DEF CON 29 - Richard Henderson - Old MacDonald Had a Barcode, E I E I CAR
Why Hacker News recommends it
HN commenters recommend it as an entertaining demonstration of how scanners and antivirus software fail on unexpected input.
What it is
A DEF CON 29 talk by Richard Henderson about encoding the EICAR antivirus test string into QR codes and barcodes and scanning them at real systems. Many systems that do not expect such input misbehave or collapse, including a parking garage system.
Recommended by 4 HN commenters across 4 different months, 2021 to 2026.
What Hacker News said
Recommends grapescheesee · 2022-02 · on “FBI sounds alarm as QR code usage soars”
Richard Henderson had a talk at the last Defcon about QR codes. I'd recommended checking it out. Video - [this video] PDF of slides - [LINK]
Recommends jrockway · 2023-11 · on “Horrible edge cases to consider when dealing with music (2022)”
None of this seems too terrible to handle. The title of the song can be an empty string, so use *string/Maybe string instead of string to distinguish between unset and "some idiot made the song literally untitled". I am surprised there are no songs that use characters only available in two different character sets, or are the same Chinese character repeated with multiple different writings (Simplified Chinese, Traditional Chinese, Korean, Japanese). I suppose that some people are running into trouble by using CHARACTER VARYING(n) instead of TEXT in their database, but if you pick the most likely database for your local music player, then it doesn't matter. (sqlite doesn't care, basically.) T
Recommends Full_Clark · 2025-06 · on “Nitrogen Triiodide (2016)”
There's a good DEFCON 29 presentation on this topic. [this video] If you skip forward to 16m 33s you'll be treated to a lively streak of invective from the passenger of a car whose driver has just confirmed that feeding EICAR to a parking system prevents it from letting any vehicle past the barrier.
Recommends tetha · 2026-04 · on “Claude system prompt bug wastes user money and bricks managed agents”
Do have way too much fun with EICAR: [this video] This guy put the EICAR test string into a barcode and started to scan it on various systems, with rather funny effects.
Cites dogleash · 2021-08 · on “Apple Has Opened the Backdoor to Increased Surveillance and Censorship”
>innocuous QR code might automatically download an image Just a few days ago at DEF CON some presenter had been going around with the EICAR test string in a QR code and having fun with all the forced AV hits that can cause. [this video] [LINK]
Cites fortran77 · 2022-03 · on “Gas pumps happen to be about as insecure as your typical router”
You can shut down all sorts of things with the EICAR string encoded as a QR code. See: [LINK] and this video [this video] where all the gates at a parking garage are rendered inoperable because someone scanned a QR code that encoded EICAR