Demystifying the (In)Security of QR Code-based Login in Real-world Deployments

Demystifying the (In)Security of QR Code-based Login in Real-world Deployments

Speakers: Xin Zhang

Conference: USENIX Security

YouTube: https://www.youtube.com/watch?v=5cWrYenMM2k

Overview

The proliferation of QR code-based login systems across a myriad of digital platforms, from social media and e-commerce to cloud storage and gaming, has revolutionized user convenience. By simply scanning a QR code with a trusted mobile application, users can bypass traditional password entry, fostering a perception of enhanced security and ease of access. However, this talk, presented by Xin Zhang from Fudan University in collaboration with Sun Yat-sen University, critically dismantles this perception, revealing a surprisingly fragile reality beneath the surface of widespread QR login implementations. The core problem, as highlighted by the research, stems from the complete absence of an industry-wide implementation standard, leading each service provider to develop its own bespoke system with varying degrees of security rigor.

This comprehensive study represents the first systematic investigation into the real-world security posture of QR login mechanisms. It moves beyond theoretical vulnerabilities to expose practical, exploitable flaws present in live deployments affecting millions of users. The researchers not only identified five novel types of attacks stemming from six fundamental security flaws but also demonstrated their prevalence across popular websites. By providing concrete examples of these vulnerabilities and their severe implications—ranging from authorization hijacking to universal account takeover—the talk serves as a critical wake-up call for both developers and users, underscoring the urgent need for standardized, secure practices in QR code-based authentication.

Background

▶ Watch: Introduction to QR login insecurity and problem (0:00)

The convenience of QR code login has made it a ubiquitous feature across major platforms like WhatsApp, Taobao, Steam, and Telegram. At its heart, QR login functions as a form of trusted device authentication. The simplified workflow typically unfolds as follows:

1. Initiation: A user navigates to a website on their computer and selects the QR login option.
2. QR Code Generation: The website's server generates a unique QR code, which is displayed on the user's browser screen. Simultaneously, the browser initiates a polling process, repeatedly querying the server for the status of this QR code.
3. Scanning and Authorization: The user scans the displayed QR code using a trusted mobile application (e.g., WhatsApp, Steam app) on their smartphone.
4. Confirmation: The mobile app prompts the user to confirm the login attempt. Upon approval, the app sends a message to the server, incorporating the user's app token, effectively signaling authorization for the specific QR code.
5. Server Response and Login: The server, receiving the authorization, replies to the browser's pending poll request with a login token. The browser then uses this token to log the user into their account.

While seemingly straightforward, this process is fraught with potential pitfalls due to the lack of a standardized security protocol. Each service implements its own version, leading to diverse and often insecure designs.

The researchers' threat model focuses on attackers who do not possess control over the victim's device. Instead, the adversary is assumed to have limited access to information, such as the victim's QR code displayed on the screen or the QR ID encoded within it. This information could be acquired through various realistic attack vectors, including shoulder surfing, where an attacker covertly observes the victim's screen, or through malicious browser extensions that capture displayed content. Another potential attack surface involves obtaining the victim's account identifier, such as a phone number. To validate the realism of these assumptions, the research team conducted a user study. The findings were stark: many users frequently expose their QR codes to potential leakage risks while performing QR login, yet a significant majority remain unaware of the inherent dangers associated with such exposure. This confirms that the identified risks are not merely theoretical but represent tangible and underestimated threats in real-world scenarios.

The study emphasizes that its focus is strictly on the design and implementation flaws within websites' QR login systems, rather than malicious QR codes themselves or compromised user devices. This distinction is crucial, as it highlights systemic vulnerabilities that can be exploited even when users follow seemingly secure practices. Prior to this work, a systematic, large-scale analysis of QR code login security in real-world deployments was conspicuously absent, making this research a foundational contribution to understanding and mitigating these widespread risks.

Key Findings

▶ Watch: Six core security flaws leading to new attack types (5:30)

The research embarked on a systematic two-step process to analyze the security of QR login implementations. First, critical security variables were identified, including the session ID (linking the browser session to the QR login request), the QR ID (the unique identifier encoded in the QR code), and various tokens (app tokens for authorization, login tokens for session establishment). Second, the researchers rigorously evaluated whether these variables adhered to fundamental security principles: confidentiality (preventing unauthorized access to sensitive data), integrity (ensuring data has not been tampered with), and consistency (maintaining a reliable state across the login process).

Following this rigorous methodology and adhering to their defined threat model, the team uncovered six distinct security flaws that collectively lead to five new types of attacks against QR login systems. These flaws include:

1. Session ID Unbound: The browser session ID is often not securely bound to the QR code, confusing the server and making it unable to distinguish legitimate requests from malicious ones.
2. Reusable QR ID: The QR ID, intended for a single use, can sometimes be reused by attackers.
3. Predictable QR ID: In some implementations, the QR ID is not sufficiently random, allowing attackers to predict valid IDs.
4. Controllable QR ID: Attackers might be able to manipulate or control aspects of the QR ID generation.
5. Weak Token Verification: The server performs inadequate verification of the app token sent by the mobile device, allowing attackers to impersonate users.
6. Other logical flaws (not explicitly detailed in the transcript but mentioned as leading to the 5 attack types).

To gauge the prevalence and impact of these findings, the researchers addressed three key questions:

1. Usage: How widely is QR logging deployed? They collected data from 350 websites utilizing QR login, sourced from the Tranco top 100,000 domains and additional popular sites. They observed that QR login is particularly common on top-ranked sites, frequently within security-sensitive categories such as technology, business, and shopping—underscoring the critical importance of its security.
2. Security Posture: Are these real-world QR login systems secure? To answer this, they developed a semi-automated testing pipeline. This sophisticated tool captures network traffic, analyzes system behavior, and automatically checks for the previously identified security flaws. Using this pipeline, they comprehensively analyzed 109 testable QR login websites.
3. Results: The findings were alarming: a staggering 43% of the analyzed websites exhibited at least one serious security flaw, impacting potentially millions of users. The researchers responsibly disclosed these vulnerabilities to the affected vendors and official vulnerability platforms, providing detailed fixes. As a testament to the severity and validity of their discoveries, they received 42 confirmed vulnerability IDs (CVEs or similar identifiers) for the reported issues. This high confirmation rate underscores the practical exploitability and widespread nature of the identified flaws.

Technical Deep Dive

▶ Watch: Detailed explanation of authorization hijacking attack (8:30)

The research identified several critical security flaws in QR code-based login implementations, leading to potent attack vectors. The core of these vulnerabilities lies in insufficient binding between session identifiers, inadequate management of QR code lifecycle, and weak verification of authentication tokens.

Flaw 1: Session ID Not Bound to QR Code

One of the most fundamental flaws identified is the server's failure to adequately bind the browser's session ID to the generated QR code. When a user initiates a QR login, a unique QR ID is displayed. The browser then begins polling the server, asking, "Has this QR code been approved?" If the server does not verify who originally initiated the request for that specific QR ID, it becomes vulnerable to authorization hijacking.

Attack Type 1: Authorization Hijacking (Motivating Attack)

This attack, also referred to as a race condition attack, exploits the unbound session ID flaw.

• Mechanism: An attacker obtains the victim's QR ID. This could happen through various means, such as shoulder surfing (observing the QR code on the victim's screen), using a malicious browser extension to scrape the QR code, or other forms of localized information leakage. Once the attacker has the QR ID, they can also start polling the server for its status, effectively joining the "question and answer game" alongside the legitimate victim's browser. The crucial point is that when the victim eventually scans and approves the login on their phone, both the legitimate browser and the attacker's system are polling. The server, due to the unbound session ID, grants access to whoever receives the login token first. By sending a quick burst of requests (a race condition), the attacker can often win this race, hijacking the authorization and logging into the victim's account before the legitimate user.
• Impact: The researchers found this vulnerability in multiple major websites, including large shopping sites with over 500 million users. Successful exploitation allowed attackers to access private order histories, personal information, and potentially perform unauthorized transactions. The server's logic simply trusts "the one who got the Q ID," without verifying the original initiator of the QR login request.

Flaw 2: Reusable QR Code

Building upon the first flaw, some implementations further compound the issue by allowing QR codes to be reused. This means that once a QR code has been successfully used for authentication, its authorization state is not promptly cleared or invalidated.

Attack Type 2: Reusable QR Code Account Takeover

This attack leverages the reusability of the QR ID, removing the need for a race condition.

• Mechanism: An attacker again obtains the victim's QR ID. Instead of racing the victim, the attacker simply waits. Once the victim has successfully scanned the QR code and logged into their account, the attacker quietly begins polling the server using the same QR ID. Because the QR code's authorization state was not cleared, the server still considers it valid, and the attacker is granted a login token.
• Impact: This results in a simultaneous account takeover, where the attacker logs in concurrently with the victim, often without the victim ever being aware. This vulnerability was discovered in popular websites, including a social media platform ranked within the top 500 global websites. Such an attack could allow an adversary to monitor the victim's social activities, post malicious content, or perform other unauthorized actions, all while the victim continues to use their account.

Flaw 3: Weak Token Verification

A particularly severe vulnerability arises from inadequate verification of the mobile app token during the authorization process. Instead of verifying the integrity and authenticity of the app token, some servers only check the account identifier (e.g., a phone number).

Attack Type 3: Universal Account Takeover

This flaw represents a catastrophic breakdown in identity verification.

• Mechanism: The server fails to properly verify the app token that the trusted mobile app sends to authorize the QR code. Instead, it might only check if a known account identifier, such as a phone number, is associated with the request. This means an attacker, by simply knowing a victim's phone number or similar account ID, can bypass the entire QR code scanning and app authorization process. The attacker can then craft a request that purports to be from the victim's trusted app, using only the known account identifier to gain access.
• Impact: This is an "alarming" universal account takeover. The researchers found this on a popular cloud storage service, granting attackers full access to private files and highly sensitive data. The implications are immense, as a single, simple flaw in identity verification can compromise an entire user base with minimal attacker effort.

The talk mentions that there are "more attack types, case studies, and technical discussions" in the full paper, indicating that these three detailed examples represent a subset of the vulnerabilities discovered. The overarching theme across these flaws is a failure to uphold the core security principles of confidentiality, integrity, and consistency for the critical variables involved in QR login.

Demo / Proof of Concept

▶ Watch: Reusable QR code attack for simultaneous account takeover (9:50)

While the presentation did not feature a live, interactive demonstration of an attack, the researchers extensively detailed their semi-automated testing pipeline as a robust proof-of-concept for their methodology and findings. This pipeline served as the primary tool to validate the existence and exploitability of the discovered flaws in real-world environments.

The pipeline functioned by:

1. Capturing Traffic: Intercepting and recording network communications during the QR login process.
2. Analyzing Behavior: Examining the sequences of requests and responses, scrutinizing how session IDs, QR IDs, and tokens were generated, transmitted, and validated (or not validated).
3. Checking for Flaws: Automatically identifying the six security flaws previously defined in their threat model and security analysis.

The results of running this pipeline against 109 testable QR login websites served as compelling evidence of the vulnerabilities. The "walk through a few of the attacks we found in the real world," where the speakers elaborated on Authorization Hijacking, Reusable QR Code Account Takeover, and Universal Account Takeover, effectively served as a demonstration of the results of their proof-of-concept exploits. The fact that they received 42 confirmed vulnerability IDs from vendors further validates the practical exploitability and severity of the issues uncovered by their testing framework. This systematic approach, rather than a single live demo, provided a broader and more impactful validation of the insecurity of real-world QR login deployments.

Defensive Implications

▶ Watch: QL Checker auditing tool and developer recommendations (11:40)

The findings presented in this research carry profound implications for both developers designing and implementing QR code login systems, and for end-users who rely on these systems for convenient authentication. Immediate and comprehensive action is required to mitigate the widespread vulnerabilities identified.

For Developers

Developers must critically reassess their QR login implementations, moving beyond a focus on mere convenience to prioritize robust security. The following measures are crucial:

1. Implement Strong Session Binding: The most critical fix to prevent authorization hijacking is to securely bind the session ID (representing the browser's context) to the generated QR ID. The server must rigorously verify that the entity polling for the QR code's status is indeed the same browser session that initially requested its generation. This ensures that an attacker with a stolen QR ID cannot simply join the polling game and hijack the login.
2. Ensure Single-Use QR Codes and Prompt Invalidation: QR codes and their associated authorizations must be strictly single-use. Once a QR code has been successfully scanned and used for authentication, its authorization state on the server must be immediately and irrevocably invalidated. This prevents the "Reusable QR Code Account Takeover" attack, ensuring that an attacker cannot simply wait for the victim to log in and then reuse the same QR ID to gain access. The server should also implement a strict expiration timeout for QR codes, invalidating them if not used within a short, defined period.
3. Robust App Token Verification: To counter "Universal Account Takeover" and other impersonation attacks, developers must implement strong verification of the app token. The server should not rely solely on a simple account identifier like a phone number. Instead, it must cryptographically verify the authenticity and integrity of the app token sent by the mobile device, ensuring it originates from the legitimate, trusted application and is truly associated with the intended user. This typically involves using digital signatures, secure cryptographic keys, and potentially short-lived, unique tokens.
4. Adherence to Core Security Principles: Developers should design QR login systems with fundamental security principles in mind:

• Confidentiality: QR IDs and associated session data should be treated as sensitive credentials and protected from leakage (e.g., through insecure display, logging, or transmission).
• Integrity: All critical data exchanges (QR ID generation, authorization requests, token issuance) must be protected against tampering.
• Consistency: The state of the QR login process must be consistently maintained across the server, browser, and mobile app, preventing race conditions and unexpected state transitions.

1. Utilize Auditing Tools: The researchers developed an auditing tool called QLChecker, specifically designed for developers to test their QR login implementations. This tool can identify existing flaws and suggest corresponding fixes. While responsibly available upon request to vendors to prevent misuse, its existence highlights the need for automated security testing in this domain. Developers should integrate such tools into their development lifecycle to proactively identify and rectify vulnerabilities.
2. Stay Informed and Consult Research: Developers should actively consult security research, such as the full paper associated with this talk, to understand the nuanced technical details of these vulnerabilities and the recommended mitigation strategies.

For Users

While the primary burden of securing QR login rests with developers, users also have a role to play in protecting themselves:

1. Treat QR Codes as Passwords: Users must understand that a QR code displayed for login is as sensitive as a password. It should not be exposed to others, photographed, or shared. Be mindful of shoulder surfing in public spaces.
2. Be Wary of Malicious Extensions: Exercise caution when installing browser extensions, as malicious ones could capture and transmit QR codes displayed on your screen.
3. Verify Login Attempts: Always carefully read the confirmation prompt on your mobile device before approving a QR login. Ensure the details (e.g., location, device type) match your current login attempt.
4. Report Suspicious Activity: If you suspect unauthorized access or notice unusual behavior related to your QR logins, report it immediately to the service provider.

By adopting these defensive measures, both developers and users can collectively work towards making QR code-based login a truly secure and reliable authentication method.

Key Takeaways

• QR code-based login, while convenient, is often insecure in real-world deployments due to a critical lack of standardized security protocols and widespread implementation flaws.
• A systematic study of 109 real-world QR login websites revealed that a significant 43% suffered from at least one serious security flaw, leading to 42 confirmed vulnerability IDs.
• The research identified six fundamental security flaws that enable five new types of attacks, including authorization hijacking, reusable QR code account takeover, and universal account takeover.
• Key vulnerabilities stem from session IDs not being bound to QR codes, reusable or predictable QR IDs, and weak or absent app token verification.
• Developers must implement robust security measures, including strict session-to-QR code binding, immediate invalidation of QR codes after use, and strong cryptographic verification of app tokens, moving beyond simple account identifiers.
• Users should treat QR codes as sensitive credentials, similar to passwords, and be aware of risks like shoulder surfing and malicious browser extensions, always verifying login prompts on their trusted devices.

About the Speaker(s)

Xin Zhang is a researcher from Fudan University. This presentation highlights their collaborative work with Sun Yat-sen University, focusing on the practical security implications of QR code-based login systems in widespread digital platforms. Their research provides a systematic analysis of real-world implementations, identifying critical vulnerabilities and offering practical recommendations for enhancing security.