QR codes are, if you think about it, pretty incredible things. A compact, optical way to store information? That can be easily reproduced and created? They can store about three kilobytes (3K) of data, which doesn’t sound like too much, until you remember that most early Atari 2600 games were only 2K, and people have managed to cram entire Doom-like games into a QR code. I mention all this for two reasons: first, to remind us of this remarkable age we live in, and to remind us of this ridiculous age we live in, because that QR code tech is also surprisingly easy to subvert, as a charming little tourist town in Ontario, Canada has learned.
The Historic Village of Elora is, I’m told, a community within Centre Wellington in Ontario, but not being Canadian, these words mean very little to me. What I can see is that Elora looks like a very picturesque and vibrant little town, with lots of historic buildings and shops and pubs and restaurants. It’s a nice little tourist escape, and as such you can imagine that parking payments are an important part of the municipal economy.
Elora introduced a new online-based paid parking system back in May, which was designed to make it easier for tourists to visit and park easily; locals would not need to pay for parking (after registering their license plates with the county), but outside tourists would. The system relied on visitors scanning a QR code to get access to a web-based portal where they could enter their license plate numbers and their payment information.
Instead, they got porn.
Somehow, people attempting to use the QR code found their browsers directed not to any sort of official parking payment portal, but instead to a porn site. I have so far spent fourteen hours attempting to figure out just which porn site it was, but so far my research has yielded no tangible results. Don’t worry, though: I will keep trying. As soon as I get more Gatorade and hand lotion.
Some sources have suggested that the compromised QR code will send you to a changing selection of sites, with some being porn, sometimes to sites attempting to get you to install a virus. Regardless of where the QR code sent people, it was not to a place that allowed for paying for parking.
The online parking system took people to a page that seemed like the correct one, but would not allow for payments, and if users clicked a button to pay for a parking ticket, they would be sent to the porn site. Visitors to the town seemed to treat it all with good humor mostly, perhaps because they were not just getting porn, but porn and free parking.
The township has covered the parking signs with black trash bags to hide the offending QR codes, and has effectively taken the parking kiosks offline, suspending parking payments until they figure out what to do next. The township also notes that no personal data appears to have been compromised, and the township’s website has this notice:
I’m curious how this all happened; because the issue affected the printed QR codes on the signs, it couldn’t be just some hack of the system. Whatever happened had to occur while the system was being developed, and when the QR code itself was generated. Then, that system had to either not have been fully tested until well after the signs were printed, or perhaps whatever URL the QR code pointed to – or some URL within the parking payment site that it pointed to, like whatever the pay parking ticket button was linked to – would have had to have been redirected to the porn site.
Whatever happened, there seems to have been multiple steps. Was it an unfortunate accident? A deliberate hack? A clever marketing ploy for some porn site?
Who knows. This is such an incredibly modern problem; imagine trying to explain to someone from 1980 how a parking meter screwed up so badly it was distributing porn.
What a world.
Top graphic images: Elora; CTV News/YouTube
“Why yes I did
order a pizza, I mean try to pay for parking.” – Bow Chicka Bow Bow!So close: porking meter.
Live by the phone; die by the phone.
It’s a feature not a bug.
Soary ‘boat that, eh.
If in Alberta, it might have been Bannffed.
or ex-jasperated…
There’s usually no shortage of ex-jasperation going on in porn.
Friend of mine was a graphic designer and did some signs with QR codes- until they paid the QR codes did not go to the client’s site- most went to the designers- but he figured one guy was gonna skip on the bill so it went to a VERY nasty site- as expected the guy took the proof had it printed elsewhere and posted- His parking lot cleaning QR code went to a site with hairy guys- think Goatse but with bears
Damn, that’s impressive! I generally lose interest after 15-30 mins.
Maybe using a black sharpie that can change everything teaching why it is not a good idea
Grift fail. The goal is to get people to send you the money while thinking they are paying for parking. Bonus points if you can slurp more lucre than the mark thinks they are sending. Offer to accept payment in Dogecoin and drain the entire wallet.
We would have also accepted “porking meter”
As has already been pointed out, a simple sticker with the wrong code could have been placed over the originals
Let’s assume the QR Code is displayed on a screen for easier updates.
This little town may not have much of a tech budget, and someone compromised the hosting site for their parking app, replacing the redirect to the parking app with said adult entertainment website.
Another option, the DNS Registration expired, someone noticed it, grabbed the domain name and replicated the site.
Final answer, a disgruntled employee or unpaid contractor did it.
Most likely answer. There have been stories in the past where criminals put fake QR stickers on parking meters to steal credit card info. I’m guessing in this case it was a bored teenager.
Now I know how I’m spending my weekend!
Ma’am, we deal harshly with people who don’t pay for parking. Get ready to do some *hard* time.
Ziiiiiiiip
Why not just provide a meter as opposed to telling everyone about me for a quarter
It is pretty common for a scammer to simply print out a new QR code on a sticker and put it over the original.
how a parking meter screwed up so badly it was screwing people by directing them to people being screwed.