퀴싱(Quishing)의 범죄피해 메커니즘 연구: 기회이론 및 사회공학적 기법을 중심으로

초록

This study introduces the concept and state of Quishing, a form of phishing crime, and examines its occurrence and mechanisms from a social engineering perspective. Quishing is a cybercrime that has surged following the COVID-19 pandemic, as the use of QR codes has become widespread. In these attacks, perpetrators exploit users’ trust to steal sensitive information or spread malicious code. This study analyzes the mechanism of victimization in quishing using Routine Activity Theory and Lifestyle/Exposure Theory, along with Techniques of Social Engineering. From a macro-level perspective, Routine Activity Theory identifies three conditions for crime: a motivated offender, a suitable target, and absence of a capable guardian. From a meso-level perspective, concepts from Lifestyle/Exposure Theory function as elements enabling Quishing. At the micro level, the study explains how perpetrators manipulate victims through social engineering tactics—trust-building, creating urgency, and leveraging social proof. These tactics exploit victims’ cognitive limitations, resulting in attacks. Findings indicate that Quishing is a method that exploits both users' psychological vulnerabilities and technological aspects. To prevent Quishing, the study suggests: (1) promoting security technologies for QR code scanners and redirection, (2) implementing education and training for safe QR code usage, and (3) establishing regulations for QR code creation, use, and placement, along with launching a platform to report suspicious QR codes.

키워드