QRLJacking Attack Can Bypass Any QR Login System
http://news.softpedia.com/news/qrljacking-can-bypass-any-qr-login-system-506818.shtml
Egyptian security researcher Mohamed Baset has published
details about a new type of attack that successfully bypasses
SQRLs (Secure QR Logins, aka Secure, Quick, Reliable Logins).
Dubbed QRLJacking, this is a social engineering attack that
relies on phishing and other similar techniques to trick a
victim into scanning the wrong QR code. The attack works by
requesting a QR code for the service the victim is trying to
log into and modifying the QR code to send the confirmation
message to the attacker's computer. The crook can modify
these login details, add the data belonging to their PC, relay
the data from their phone to the default login server, and
access the victim's account from their PC.
- - -
--Lauren--
Lauren Weinstein ([email protected]): https://www.vortex.com/lauren
Founder:
- Network Neutrality Squad: https://www.nnsquad.org
- PRIVACY Forum: https://www.vortex.com/privacy-info
Co-Founder: People For Internet Responsibility: https://www.pfir.org/pfir-info
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: https://lauren.vortex.com
Google+: https://google.com/+LaurenWeinstein
Twitter: https://twitter.com/laurenweinstein
Tel: +1 (818) 225-2800 / Skype: vortex.com
I have consulted to Google, but I am not currently
doing so -- my opinions expressed here are mine alone.
_______________________________________________
pfir mailing list
https://lists.pfir.org/mailman/listinfo/pfir
