The QR Code Humbug

 

The digital world is growing so fast that everything happens with a click. For instance, the good old cash paid for in receipt of goods and services might become obsolete in a few years, as people no longer rely on it. Instead, they would need to scan a QR code in receipt of things.
So what is this QR code, aka Quick Response code? In simple terms, this is a machine-readable barcode that contains information that you need to make a payment for receipt of goods and services.
So, can we use this for receiving payments? The answer is a big “NO”. Let us see why.
Let us now see a scenario wherein the conman Shyam dupes a techie Ram.
Here is how Shyam dupes Ram.
Ram wants to sell his old mobile, So he uploads it onto an online website waiting for prospective buyers. Shyam sees this ad of his and is excited and ready to dupe a prospective victim.
Shyam (approaches Ram): Hi Ram, this is Shyam. I am interested in buying your mobile
Ram: Oh, Wow, That’s great. I am happy that you are interested in my mobile.
Shyam: Any reason for selling this mobile at a nominal price?
Ram: Oh yeah, That’s because I am planning to buy an iPhone; otherwise, I am happy with this mobile.
Shyam: Wow. Nice to hear. Okay, so shall we fix this deal?
Ram: Yeah, sure!
Shyam: So, before anyone else approaches you, let me transfer an amount of Rs XXXX to fix the deal?
Ram: Sure, Thanks. I will send you my QR code.
Ram (shares the QR code and waits for 5 minutes): Shyam, you there?
Shyam: Oh yeah, I am actually having some problem sending the amount. I will send you my QR code. Can you please scan it so that I can send you the amount?
Ram (without a second thought): Sure, I will do it.
Shyam (sends the QR code): I have sent the QR code to scan.
Ram (scans the same and enters the UPI pin): I have scanned it.
Within seconds, Ram gets a pop-up message on his mobile that an amount of Rs 2 lakh has been withdrawn from his account. Only then did Ram realize that he had been cheated.
Ram quickly heads off to his bank to block his account from any further transactions. He also files a case with the Cyber Police to get his money back.
Do you think Ram would get back his money? Well, that’s a different discussion. But if you are curious how the conman Shyam swiped off Ram’s account, let us tell you that the answer lies in the QR code and the UPI pin. One needs to scan the QR code and enter the UPI pin only for sending the payment and it should not be scanned for receiving the payment.
So readers, beware of such frauds and stay safe. Please, pass this on to your near and dear ones as well so that they don’t get duped. To More Secure Download free antivirus download

Comments

Post a Comment

Popular posts from this blog

AMOS (MacOS Stealer)

  In the last week of April 2023, it was reported on twitter , that through a telegram channel a new malware was being offered as “Atomic MacOS Stealer”. Many samples of this malware were found on the internet. Figure 1 – Atomic MacOS Stealer Most of these samples were masquerading as an installer of various applications like Tor browser, Photoshop CC, Notion, FL studio. Figure 2 – Amos DMGfiles masquerading as different applications These are delivered as a DMGfile(Disk Image) which is the common format for software distribution & installation packages on macOS. We identified the Tor browser DMG file for the analysis. When we execute the DMG file it gets mounted and we can see the resulting window advises the user to execute the application by right clicking. Figure 3 – Tor Browser These fake applications are created by using Appify , which is used to create applications just by having the executable alone. The icons can be customised. That’s why these applications are in dif...
Read more

Ransomed by Warlock Dark Army “OFFICIALS”

  Recently we came across a tweet shared by petikvx . The tweet was on a ransomware family that had the group name similar to the WARLOCK DARK ARMY. The similarities with Chaos ransomware seem to end with the attacker group’s name. Upon analyzing the ransomware from the tweet we suspect both to be very different groups just based on their malware’s attributes. The sample under consideration was compiled using C/C++, in case of Chaos ransomware it is usually .Net. Statically looking at the file we noticed a resource entry under Bitmap with an identifier “14”, while analyzing the file code we noticed that this resource was read and loaded on to the memory. Hence we decided to dump that resource entry. Figure 1: Encrypted blob in resource section Figure 2 : Loading blob into the memory During our code analysis we found this blob was XOR encrypted. The first 16 bytes of this blob acts as the key for XOR decryption and the rest is the data which plays a key role in this ransomware’s in...
Read more

MuddyWater Back with DarkBit

  Recently, we came across a tweet about DarkBit ransomware. An Iranian APT group, named MuddyWater, is reportedly behind the DarkBit ransomware. In this blog we will explore the ransomware’s initial access method, the use of Cobalt Strike and the final ransomware payload. Initial Access Method The initial lure was delivered as an ISO file. Figure 1 – ISOFile The payload included a shortcut file (with a .doc extension) and a zip file. Figure 2 – Contents Inside ISO File The shortcut was using PrintBrm.exe to unpack the HR-Update.zip and run it as shown below. PrintBrm.exe is a windows inbuilt command line tool . Figure 3 – Shortcut File cmd.exe /c xcopy .\HR-Update.zip %TEMP% /h /y && PrintBrm.exe -r -f %TEMP%\HR-Update.zip -d %TEMP%\unzip & %TEMP%\unzip\HR-Update.exe Figure 4 – HR-Update.exe Running HR-Update.exe was a Cobalt Strike beacon. Cobalt Strike, a penetration testing tool, can also be used by attackers for gaining a foothold in the system. The final ran...
Read more