消失：恶意QR代码网络钓鱼的现场研究
Gone Quishing: A Field Study of Phishing with Malicious QR Codes
摘要：
COVID-19大流行使恶意QR码成为共享URL（包括恶意URL）的方便中间人，从而使“quishing”或网络钓鱼成为可能。为了探索quishing现象，我们进行了一项173名参与者的研究，我们使用了一个带有恶意QR码的COVID-19数字护照注册试验作为借口。我们发现，67%的参与者乐于使用Google或Facebook凭据注册，18.5%的人愿意创建新帐户，只有14.5%的人愿意跳过注册。方便是愿意出示参与者证书的唯一最常被引用的因素。不愿意将个人账户与新服务联系起来是创建新账户或跳过注册的原因。我们还开发了Quishing Awareness Scale（QAS），发现参与者的QR码行为与他们的注册选择之间存在显着关系：选择注册Facebook的人得分最低，而选择跳过的人得分最高。我们使用我们的研究结果，提出quishing意识培训指南，并开发和测试可用的安全指标，警告用户quishing的威胁。
英文摘要：
The COVID-19 pandemic enabled "quishing", or phishing with malicious QR codes, as they became a convenient go-between for sharing URLs, including malicious ones. To explore the quishing phenomenon, we conducted a 173-participant study where we used a COVID-19 digital passport sign-up trial with a malicious QR code as a pretext. We found that 67 % of the participants were happy to sign-up with their Google or Facebook credentials, 18.5% to create a new account, and only 14.5% to skip on the sign-up. Convenience was the single most cited factor for the willingness to yield participants' credentials. Reluctance of linking personal accounts with new services was the reason for creating a new account or skipping the registration. We also developed a Quishing Awareness Scale (QAS) and found a significant relationship between participants' QR code behavior and their sign-up choices: the ones choosing to sign-up with Facebook scored the lowest while the one choosing to skip the highest on average. We used our results to propose quishing awareness training guidelines and develop and test usable security indicators for warning users about the threat of quishing.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
