QR Inception: Barcode-in-Barcode Attacks
With barcode-in-barcode attacks, two different barcodes are encoded in the same rectangular area, optically appearing as one barcode. This can be accomplished by generating one complex barcode that confirms to multiple standards, or by hiding a smaller one within a bigger one. The latter is similar to Packet-in-Packet attacks known from radio systems. However, this attack relies less on probabilistic errors, and more upon implementation differences of the decoders. It bears resemblance to protocol decoding mismatches, where e.g. a firewall or anti-virus scanner decodes and interprets data differently than the server behind it – allowing an exploit to pass. Any ambiguity is therefore a potential security risk
Das Paper gibt's hier.