What is QRLJacking?

QRLJacking or Quick Response Code Login Jacking is a simple social engineering attack vector capable of session hijacking affecting all applications that rely on the “Login with QR code” feature as a secure way to login into accounts. In a nutshell, the victim scans the attacker’s QR code which results in session hijacking.

The QRLJacking attack consists of two sides:

1. Server Side: A server side script is needed to serve and shape the final look to the victim.

2. Client Side: Cloning the QR Code and pushing it to the phishing page.

Our example will be: The WhatsApp Web Application!

Server Setup (Attacker's hosting):

• Upload "qrHandler.php" to your server. This php file is used to convert the base64 QR Code string into a valid .JPG file.

• Now you have a valid, generated, QR image named "tmp.jpg" residing in the same root folder as your files which will be updated whenever that php file is called, so we can put it anywhere. For example: a fake WhatsApp page, a scam page with an offer related to WhatsApp, etc. Depending on your creativity.​

• Now update the "phishing.html" file with your preferred phishing page source code.

Exploitation, Client Side Setup (Attacker's browser):

Manually:

1. Open your Firefox browser.

2. Write "about:config" in the url area, click the "I'll be careful, I promise" confirmation button.

3. Search for a preference named "security.csp.enable" and change its value to "false" by double clicking it to allow performing an XHR Request from a different domain (we're not supporting leaving this preference disabled, you may do that while testing, but after that you should set the preference to its original state).

4. Install the Greasemonkey add-on (https://addons.mozilla.org/en-US/firefox/addon/greasemonkey) and be sure that the module file "WhatsAppQRJackingModule.js" is loaded and already running.

5. Now we're ready. Browse to our example "https://web.whatsapp.com" on your side and wait for a WhatsApp session to be loaded. Greasemonkey should now inject our WhatsApp module file to catch.

6. Send the direct link of the final phishing page to a victim.

Once the QR Code is scanned, the victim's session is yours.

Automatically:

Using QRLJacker -

https://github.com/OWASP/QRLJacking/tree/master/QrlJacking-Framework

Vulnerable Web Applications and Services

There are a lot of well-known web applications and services which were vulnerable to this attack until the date we wrote this paper. Here are some examples (that we have reported) including, but not limited to:

Chat Applications: WhatsApp, WeChat, Line, Weibo, QQ Instant Messaging

Mailing Services: QQ Mail (Personal and Business Corporate), Yandex Mail

eCommerce: Alibaba, Aliexpress, Taobao, Tmall, 1688.com, Alimama, Taobao Trips

Online Banking: AliPay, Yandex Money, TenPay

Passport Services “Critical”: Yandex Passport (Yandex Mail, Yandex Money, Yandex Maps, Yandex Videos, etc...)

Mobile Management Software:

AirDroid

Other Services:

MyDigiPass, Zapper & Zapper WordPress Login by QR Code plugin, Trustly App, Yelophone, Alibaba Yunos