Due to circumstances, I found myself visiting Dijklander Hospital in Hoorn on a regular basis. While taking the stairs there I noticed these signs on every floor that, besides the floor number, also contained a QR code.
I didn’t notice these QR codes anywhere else in the hospital.
Curiosity got the best of me, so I scanned the QR code.
The browser on my phone displayed a curious “Hmmm… can’t reach this page” message. The URL that failed to open was https://w.navigation-id.com/. What is this QR code for?
NavigationID
In 2015 the Dijklander hospital moved to a brand new building and a year later they pioneered as the first hospital in The Netherlands that utilized BLE Beacons for indoor navigation. The system was a cooperation of Navigation-ID, Mobile Agency and a then new startup called Movin.
Because maintaining hundreds of Bluetooth beacons is pretty expensive the system was eventually decommissioned in favor of simpler navigation signs, narrowcasting screens and new developments like pre-check-in from home.
While almost all traces of the old navigation system were removed, they somehow missed the QR codes in all of the stairways of the hospital. With the building spanning five floors and multiple stairwells, that amounted to a fairly large potential attack surface.
Can’t reach this page
It turned out the domain the QR linked to was navigation-id.com, which was available for purchase. So I snatched it and configured it so that every subdomain and page-request was routed to index.php, where I embedded the Rickroll-video.
And just like that, when someone took the stairs instead of the elevator in the Dijklander hospital and scanned one of the QR codes, this would happen.
Responsible disclosure
While this was all fun to explore and research, I needed to report this potential security risk to the hospital using the proper channels. Dijklander hospital has a page for reporting security related concerns and so I send them an email detailing my findings (and then mistakenly queried them for an update after 4 days instead of 6).
To their credit they did respond within 5 business days. In that response they explained that the issue had been resolved (while also explaining that 4 days is within the 5 day response window).
Because of the nature of the vulnerability, the fact that I made sure the QR codes were not pointing to something unsavory and the confirmation that the issue has since been resolved by the hospital, I figured that writing this down for my own, and hopefully your amusement should be fine.
So that’s the story of how I Rickrolled a hospital.
PS: I should probably check how the QR were removed and update this post accordingly.