QRLJacking – New Social Engineering Attack Vector

December 17, 2016July 27, 2019 Comments Off

QRLJacking or Quick Response Code Login Jacking is a simple-but-nasty attack vector affecting all the applications that relays on “Login with QR code” feature as a secure way to login into accounts which aims for hijacking users session by attackers.

This attack vector is made by Mohamed Abdelbasset Elnouby (@SymbianSyMoh) security researcher from Seekurity Labs.

Using QRLJacking you can use to hijack session for following services:

Chat Applications:

WhatsApp, WeChat, Line, Weibo, QQ Instant Messaging

Mailing Services:

QQ Mail (Personal and Business Corporate), Yandex Mail

eCommerce:

Alibaba, Aliexpress, Taobao, Tmall, 1688.com, Alimama, Taobao Trips

Online Banking:

AliPay, Yandex Money, TenPay

Passport Services “Critical”:

Yandex Passport (Yandex Mail, Yandex Money, Yandex Maps, Yandex Videos, etc…)

Mobile Management Software:

AirDroid

Other Services:

MyDigiPass, Zapper & Zapper WordPress Login by QR Code plugin, Trustly App, Yelophone, Alibaba Yunos

If you want to try it and check how to prepare everything, you can check official OWASP’s GitHub repository for QRLJacking Attack Vector

Here’s also demonstration video:

QRLJacking – New Social Engineering Attack Vector

Chat Applications:

Mailing Services:

eCommerce:

Online Banking:

Passport Services “Critical”:

Mobile Management Software:

Other Services:

Related Articles

CVE-2020-3374, CVE-2020-3375: CISCO SD-WAN High-Risk Vulnerabilities Alert

CVE-2020-10713: GRUB2 Local Code Execution Vulnerability Alert

Researchers revealed BootHole vulnerability in the GRUB2 bootloader, both Windows and Linux systems are affected

ABOUT US

COMPANY

RESOURCES

TOOLBOX

Join Our Community

Subscribe now and get your free HACKERS HANDBOOK