QRLJacking Attack Can Bypass Any QR Login System
Egyptian security researcher Mohamed Baset has published details about a new type of attack that successfully bypasses SQRLs (Secure QR Logins, aka Secure, Quick, Reliable Logins).
Dubbed QRLJacking, this is a social engineering attack that relies on phishing and other similar techniques to trick a victim into scanning the wrong QR code.
The attack works by requesting a QR code for the service the victim is trying to login into and modifying the QR code to send the confirmation message to the attacker's computer. The crook can modify these login details, add the data belonging to his PC, relay the data from his phone to the default login server, and access the victim's account from his PC.
