论文标题
消失：对恶意QR码的网络钓鱼的现场研究
Gone Quishing: A Field Study of Phishing with Malicious QR Codes
论文作者
论文摘要
共同的-19大流行使“呼吸”或恶意QR码的网络钓鱼成为共享URL的方便之际，包括恶意的URL。为了探索呼吸现象，我们进行了一项173个参与者的研究，在其中使用了COVID-19数字护照注册试验，并以恶意QR码为借口。我们发现，有67％的参与者很乐意与他们的Google或Facebook凭据注册，18.5％的参与者可以创建一个新帐户，只有14.5％可以跳过注册。便利是愿意屈服参与者证书的最多引用的因素。不愿将个人帐户与新服务联系起来是创建新帐户或跳过注册的原因。我们还开发了呼吸意识量表（QAS），并发现参与者的QR码行为与他们的注册选择之间存在显着的关系：选择与Facebook注册的人获得了最低分数，而那些选择平均跳过最高的人。我们利用结果提出了戒断意识培训指南，并制定和测试可用的安全指标，以警告用户引起的威胁。
The COVID-19 pandemic enabled "quishing", or phishing with malicious QR codes, as they became a convenient go-between for sharing URLs, including malicious ones. To explore the quishing phenomenon, we conducted a 173-participant study where we used a COVID-19 digital passport sign-up trial with a malicious QR code as a pretext. We found that 67 % of the participants were happy to sign-up with their Google or Facebook credentials, 18.5% to create a new account, and only 14.5% to skip on the sign-up. Convenience was the single most cited factor for the willingness to yield participants' credentials. Reluctance of linking personal accounts with new services was the reason for creating a new account or skipping the registration. We also developed a Quishing Awareness Scale (QAS) and found a significant relationship between participants' QR code behavior and their sign-up choices: the ones choosing to sign-up with Facebook scored the lowest while the one choosing to skip the highest on average. We used our results to propose quishing awareness training guidelines and develop and test usable security indicators for warning users about the threat of quishing.
