QR codes are, if you think about it, pretty incredible things. A compact, optical way to store information? That can be easily reproduced and created? They can store about three kilobytes (3K) of data, which doesn’t sound like too much, until you remember that most early Atari 2600 games were only 2K, and people have managed to cram entire Doom-like games into a QR code. I mention all this for two reasons: first, to remind us of this remarkable age we live in, and to remind us of this ridiculous age we live in, because that QR code tech is also surprisingly easy to subvert, as a charming little tourist town in Ontario, Canada has learned.
The Historic Village of Elora is, I’m told, a community within Centre Wellington in Ontario, but not being Canadian, these words mean very little to me. What I can see is that Elora looks like a very picturesque and vibrant little town, with lots of historic buildings and shops and pubs and restaurants. It’s a nice little tourist escape, and as such you can imagine that parking payments are an important part of the municipal economy.
Elora introduced a new online-based paid parking system back in May, which was designed to make it easier for tourists to visit and park easily; locals would not need to pay for parking (after registering their license plates with the county), but outside tourists would. The system relied on visitors scanning a QR code to get access to a web-based portal where they could enter their license plate numbers and their payment information.
Instead, they got porn.
Somehow, people attempting to use the QR code found their browsers directed not to any sort of official parking payment portal, but instead to a porn site. I have so far spent fourteen hours attempting to figure out just which porn site it was, but so far my research has yielded no tangible results. Don’t worry, though: I will keep trying. As soon as I get more Gatorade and hand lotion.
Some sources have suggested that the compromised QR code will send you to a changing selection of sites, with some being porn, sometimes to sites attempting to get you to install a virus. Regardless of where the QR code sent people, it was not to a place that allowed for paying for parking.
The online parking system took people to a page that seemed like the correct one, but would not allow for payments, and if users clicked a button to pay for a parking ticket, they would be sent to the porn site. Visitors to the town seemed to treat it all with good humor mostly, perhaps because they were not just getting porn, but porn and free parking.
The township has covered the parking signs with black trash bags to hide the offending QR codes, and has effectively taken the parking kiosks offline, suspending parking payments until they figure out what to do next. The township also notes that no personal data appears to have been compromised, and the township’s website has this notice:
I’m curious how this all happened; because the issue affected the printed QR codes on the signs, it couldn’t be just some hack of the system. Whatever happened had to occur while the system was being developed, and when the QR code itself was generated. Then, that system had to either not have been fully tested until well after the signs were printed, or perhaps whatever URL the QR code pointed to – or some URL within the parking payment site that it pointed to, like whatever the pay parking ticket button was linked to – would have had to have been redirected to the porn site.
Whatever happened, there seems to have been multiple steps. Was it an unfortunate accident? A deliberate hack? A clever marketing ploy for some porn site?
Who knows. This is such an incredibly modern problem; imagine trying to explain to someone from 1980 how a parking meter screwed up so badly it was distributing porn.
What a world.
Top graphic images: Elora; CTV News/YouTube
I walked by a temporary NO PARKING sign the other day and someone had taken a Sharpie and converted the P to a B. I got a chuckle out of that.
When I was a TV news photographer, one of my colleagues joked that the NO stood for News Only. Turns out, parking enforcement officers often didn’t see it that way.
This reminds me of 25 or so years ago, when the common wisdom was “don’t go to porn sites, you’ll get a computer virus,” but the computer porfessionals’ wisdom was, “porn sites are money-making businesses that hire professionals. Don’t go to church websites, which are put together by amateurs, because you’ll get a virus.” Small Canadian town brings this to mind.
I was hoping you would provide an example of the QR code in question. It’s for a friend.
I didn’t know we had any friends in common!
In the late 90’s as more orgs were going online, I was engaged to do an audit of a fairly large online system that had been built by a contractor. The system was exhibiting ‘strange’ performance problems according to the client. While monitoring the system the logs started showing some weird traffic patterns. After some investigation it turned out that the vendor had subcontracted part of the work. The subcontractor had build a ‘hidden’ porn site and was vending inages and videos from the system. The system was seriously over spec d and built for what it was supposed to be supporting. Needless to say it was immediately taken off line. The biggest challenge I had was writing up the report and tip toeing around the content ‘problem’ while explaining the issues I’d found.
One wonders how you are supposed to pay if you don’t have a smartphone.
You buy a smartphone or find someplace else to park.
Even with smartphones I have left a city and spent my money elsewhere due to app only parking.
You are wise. There’s a scan-the-QR-code-to-pay lot near one of the major stadiums where I live, I used it once.
Weeks after the only time I used it, I saw small “feeler” charges from them on my credit card. Turns out they scan license plates and when they see you pull into a lot they use those feeler charges to validate the card you used last time is active . . . But I didn’t give them permission to store my card. Add that I was not anywhere near the lot they claim I was that day, and it convinced me to never use a lot like that again (for as long as I could avoid it).
I’m on one of the cheaper networks in Ontario, and coverage in some of the more rural areas can be spotty. For that matter, I’ve had spotty connectivity at my office, sitting on the border of two of the country’s largest cities. Even with a smartphone, I get a bit old man yelling at cloud at anything that expects my phone to be a payment device.
Damn. The code was gloved. No love.
Thomas reported on a story a couple of years ago in Maryland (my home state) when someone let the domain for our War of 1812 license plates lapse, and the address on 800,000 plates went to a Filipino gambling site. Update your registries, friends.
That reminds me of one of my favorite jokes:
“Man…I can’t, for the life of me, ever remember what year the War of 1812 was”
Ha ha
Take the Freeway of Love and exit at Lover’s Lane *or* Avenue Q if that is your preference.
Trekkie monster is that you?
No. Trekkie monster wouldn’t know about the exit at Lover’s lane.
This exact thing happened somewhere else a few years ago. My guess they fined the wrong person. I guess you could say they took things into their own hands and offered the same to the town at large. Anything weird like this combined with wild fire smoke / pollution is too dystopian.
Did the porn at least comply with Canadian content rules?
All the actors were wearing plaid before the disrobing.
Poutine porn, don’t ‘cha know
And had no grooming done on men or women
I imagine those ladies were in fact barenaked. That has to count for something.
Probably just sent them to PornHub, since they’re headquartered in Montreal.
Yes, they first orgasmed in English then again in French.
I think Porking Meter would have been better, but maybe I’m the odd man out on this one.
No, you’re right.
That’s definitely how I read the topshot initially
“Why yes I did
order a pizza, I mean try to pay for parking.” – Bow Chicka Bow Bow!I could make this scenario work, script can be in on the desk COB Monday, we can shoot Tuesday morning, and have it on the Internet by lunchtime
Why’s it going to take so long to write the script?
I’m incredibly lazy
OK, good self-awareness.
So close: porking meter.
Live by the phone; die by the phone.
It’s a feature not a bug.
Soary ‘boat that, eh.
If in Alberta, it might have been Bannffed.
or ex-jasperated…
There’s usually no shortage of ex-jasperation going on in porn.
The irony of this being done in the capital of Sask would be soooo rich
Ah yes. The city whose name rhymes with fun.
Friend of mine was a graphic designer and did some signs with QR codes- until they paid the QR codes did not go to the client’s site- most went to the designers- but he figured one guy was gonna skip on the bill so it went to a VERY nasty site- as expected the guy took the proof had it printed elsewhere and posted- His parking lot cleaning QR code went to a site with hairy guys- think Goatse but with bears
Damn, that’s impressive! I generally lose interest after 15-30 mins.
Maybe using a black sharpie that can change everything teaching why it is not a good idea
That’d be some very, very impressive work to change a QR code to an arbitrary site with a sharpie.
Grift fail. The goal is to get people to send you the money while thinking they are paying for parking. Bonus points if you can slurp more lucre than the mark thinks they are sending. Offer to accept payment in Dogecoin and drain the entire wallet.
We would have also accepted “porking meter”
As has already been pointed out, a simple sticker with the wrong code could have been placed over the originals
Let’s assume the QR Code is displayed on a screen for easier updates.
This little town may not have much of a tech budget, and someone compromised the hosting site for their parking app, replacing the redirect to the parking app with said adult entertainment website.
Another option, the DNS Registration expired, someone noticed it, grabbed the domain name and replicated the site.
Final answer, a disgruntled employee or unpaid contractor did it.
Most likely answer. There have been stories in the past where criminals put fake QR stickers on parking meters to steal credit card info. I’m guessing in this case it was a bored teenager.
Now I know how I’m spending my weekend!
Ma’am, we deal harshly with people who don’t pay for parking. Get ready to do some *hard* time.
Ziiiiiiiip
Why not just provide a meter as opposed to telling everyone about me for a quarter
It is pretty common for a scammer to simply print out a new QR code on a sticker and put it over the original.
how a parking meter screwed up so badly it was screwing people by directing them to people being screwed.