Post B5yVMsbbQ3vtCA0k7s by EriogonumDarwin@mastodon.social
(DIR) More posts by EriogonumDarwin@mastodon.social
(DIR) Post #B5qauDlugovWu5s8Jc by SecureOwl@infosec.exchange
0 likes, 4 repeats
trying a new thing, have 3D printed a QR code and put it on the front porchQR code triggers a canary tokenwant to see if any of the delivery companies are using the drop off proof of delivery pics to train AI#infosec
(DIR) Post #B5qauER2Dvouxd6yPY by SecureOwl@infosec.exchange
0 likes, 3 repeats
Whelp, sample size of 1 so far, but about 50 minutes after an amazon delivery - where a picture was taken - got a hit on the canaryi just checked the delivery photo and the QR code was visible in itUser agent was not a phone and clearly some sort of crawlerIP address was a CDNbut we are 1/1, lets see how it goes with a few more(i get a lot of random work deliveries)
(DIR) Post #B5vTxUFEAllyyOzeNs by SecureOwl@infosec.exchange
1 likes, 1 repeats
Experiment updateAmazon are 2/2 for hitting the QR canary token - same CDN, same non-phone user agent each time. Seems to happen async after the delivery, maybe 20 mins or so later.Actual delivery photo from today below.Only other test subject so far is Fedex, they did not trigger the QR.#infosec
(DIR) Post #B5yVMsbbQ3vtCA0k7s by EriogonumDarwin@mastodon.social
0 likes, 0 repeats
@SecureOwl any chance we could mess with Flock in a similar way? Just wondering for a thought experiment, of course. I love my tech overlords and their minions. /s
(DIR) Post #B5yVMstgKqOW6ETBJ2 by SecureOwl@infosec.exchange
0 likes, 0 repeats
@EriogonumDarwin great idea- they have flock cameras at my local home depot - will take the qr on a road trip and report back
(DIR) Post #B5yVMt6RZObQjoRNCK by Jes@labyrinth.zone
0 likes, 0 repeats
@SecureOwl @EriogonumDarwin llm injector embroidery patch
(DIR) Post #B5yVMtqsmjkX3qASa8 by EriogonumDarwin@mastodon.social
0 likes, 0 repeats
@SecureOwl Aaaand now I want clothing with subtle qr codes. this will not end well.
(DIR) Post #B6F8t8ZSbJHSiejxWy by SecureOwl@infosec.exchange
0 likes, 0 repeats
UPS delivery today - photo taken - no hits on the canary, which means Amazon still remains the only deliverer to have triggered it
(DIR) Post #B6F8t8knv8M3Hq31DE by SecureOwl@infosec.exchange
0 likes, 0 repeats
delivery person today put package actually on top of the QR code so it wasn’t in the POD photo
(DIR) Post #B6F8t8v5IuZtnirEEi by SecureOwl@infosec.exchange
0 likes, 1 repeats
Update on my QR porch ornament experiment.There have now been 4 Amazon proof of delivery images containing the code.The first two, reliably hit the canary token within 20-40 minutes of the delivery, from a non-phone QR code. Definitely some sort of automated process.The third one, did hit the QR, but it was because the delivery person took it upon themselves to scan the QR code with their phone to see what it did - user agent confirmed that. There were no programatic hits like the first two.Fourth one, in the picture, but no hit registered.UPS/FedEx/USPS - not even as much as a flicker of a GET request to my canary.Bonus points, while driving I exposed my QR code to a couple of Flock cameras, but alas they didn't do anything.Next step will be a new QR code, one that points to a different domain, because the next thing to check is - did they start blocking the requests to Canarytoken dot org from whatever process was ingesting the images - because that is what it seems like.
(DIR) Post #B6F8xej2zbJvbTNZLc by Viss@mastodon.social
0 likes, 0 repeats
@SecureOwl how can you tell that a hit to the qr code is ai? user agent?
(DIR) Post #B6F8xesGRKh243gviK by SecureOwl@infosec.exchange
0 likes, 0 repeats
@Viss all i can tell is there is some automated process at the motrying to think of a way to figure out if its ai, might print a qr that contains an instruction to go to a second url to see if it follows
(DIR) Post #B6F8xf1Tt448We0I52 by mirabilos@toot.mirbsd.org
0 likes, 0 repeats
@SecureOwl @Viss different informations for AI and humans…