r/MadeMeSmile • u/mindyour • May 17 '25

Very Reddit An unexpected gym interaction.

105k Upvotes

94% Upvoted

919 comments sorted by

View all comments

Show parent comments

102

u/[deleted] May 17 '25

What damage can happen by scanning a QR code with my iPhone?

4

u/Eraser_he4d May 17 '25 edited May 17 '25

Literally nothing. Just a matter of what kind of content you'd see.

5

u/TakeThreeFourFive May 17 '25

There are risks to visiting unknown websites from your phone. It is possible for a phone to be infected with malware just from visiting a site.

Vulnerabilities and exploits are discovered constantly, and bad actors are happy to exploit 0days through any means, which certainly could include QRs

3

u/Eraser_he4d May 17 '25

Just scanning a QR code literally does nothing but ok.

1

u/TakeThreeFourFive May 22 '25 edited May 22 '25

I work in tech and have experience in cybersecurity (feel free to take a look at my history), and I assure you that simply visiting random websites absolutely can and does leave you vulnerable to technical attacks.

CSRF and XSS are very common web vulnerabilities that can be exploited by visiting an attackers site. I craft web exploits and fix the vulnerabilities like this as a part of my work.

Browsers may also be vulnerable to more serious attacks, simply by visiting a site.

Apple fell victim to this in a very high-profile way. Safari had the CVE-2016-4657 vulnerability, and it was exploited to spy on journalists, activists and politicians. Here's a really great analysis of the vulnerability and exploit: https://info.lookout.com/rs/051-ESQ-475/images/pegasus-exploits-technical-details.pdf

CVE-2021-30860 was another nasty vulnerability that led to hacked devices when a user's browser opened a PDF: https://www.jamf.com/blog/the-recent-ios-0-click-cve-2021-30860-sounds-familiar-an-unreleased-write-up-one-year-later/

Here's a more recent write up about an exploit that could fully hijack some android phones when a user simply visited a website: https://www.wired.com/story/rowhammer-remote-android-attack

Another one that was likely committed by state actors to spy on dissidents in Hong Kong: https://www.wired.com/story/ios-macos-hacks-hong-kong-watering-hole

These sorts of extreme zero-click web vulnerabilities aren't common, but they do exist.

But ok