in order to secure funds. What I am doing is converting my wallet address and private key to QR since I believe that when it is printed, it is very much likely to be safe. In this regard, we should really consider having hardware wallets such as trezor.

We all know for sure that Bitcoin is not 100% safe, so we have to be careful about it, that’s why no one should be so dumb to the extent of using a Google voice search to ask Google to bring a QR code generator.

Why don’t you do the research yourself and look for a good QR code generator? Anyone that’s doing these kind of thing is meant to use sites that are already popular and well established, like BitPay. You don’t just jump on any random site or app when you know for sure that there are lots of scammers online.

Since QR code is already here to make our money transactions faster, then let's be more careful in using it and check even 5 times to verify if the address is really correct. Sometimes i do copy paste the QR code but still review it just to make sure that i am not putting a wrong address. Scammers may take an advantage when they see we are already confident on what we are doing.

I remember my screenshot about my QR code in my Bitcoin address just to prove my ownership of the account, and from how this news seemed like to avoid the usage of cryptos, I'll never let my friends transfer money to me using those.
I'll just use QR codes whenever I need to access a certain sites without typing the whole hyperlink itself. It could be altered to a phishing site, but that's a matter of different discussion.