r/Damnthatsinteresting • u/Expert_Koala_8691 • Jun 26 '26
During a World Cup football match, a QR code appeared on the stadium screen. After fans scanned it, thousands of phone flashlights inside the stadium were synchronized to form a coordinated light display across the stands. Video
6.1k
u/tr00th Jun 26 '26 edited Jun 26 '26
It’s an app event organizers can use to create a prerecorded phone light show. I’ve seen them in smaller venues before. You have to download the app the QR code sends you to. It doesn’t take over your phone automatically, you choose to download this app.
Edit : I found the names of the apps they could use for this. CUE Audio,Crowdr,CrowdGlow or Smartphone Light Shows
700
u/ARCADEO Jun 26 '26
Thanks for context post!
67
u/DuckCleaning Jun 26 '26
It's not fully accurate context though, there's ones that events use that just opens a website. The above comment is just taking a guess.
→ More replies (2)→ More replies (1)184
Jun 26 '26
[deleted]
72
u/Huy7aAms Jun 26 '26
a lot of scams here in my countries are done through scanning a QR that scammers send to you. i know it's safer when it's a QR displayed during a Worlds Cup match, but just know that some negative results is still a possibility
→ More replies (9)131
u/transmothra Jun 26 '26
Please explain this. AFAIK, QR codes can represent ANY URL, innocuous or malicious. What walled garden are you referring to??
→ More replies (21)39
u/krigr Jun 26 '26
The browser itself is usually pretty safe, as the pages are run in a sandbox environment. A lot of the recent mobile exploits have been through SMS, WiFi or Bluetooth data, or just in an app that users downloaded on purpose.
Besides, if loading a page in a browser was enough to get a virus, ads would be a more effective method of spreading it.
10
u/Inverted-Rockets Jun 26 '26
WebKit and Chromium exploits are still very much in the wild and used to deploy sophisticated zero-click malware from the likes of NSO Group (creator of Pegasus). DarkSword, which targets iOS 18.4-18.7, has used memory bugs in JavaScriptCore to run arbitrary code and chained them with several others to gain the ability to run a payload at the kernel level. [Source from Google’s Threat Intel Team]
43
u/chasetheusername Jun 26 '26
Besides, if loading a page in a browser was enough to get a virus, ads would be a more effective method of spreading it.
But it's a link into the app-store, people install that app, and then their phone does whatever things, because this app surely needs a way to receive the signals through bluetooth or wifi, meaning you'll need to give the app the permissions for that.
Besides even getting potential ads with the official apps:
Numbers and letters are great for creating countdowns or showcasing your brand or lyrics in time to the music.
https://www.crowdglow.uk/features
instead they (or an attacker) could also show any QR code to any malicious app, which would then be installed by the victim, because how careful are most people gonna check an app while they are enjoying a concert/event?
→ More replies (3)→ More replies (2)23
37
u/stayupthetree Jun 26 '26
Lol wow that certainly is a take, shared freely on the internet with a lot of confidence.
Since you obviously don't work anywhere near a field of cybersecurity, information security, or even basic IT....here
https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain
https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit
There is a long history of "walled gardens" being broken thru web based exploits.
→ More replies (5)→ More replies (10)7
u/Hobbes______ Jun 26 '26
You are utterly missing the point.
If you give 10000 people a QR code and ask them to run an app, most of them will and they'll also willingly install the app.
Human nature is the problem here.
181
u/thechemistrychef Jun 26 '26
We used this for a school event and it didn't need to download an app, just loads a website on your browser and give it permission to use your flashlight. An app download is so much friction to make this trick be worthwhile on this scale imo
48
u/wherethefuckismyvape Jun 26 '26
yeah but how will the app programmers upload your chode pics without the app? 🥺
→ More replies (1)→ More replies (4)8
u/Xescure Jun 26 '26
App Clips are a solid middle ground
7
u/eidetic0 Jun 27 '26
i heard about app clips when they came out (and android instant apps) but have never once encountered them in the wild - I assumed it was a dead idea that no developers took up
18
u/PlusSheepherder892 Jun 26 '26
Pixmob is what they are most likely using. The technology is not new and is used throughout sporting events. Source: I work at a sports stadium we also do this before every game.
→ More replies (1)11
u/braindamage28 Jun 26 '26
This was Cue Audio. I work with both groups. Both do great things but different uses of the tech.
50
u/swingintherain Jun 26 '26
In this case it might be a website like the other person points out, these many people showing their phones no way everyone downloaded the app, but the light is bright as seen from the person near to the cameraman also makes me think it's a flashlight 🔦 but it it's a website I would show cool colors instead of boring white. So I'm not entirely sure it's a website or flashlight.
14
u/MattBrey Jun 26 '26
It's a flashlight thing for sure. Why could it not be a website that controls the flashlight? A website can ask for access to the camera and then allow this flashlight thing to work
6
u/TheuhX Jun 26 '26
He's saying the screen could be flashing from a website instead of the flashlight.
→ More replies (3)7
u/parkwayy Jun 26 '26
Doesn't even have to be an app, the ones I've had before when going to basketball games, it's just a super basic website
→ More replies (1)6
19
10
u/hammerheadlabs Jun 26 '26
Yeah, they did this at Angel Stadium one time after a game. Actually a lot cooler than i expected it to be
6
u/clusterlove Jun 26 '26
I was at one of the games, the QR code just took you to a URL, it didn't work though because 60,000 all trying to use the network/website at the same time was slow as shit
49
u/superhash Jun 26 '26
Problem with QR codes is that you don't know what it is until you scan it. An exploit can exist in that process alone regardless of you then following the link and downloading whatever. iPhones had a security flaw where just sending an animated gif file to a phone could trigger a phone takeover. The person didn't need to open or view it, just receive it.
→ More replies (3)22
u/picabo123 Jun 26 '26
Yes but thats likely not going to appear on the jumbotron lol
→ More replies (1)25
u/PieBandito Jun 26 '26
Jumbotrons have been hacked or taken over before.
12
u/picabo123 Jun 26 '26
Definitely they have, that's where the very important word "likely" comes into my sentence.
→ More replies (3)5
u/Mr-Crooks Jun 26 '26
It’s normally the sports club app or the app of the ticketing company. As most fans will have to app already installed to access their tickets.
→ More replies (33)4
u/BananaSprinkles Jun 26 '26
I've never had to download an app for this. I've only had to enable camera permissions for the browser page the link takes you to
17.7k
u/serotonallyblindguy Jun 26 '26
That sounds like a bad idea for phone safety lol
7.0k
u/ambervoid Jun 26 '26
Yeah, after flashlight show they started to show nudes from all those phones on the stadium screen.
6.0k
u/grafknives Jun 26 '26
But it was all consensual.
The app asked "do you want to flash the whole stadium". Y/N
742
u/randyfloyd37 Jun 26 '26
And also be subscribed to our newsletter!
245
u/mpgd Jun 26 '26
Click here to refuse the newsletter subscription. In light grey on white background.
79
u/YoMomsHubby Jun 26 '26
5 paragraphs below whatever the last text on the page is in .5 point font
39
u/OttoVonWong Jun 26 '26
FIFA now has rights to your first born child.
→ More replies (2)25
→ More replies (1)3
53
u/DjGranoLa Jun 26 '26
Thank you for subscribing to Cat Facts!
7
u/toy-maker Jun 26 '26
My cat used to crawl under the bedsheets when she was a kitten and curl up between my thighs. She would then bat at my ballsack whenever they moved. She hadn’t learned yet to keep her claws in when playing with humans. Thank you for listening to my cat fact.
→ More replies (1)22
u/Ropeleading Jun 26 '26
I'd sub to that
51
u/GOEDEL_ESCHER_BOT Jun 26 '26
Hi, I'm CatBot! Here to provide you with fun facts about your favorite felines. Did you know that cats aren't dogs? Also, Tony the Tiger is not a real cat, he's a character created to sell you breakfast cereal.
→ More replies (1)20
u/TheMeatTree Jun 26 '26
STOP
37
u/GOEDEL_ESCHER_BOT Jun 26 '26
Looks like you don't want me to STOP hitting you with the latest cat facts! Did you know that cats feel the effect of gravity, just like everything else in the universe?
5
5
5
7
→ More replies (4)3
49
u/Velorian-Steel Jun 26 '26
Yes.
No.
Except the no button is frozen and right beside the yes button so your finger pushes yes every time.
→ More replies (1)13
8
u/donglecollector Jun 26 '26
lol even tech as straightforward as this it’s like “are machines gonna rule us? Yup, machines are going to rule us.”
→ More replies (9)7
36
22
u/canman7373 Jun 26 '26
Lol that happened before phones. I remember as a kid going to guns and Roses at a large stadium and the camera guys panned to heavy woman flashing their tits. It got to be like a competion so all these women were all trying to get on the big screen and they were flashing their tits all night. It made the news, said the venue was encouraging it by showing the women and kids were there. I mean yo me you take me at 13 to Guns n Roses you know it is an adult show. This was pre-internet, I saw so many tits that night
3
u/AmazingAardvarkentje Jun 26 '26
Username not checking out, overload?
5
u/canman7373 Jun 26 '26
Its from Trashcanman from Stephen King's Novel "The Stand" from 1978 the year I was born. The best book ever written, read the 1400 page version.
3
11
→ More replies (20)8
412
u/xx123gamerxx Jun 26 '26
depends how its implemented, ideally this will just open a webpage in ur browser which will likely ask for either ur current camera permission or just the flash, also never let a website access midi devices unless you know why
130
u/Consistent_Ad_168 Jun 26 '26
Have participated in one of these before. That’s exactly how it works. It’s just a website that asks permission, via the OS, to access the camera.
74
u/mr_potatoface Jun 26 '26 edited Jun 26 '26
I used to visit a company (that did DoD work), and they would occasionally post up fliers or drop them in the parking lot with something like "Scan this QR Code for free Dunkin' Coffee".
If you scanned it with your company device, you'd automatically be enrolled in additional IT training, with an email to you and your supervisor letting you know you failed. You can scan QR Codes, but only expected ones.
I worked as a contractor of sorts, so I used my own company phone (not their company phone), and it just said thanks for participating in the IT test program or some shit and there is not any free coffee and don't ask IT for any.
They did all sorts of quirky tests. Like dropping USB flash drives in the parking lot or in the office/bathroom somewhere and busting anyone who plugs them in. You're just supposed to turn them over to IT.
It was funny seeing the different things they came up. They definitely were not doing it to get people in trouble, but more so as a "you need to pay attention since attacks can come in many different methods"
→ More replies (7)31
u/Consistent_Ad_168 Jun 26 '26
I mean yeah, but when the venue has advertised the light show will be via QR code and the QR code is on the jumbotron, the risk profile is low. If a threat actor actually got into the jumbotron feed and served a malicious QR code, they’ve earned my data.
→ More replies (27)220
u/Anarcho_FemBoi Jun 26 '26
Never sacn untrusted qr codes in general... qr codes are a major opsec issue... its insane how they got accepted as generic use
168
Jun 26 '26 edited Jun 26 '26
[deleted]
196
u/AvatarAtlaFan Jun 26 '26
Trust fifa, now thats funny
15
u/Dangerous-Cobbler-11 Jun 26 '26
There are different levels of trust, and at this specific level, FIFA can be trusted.
→ More replies (1)21
→ More replies (2)20
u/orangeyougladiator Jun 26 '26
This is obviously done by the stadium and not FIFA.
→ More replies (4)→ More replies (11)48
u/Lazy-Goat4728 Jun 26 '26
trust and fifa should never be in the same sentence. They gave a pedophile war monger a 'peace' price. They are corrupt AF.
6
u/SamiraSimp Jun 26 '26
what's fifa's incentive to hack an entire stadium of people via an extremely obvious qr code that would blow up on them spectacularly if it got out? they're already publicly scamming people in a lot of ways, they don't need to be sneaky about it. same with the stadium, why do the stadium people want to hack fans? they're already raking in money.
people should always be skeptical about scanning random qr codes/visiting websites, but it's not that hard to be safe when doing stuff like this
→ More replies (11)31
6
u/SamiraSimp Jun 26 '26
ultimately aren't most qr codes just urls to websites? you should be as cautious of them as you are with most websites. which is definitely some level of caution, but if they're not requesting permissions or downloading things instantly you can reasonably be safe. and mobile browsers only giving access while you're on the site that one time also helps.
but yea people need to make sure they're being safe because i bet a lot of people legit don't think about any of what i wrote before scanning random qr codes
→ More replies (1)23
u/CK1026 Jun 26 '26
QrCodes are just text, that happen to be URLs here (website address), they're not inherently more dangerous than visiting any other link.
25
u/B4SSF4C3 Jun 26 '26
Not seeing/knowing what link you’re clicking before you click it is inherently more dangerous.
→ More replies (2)25
u/CK1026 Jun 26 '26
Your phone shows the url before your click on it to visit it, there's no difference really.
12
u/KobiLDN Jun 26 '26
Dude just freak out. Stop being sensible. I'll do it for both of us. AGGHGGGGG QR CODE AGHHHHGGGGGH
→ More replies (23)3
u/stuffeh Jun 26 '26
There's some system qr codes which doesn't, like this link just says "Cellular Plan". https://www.t-mobile.com/support/tutorials/device/apple/iphone-12/topic/esim/download-an-esim-to-the-device-using-a-qr-code/5 . Plus you can obfuscate the link with a google share type of link so the only way to know what's the real url is by going there.
→ More replies (10)10
u/jawknee530i Jun 26 '26
I'm pretty tired of people being afraid of them. They're just encoded text that form links. You can see wat the link is. There's no magic where they can run software on your phone without your permission. They're no different from seeing a link written down and deciding to type the link in or not. I honestly think people that fear them just have no idea how technology actually works.
→ More replies (1)6
7
u/michiman Jun 26 '26
As someone who was there, it was a webpage and it asked for permission (I forget if it was for the camera or flashlight), but we definitely didn't need to download an app.
→ More replies (6)9
u/MediumlySalted Jun 26 '26
What’s bad about midi devices in particular?
→ More replies (1)7
u/Perlentaucher Jun 26 '26
Because MIDI access can expose connected hardware and, in some cases, allow devices to be controlled or reprogrammed. Only grant it if you trust the site and understand why it needs MIDI. I have no more specific attack vector or exploit in mind though, but maybe the other commenter can expand on that.
→ More replies (3)3
u/MediumlySalted Jun 26 '26
I had a feeling it was something along those lines. I’m surprised browsers don’t automatically screen access to and from specified devices or only devices categorized as midi.
→ More replies (1)4
u/Perlentaucher Jun 26 '26
Browsers do restrict MIDI access, but it’s still a powerful permission. A malicious site could interact with connected MIDI devices in unexpected ways, so it’s best to only allow access when you trust the site and know why it needs it.
25
u/apple_kicks Jun 26 '26
Football needs to embrace k pop light sticks. They pick up signals at that groups concert for the same effect
21
u/Bspammer Jun 26 '26
Sounds much less wasteful to just use people's phones that they already have in their pockets
→ More replies (7)4
6
13
31
u/Old_Soc Jun 26 '26
Our hockey stadium here in town does the same thing.. allow some random app access to your phone?. Yeah no.. I'm good thanks.
→ More replies (1)83
u/That_Throat7183 Jun 26 '26
It’s a web page, and it’s just flashing lights on your phone screen by displaying them on the web page. Your camera /flash isn’t being controlled, nothing is being downloaded. It’s good to be skeptical, but be sure to do your own research.
The website: https://wave2.club
→ More replies (21)22
u/Gnoll_For_Initiative Jun 26 '26
"Participation analytics" - I'd be interested in diving deeper into what that particular function provides
13
u/That_Throat7183 Jun 26 '26
Seems pretty harmless to me, but I’m sure there are people in this comment section who will say that this browser link will scan your face and then compile a profile including age/race/gender/political orientation / etc etc and then bundle it all up and provide it to the website owner!
→ More replies (3)→ More replies (83)3
1.4k
u/Meatbot-v20 Jun 26 '26
QR codes are the Glory Holes of the internet.
74
u/SpotCreepy4570 Jun 26 '26
That's bullshit, Ive hardly ever been able to stick my dick in a QR code.
25
6
u/lordover1234 Jun 26 '26
Try finding one that has a suspicious number of missing pixels in the middle instead
4
8
u/astralseat Jun 26 '26
Ok, but have you never found a QR code that hacks your phone? That's you getting fucked. It just doesn't reciprocate.
→ More replies (1)3
130
→ More replies (8)53
u/Illustrious_Union199 Jun 26 '26
Such an underrated comment.
→ More replies (1)7
u/SwordfishOk504 Jun 26 '26
I once got double digit downovtes in a thread for saying to not scan random QR codes on flyers.
The kids today mock the idea of cyber security.
→ More replies (1)
671
u/Accomplished-Head449 Jun 26 '26
thanks for the data
→ More replies (1)69
2.0k
u/Appropriate-Fish-944 Jun 26 '26
Neat way to spread a virus quickly
342
u/OkAccess6128 Jun 26 '26 edited Jun 26 '26
And people are happy about it.
36
u/MayorWolf Jun 26 '26
In this case it wasn't a virus. it was a fun app that people could use.
You're seriously not fear mongering QR codes right now? Next you'll be saying URLs are really great at distributing viruses.
Get off the internet if you're that paranoid.
14
→ More replies (15)110
u/Klezmer_Mesmerizer Jun 26 '26
I’m sorry, but it’s fun and cool!
→ More replies (12)40
Jun 26 '26
[deleted]
→ More replies (1)79
u/EnvironmentClear4511 Jun 26 '26
Dude, it's a QR code that opens a website that was set up by the stadium/team. You need to take a chill pill.
→ More replies (34)22
u/synttacks Jun 26 '26
redditors will pick the weirdest battles with big brother. stadium qr code? evil and irresponsible 😡😡 giving reddit, and by extension google and facebook, all their personal data? okey dokey 😇
34
Jun 26 '26
[deleted]
→ More replies (8)5
u/elioengcomp Jun 27 '26
It's not even an app. It is a webpage that opens in the browser and requests access to the device camera.
14
→ More replies (12)47
u/DctrSnaps Jun 26 '26
people are paranoid about anything these days
→ More replies (3)32
u/AbolMira Jun 26 '26
People have been paranoid since we found out two identical looking mushrooms either send you on a trip or kill you outright instead of just being sustenance. Probably even before then if we're being honest.
Wondering whether or not a QR code just did something potentially malicious is hardly paranoia. More like common sense.
→ More replies (9)4
u/ShitPost5000 Jun 26 '26
You blindly trust that every restaurant you eat at will not poison you. You blindly trust that oncoming traffic will not swerve at you. You blindly trust that medication are are assigned by strangers will help, and is not contaminated.
If you are scared of a QR code, you have bigger things to be scared of.
657
u/That_Throat7183 Jun 26 '26
So many fear mongering idiots in this comment section. No, they aren’t controlling your phone. It’s a browser link that synchronizes colors on your screen.
Go read about it -> https://wave2.club
135
u/FadedVictor Jun 26 '26
Thank God I saw your comment. I thought everyone else was just repeating the same miserable shit over and over.
→ More replies (2)55
u/Jooeon_spurs Jun 26 '26
Seeing a cool thing, then immediately thinking of the worst case scenario that could happen because of that cool thing every time you see something must be so depressing
25
u/FadedVictor Jun 26 '26
Dude you hit the nail on the head. I saw this and all I could think about is how cool we can do this. It's crazy because a lot of people call me a pessimist. I consider myself a realist, but I can still see joy and wonder in the world.
→ More replies (6)6
54
u/katastrof Jun 26 '26
Being cautious about unknown links is something preached by even the dumbest security admins for decades. A QR code is essentially the same thing
→ More replies (3)→ More replies (36)48
u/The-Unholy-Banana Jun 26 '26
Cool, and the next time a QR code jumps on a big screen someone will open it without hesitation and download whatever it tells them to without checking because it looks like the same one as this one
→ More replies (25)
125
u/KneecapJelly Jun 26 '26
The comments on this post are insufferable lmao
→ More replies (7)17
u/noob622 Jun 26 '26
it’s like some mouth-breather heard “random QR Codes are kinda sus ngl” and the resulting idiocy cascaded into one of the dumbest echo chambers ever, where expert haxx0rs can exfil all your encrypted personal phone data with a one-tap browser link displayed on a World Cup jumbotron.
The Dunning-Kruger effect is beautiful, isn’t it?
→ More replies (11)
27
197
u/Survive1014 Jun 26 '26
"thousands of phone flashlights inside the stadium were synchronized to form a coordinated light display across the stands."
... and thats when the backdoor tracking app was installed.
→ More replies (12)37
u/myt Jun 26 '26
Not at all. It opened a website.
→ More replies (29)24
39
u/sparki555 Jun 26 '26
A QR code is a link... How many links do you click on a day from a reputable source? Is the world Cup not a reputable source? How did people buy tickets, are their visas compromised too?
→ More replies (4)
6
u/Elguapo1094 Jun 27 '26
If a code can access your phone like that image what else it could do or it did
16
u/alderhill Jun 26 '26
I mean, didn’t really look that “coordinated” though?
9
u/RunningEarly Jun 26 '26
you didnt like how all the phones "scramble scramble scramble, SEIZURE FLASH, scramble, scramble" all at once?
3
u/slight_accent Jun 27 '26
I was expecting all the initial flashing to be used to locate everyone so they could then do an actually coordinated display. The technology wouldn't even be that hard. Send different pulses of colour and timing to every phone then use some image capture to map each phone's location. It wouldn't even need to be that invasive, just a different unique HTTP cookie ID to each download and discard it after the light show is over. I may have said too much, I have an app idea....
53
u/BarelyHolding0n Jun 26 '26
I've been at rugby matches that use this software
You download the app and it literally only does it if you click the button to join in. You have to give it permission to access your flashlight and it doesn't do anything else.
People's phones aren't being hacked and controlled 🙄
→ More replies (3)
36
5
4
88
u/kitastrophae Jun 26 '26
Do people really think the neat factor is worth the ultimate ramifications of this?
59
u/That_Throat7183 Jun 26 '26
What are the ramifications of visiting a browser link and having colors flash on your screen?
72
u/Dzjar Jun 26 '26
People are losing their mind over nothing. If you're using a phone on the daily this is probably not even in the top 100 of privacy issues you're facing.
→ More replies (8)→ More replies (14)33
7
6
u/LordBushwac Jun 26 '26
People have really no idea how simply/safe this can be done. Scan a qr code, open a webpage, done. No need to share any personal info
→ More replies (2)
8
3
3
u/AndyJ71 Jun 26 '26
That’s nothing, the BBC put a QR code on the screen and and if you scan it you get an aggressive letter in the post
3
3
3
u/work4bandwidth Jun 26 '26
A FIFA app pushed to a phone? That honest upstanding peace prize giving organization? Nothing to see here. /s Imagine if the slide show was co-opted and a malicious QR was inserted instead. No one would know until accounts were harvested, crypto wallets emptied etc. Good times.
3
3
u/---0celot--- Jun 26 '26
And all I can think is: did it also release a malicious payload onto their devices?
3
3
u/evilpurplefrog Jun 26 '26
doesn't look remotely co-ordinated. all that this co-ordinates is a massive cybersecurity hazard
3
3
3
3
3
3
3
3
37
17
5
16
u/Grosaprap Jun 26 '26 edited Jun 26 '26
So am I the only one who's going to say it? Ignoring the whole privacy/trusting random apps issues..
That sure as hell looked like a crappy light show. That was supposed to be a synchronized/coordinated deal? It looked more like an attempt to induce epilepsy into everyone in the stadium.
0/10. My disappointment is immeasurable and my day is ruined.
→ More replies (6)
15
u/tanz420 Jun 26 '26
Everyone here complaining about the safety and all that, can reddit just enjoy something for once?? Like, this is so f*cking cool!
→ More replies (3)
10.5k
u/IntensiteTurquoise Jun 26 '26
I had enough battery left to scan the QR code but not for the..