QR codes are, if you think about it, pretty incredible things. A compact, optical way to store information? That can be easily reproduced and created? They can store about three kilobytes (3K) of data, which doesn’t sound like too much, until you remember that most early Atari 2600 games were only 2K, and people have managed to cram entire Doom-like games into a QR code. I mention all this for two reasons: first, to remind us of this remarkable age we live in, and to remind us of this ridiculous age we live in, because that QR code tech is also surprisingly easy to subvert, as a charming little tourist town in Ontario, Canada has learned.
The Historic Village of Elora is, I’m told, a community within Centre Wellington in Ontario, but not being Canadian, these words mean very little to me. What I can see is that Elora looks like a very picturesque and vibrant little town, with lots of historic buildings and shops and pubs and restaurants. It’s a nice little tourist escape, and as such you can imagine that parking payments are an important part of the municipal economy.
Elora introduced a new online-based paid parking system back in May, which was designed to make it easier for tourists to visit and park easily; locals would not need to pay for parking (after registering their license plates with the county), but outside tourists would. The system relied on visitors scanning a QR code to get access to a web-based portal where they could enter their license plate numbers and their payment information.
Instead, they got porn.
Somehow, people attempting to use the QR code found their browsers directed not to any sort of official parking payment portal, but instead to a porn site. I have so far spent fourteen hours attempting to figure out just which porn site it was, but so far my research has yielded no tangible results. Don’t worry, though: I will keep trying. As soon as I get more Gatorade and hand lotion.
Some sources have suggested that the compromised QR code will send you to a changing selection of sites, with some being porn, sometimes to sites attempting to get you to install a virus. Regardless of where the QR code sent people, it was not to a place that allowed for paying for parking.
The online parking system took people to a page that seemed like the correct one, but would not allow for payments, and if users clicked a button to pay for a parking ticket, they would be sent to the porn site. Visitors to the town seemed to treat it all with good humor mostly, perhaps because they were not just getting porn, but porn and free parking.
The township has covered the parking signs with black trash bags to hide the offending QR codes, and has effectively taken the parking kiosks offline, suspending parking payments until they figure out what to do next. The township also notes that no personal data appears to have been compromised, and the township’s website has this notice:
I’m curious how this all happened; because the issue affected the printed QR codes on the signs, it couldn’t be just some hack of the system. Whatever happened had to occur while the system was being developed, and when the QR code itself was generated. Then, that system had to either not have been fully tested until well after the signs were printed, or perhaps whatever URL the QR code pointed to – or some URL within the parking payment site that it pointed to, like whatever the pay parking ticket button was linked to – would have had to have been redirected to the porn site.
Whatever happened, there seems to have been multiple steps. Was it an unfortunate accident? A deliberate hack? A clever marketing ploy for some porn site?
Who knows. This is such an incredibly modern problem; imagine trying to explain to someone from 1980 how a parking meter screwed up so badly it was distributing porn.
What a world.
Top graphic images: Elora; CTV News/YouTube
Ha ha…so was there anyone trying to park who owned “a Lexus TX?”
If you know what I mean…
This is such a stupid “internet of things” failure. Parking meters were a solved problem that we unsolved by making people scan a stupid QR code. it used to take 15 seconds to hop out, insert a quarter and turn the knob. now i have to spend 15 minutes doing all this BS on my phone.
Well, this ruins it, but we’re at 69 comments now.
Ha! I thought I recognized that hotel. A travel YT channel I follow did a review on it a few years ago. Gorgeous views, but as I recall it’s outrageously expensive.
I heard that while the QR code issue is being dealt with, you can just call a number to pay over the phone. Looks like it’s 867-5309. Ask for Jenny
I work for one of the OEM repair info aggregators and in my early years GM had a toll-free number published in the service manuals for dealers to call to get unlock codes for radios. GM eventually abandoned the number and it was picked up by a phone sex line – A very angry customer notified us of it and of course we had to verify it.
I SPENT $450 AND THIS DAMN RADIO STILL DOESNT WORK!!!!
I had the opposite of this problem about 3 years ago.
At an Everything Electric event, Kia were offering test drives of their EVs, but to get one you had to scan a QR code and fill in an online form. My cellphone data provider for some reason had the site Kia was using for their form categorised as an “Adult only” website (perhaps because Kia understandably wasn’t offering the test drives to under 18s), and as I hadn’t enabled access to “Adult” websites on my data plan, I was blocked from accessing it.
They may have let the domain for the parking site lapse. Pornsters are always eager to snap up recently-expired domains.
I bet that is exactly what happened. A lot of people manage to have a domain name and website set up, but no one is paying attention when the domain name comes up for renewal. There is a 30-day grace period when a domain name expires, and then anyone can register it.
This even happened to Google.com one time, someone renewed it and IIRC Google (good guys at the time) paid them a modest amount for it instead of taking them to court.
This is also the exact sort of deal that ignorant/money-hungry localities will get into with shiny promises from a commercial vendor, and things don’t turn out as good as the salesmen said.
This makes me feel less paranoid about never using the QR code to get to the parking pay site.
QR codes are also trivially easy to hack in public places like this. Print a new sticker, slap it over the original QR code, and bam! You can send people wherever you want.
I think David even did an article about this a couple years ago because it happened to his wife.
No honey I wasn’t on a porn site I scanned a QR Code to pay for parking and it took me to the porn site
What kind of idiot do you think I am? It shows you were on our home computer
I hope this titillating story has a happy ending.
COTD
I see what you did there. I approve of your humor
In France they just print out the naughty QR code and stick it on top of official ones.
People have lost tens of thousands of Euros.
Variation where the QR code is on a screen, as I imagine these ones are, is to have the screen smeared with butter or some-such in the appropriate place and then a help full chap appears to help the befuddled masses, some times just running away with the unlocked smart-phone once he has his mits on it, sometimes taking it and transferring cash from it there and then while offering inane commentary.
I heard that someone put QR code stickers over the real QR codes on the signs.
The parking rates should have been the first clue: $5.99 for the first minute, and $1 for each minute after that…
So, you also became a member?
ParkHub