What's With All the Squares? QR Codes

A QR code is comprised of an array of squares, some of which are used for the image sensor to position itself (that's the large squares on three of the corners), while the rest of the cells contain version and format information as well as the data itself, of course, along with error correction coding.

Whereas most of the barcodes you come across are one-dimensional, such as UPC labels on items at the store, QR codes are two-dimensional and offer many advantages. For instance, QR codes can be scanned in any direction instead of only one, they can contain thousands of alphanumeric characters versus only a dozen or so, and when configured with a high level of error correction they are particularly capable at continuing to function after sustaining damage.

The more error correction a QR code has, the less data it can store and incidentally, the more data that is stored within a QR code, the more squares it will have. More squares are also required as the level of error correction is increased and artistic QR codes can forego data capacity for aesthetics by creating an image with some of the blocks.

Anatomy of the QR Code

(click to enlarge)

An early version of the two dimensional barcode system measured only 21 x 21 modules and contained just four characters of data, while the largest current version (40) spans 177 x 177 modules and can hold 1,264 characters of ASCII text or up to up to 7,089 numerals. Information can be encoded by a variety of methods and different types of encoding can be used in the same QR code:

• Numeric (10 bits per 3 digits)
• Alphanumeric (11 bits per 2 characters, but can't store lowercase letters)
• Byte (8 bits per character)
• Kanji (13 bits per character)
• And some more obscure modes such as FNC1 and ECI

Along with different standards for conventional QR codes, specifications for new iterations have been approved over the years, including MicroQR (11×11 modules containing as many as 35 numeric characters), iQR Code (holds 80% more data in the same space as a standard QR code), FrameQR (the one lets you create images in the QR code) and SQRC (stores public and private data, the latter of which can only be read by certain scanners).

Don't Trust Them Anywhere

While generally speaking QR codes are deemed safe to use, their most common exploit uses the URL data type to redirect users to malicious websites, for phishing purposes or by hosting executable data that exploits vulnerabilities in the client's applications (reader, web browser or image viewer).

There have been other incidents where malware has infected Android phones, for example to send costly SMS or to steal bank account information without the user ever noticing.