The QR code system was invented in 1994 under a team led by Masahiro Hara from the Japanese company Denso Wave. A QR code (quick-response code) was developed as a type of two-dimensional matrix barcode for labelling automobile parts. Now, using a new twist to bypass detection from security solutions, cyber-attacks are now employing QR codes that your users will not recognize as anything suspicious.
Threat actors need some means of getting a user to engage with malicious content – whether an attachment, link, or phone call, there needs to be some content within an email that provides the victim user with their next step.
Right behind this are the security solutions which have employed scanning those attachments, following the links to their end, etc. in an attempt to provide the user and their organization with a first layer of defense to stop such attacks before they start.[1]
A new phishing attack method spotted by security researchers at Inky includes the use of a QR code, prompting a victim user to take a picture of the image and navigate to the resulting impersonated login page. It’s sinister for a number of reasons, two of which are obvious immediately:
- Researchers are not aware of any security solution that can follow a QR code-based URL to determine if the resulting URL is malicious or not.
- It shifts the actual threat action to another device, specifically one that has far less protections than a user’s endpoint.
But it is also awkward, because who takes a picture of a QR code to login to their email, etc. instead of just clicking a link. Despite this lack of reasoning as to why this should work, we see that this type of social engineering works anyway, otherwise the cyber criminals would not be using this method.
This kind of attack highlights the fact that your users need to be continually educated through Security Awareness training: that anything out of the ordinary, especially something this wacky just to log onto a website, should be avoided.
This article is presented at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. For questions, comments, or assistance, please get in touch with the office directly at 1-844-492-7225, or feedback@redskyalliance.com
Weekly Cyber Intelligence Briefings:
Reporting: https://www.redskyalliance.org/
Website: https://www.redskyalliance.com/
LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/5993554863383553632
Comments