Linked-Device QR Hijacking (QRLJacking) pa WhatsApp, Signal, Discord, ne Telegram¶

Kujingulula ne muntu udi ubala mesaje eba a tshisokomenu mu tshikondo tshilelela anyi utuma mesaje a dishima ku diambuluisha dia WhatsApp, Signal, Discord, Telegram, anyi Line paudi telefone webe wa bianza utshidi wenza mudimu bimpe mu tshianza tshiebe ne kuyi muanji kupatuka mu tshiamu tshiebe ke tshimanyinu tshilelela tshia Linked-Device Qjacking (RQRLJacking / Ghost Pairing). Bishilangane na Dishintakaja dia SIM anyi code-star-code wa muena mudimu (*72) ne PIN wa mesaje a dîyi (udi utuma nomba webe wa telefone wa kumpala ku tshiamu tshipiatshipia ne umbusha diakamue telefone webe ku WhatsApp anyi ku Signal), Linked-Device QR Hijack kena ulenga difunda dia telefone webe wa kumpala nansha kakese. Pamutu pa nanku, muena tshinyangu udi ukushima bua kubala Companion Device Pairing QR Code muenza kudi muena tshinyangu nkayende WhatsApp Web, Signal Desktop, Discord, anyi Telegram Desktop dididishi dia tshikebelu (tshisokoka pa dibeji dia dishima bu "Verify your age/humanity QR code", "Scan to join this private WhatsApp/Telegram group", "Scan for free Discord Nitro / Steam skin", or "Job interview / package delivery verification"). Dîba diudi ubala code QR munda mua scanner wa app webe, telefone webe udi ufila bukokeshi kudi ordinatere wa muena tshibawu bu Linked Companion Device wa kueyemena, udi wenza bua mesaje ebe a matuku mashale aa ne mesaje onso adi alua ne adi apatuka ku tshiamu tshia muena tshibawu mu tshikondo tshilelela eku wenda upita SMS 2FA, Registration PINs ne mêyi a tshisokomenu. Shi uvua muangate tshiamu tshia QR pa tshibandilu tshia mashinyi anyi pa mesa a mu restoran ne tshiamu tshieba tshia telefone tshia pa tshibidilu tshivua tshiunzulule site wa dishima dia karte ka mfranga, bala bulombodi buetu pa QR code phishing (quishing) ne bimanyinu bia tshiamu tshia mashinyi. Shi udi mu lutatu lua dikuata dia makuta, dienzeja dia malu mabi, anyi njiwu ya ku mubidi, udi mua kubikila ku nimero wa diambuluisha dia lukasa wa muaba unudi (911 mu États-Unis ne mu Canada, 112 mu matunga masanga a ku Mputu, 999 mu Royaume-Uni) anyi tangila mukanda wetu wa malu a pa buloba bujima nomba ya tshimpitshimpi.

Enza nunku mpindieu¶

1. Kangula tshibuelelu tshia "Linked Devices / Active Sessions" tshia programe webe wa dituma dia mesaje LELU ne ujikije tshisangilu tshionso tshia ku biro anyi tshia ku Enternete tshidi katshiyi tshimanyike:
2. Pa WhatsApp (iPhone & Android): Toneka pa Malongolola (anyi Menu wa tutotshi tusatu) > Biamu bidi bipetangana. Tangila liste udi kuinshi kua Nsombelu wa tshiamu (Google Chrome (Windows), Mac OS, Firefox (Linux), WhatsApp Desktop). Fina pa tshiamu tshionso tshiudi kuyi mumanye 100 pa lukama ne fina pa Log Out.
3. Pa tshimanyishilu (iPhone & Android): Fina pa Tshimfuanyi tshiebe tshia profil (kuulu ku dia bakaji) > Malongolola > Biamu bidi bipetangana. Fina tshitupa tshionso tshia mudimu tshidi katshiyi tshimanyike (Signal Desktop) ne usungula Unlink.
4. Pa Telegram (iPhone & Android): Fina pa Malongolola > Biamu (Active Sessions). Toneka pa Terminate All Other Sessions diakamue (ne tangila liste udi kuinshi eku: pikala muena tshibawu muele tshisangilu tshiabu kukadi mêba makese kupita 24 ne Telegram wamba ne "Biamu bipiabipia kabiena mua kujikija bikondo bia kale munkatshi mua mêba 24", londesha tshienzedi tshietu tshia dishipa dia tshisangilu mu tshitupa tshia 1 tshidi kuinshi eku).
5. Pa Discord (iOS & Android): Fina pa Wewe (kuinshi ku dia balume) > Malongolola (tshimfuanyi tshia tshiamu tshia mudimu) > Biamu -> fina pa Patuka mu biamu bionso bimanyike (ne shintulula mot de passe webe wa Discord diakamue, udi ujimija bimanyinu bionso bia Discord bidi bienza mudimu).
6. Tangila mesaje audi mutume, miyuki milama, ne "Trash / Recently Deleted" bua kumona tshidi muena tshibawu mutume anyi mupatule patshivua tshiamu tshiabu tshilamakaja:
7. Bena tshinyangu badi bakuata WhatsApp Web, Telegram, anyi Discord tshisangilu ku diambuluisha dia kode wa QR, tangila diakamue Miyuki milama (badi balama miyuki idibu batumina balunda bebe anyi mfumuebe wa mudimu balomba makuta bua miyuki ayi ikale misokoka mu liste webe wa miyuki minene) ne ukebe mu miyuki yebe miaku "password", "seed", "bank", "passport", "tax", "SSN", anyi "code".
8. Bulula bintu bionso bidi mu WhatsApp/Telegram mpindieu bua kumona muntu udi mukubunda mutume mesaje ku konte webe.
9. Bikalabu bakuate konte webe wa Discord ku diambuluisha dia tshishima tshia "Dijadika dia dishima / Code QR wa tshianana wa Nitro", umbusha diakamue tshimanyinu tshiebe tshia Discord Auth pa kushintulula mot de passe webe NE kutangila tshibutshilu tshiebe tshia makuta anyi mapa:
10. Kubala kode wa QR munda mua Discord Mobile App (Scan QR Code) kena anu ulamakaja muena mudimu nende to: udi upesha muntu udi ukubunda tshimanyinu tshieba tshia dianyisha dia konte webe mujima, umuanyishila bua kusumba nkama ya dolare ya Discord Nitro Gifts ku diambuluisha dia karte kebe ka mfranga anyi PayPal ne DM malware ku biamu biebe bionso bia mudimu.
11. Tangila ni muena tshibawu uvua mukushime bua kufunda "8-Character Pairing Code" (Link with Phone Number Instead) pa WhatsApp:
12. Pa kumbusha kode ya QR, WhatsApp udi mpindieu wambuluisha bua kulamakaja navigateur mukuabu pa kufunda kode wa maleta 8 (XXXX-XXXX) mu telefone webe ("Enter code to link new device"). Bena tshinyangu batu batuma bintu bia dishima bia bukubi bidi biamba ne: "Bueja kode wa dijadika" A7K9-M2P4 mu WhatsApp bua kujadika konte webe", udi wenza mudimu wa muomumue WhatsApp Web muena dibaka udi wenza mudimu ne tshiamu tshia QR code. Kujikija Biamu bionso bidi bipetangana mu Tshitupa 1 kudi kushipa bionso bibidi bidi bipetangana ne QR ne 8-character-code-linked diakamue.
13. Adimuija bantu baudi uyukila nabu ne bantu baudi uyukila nabu mu kasumbu ne: muntu kampanda udi mubuele mu konte webe mu tshitupa tshîpi:
14. Tuma mesaje anyi mukenji kudi muntu yonso udi muena tshibawu mutume bua muntu nansha umue kafiki pa tshimanyinu tshia dishima, kafuanyikiji kode wa QR muibidi, anyi katumi makuta ku diambuluisha dia Zelle, Venmo, Revolut anyi crypto.
15. Kushintulula meyi a tshisokomenu, meyi a ntete ya makuta a tshianana, anyi binjinjimbi bia mushinga bivua munda mua "Message Yourself / Saved Messages" chat:
16. Bantu binunu ne binunu batu benza mudimu ne WhatsApp "Message Yourself (You)", Telegram "Saved Messages", Signal "Note to Self", anyi Discord Server bu mukanda wa pa nkaya bua kulama meyi a tshisokomenu, foto ya mikanda ya diendesha mashinyi, PDF ya bitadi, ne phrasovers. Dîba didi muntu udi uluisha ulamakaja navigateur wa tshiamu tshia ordinatere ku diambuluisha dia code QR, muyuki wa kumpala udiye wangata script wende udi Saved Messages / Note to Self / You.

Mutshi wa mapangadika: kujingulula ne kujikija tshinyangu tshia tshiamu tshia QR (QRLJacking)¶

Londa mutshi wa mapangadika ewu bua kumanya mushindu udi muena tshinyangu mubuele mu konte webe ne kumupangisha bua kubuelamu:

flowchart TD
    Symptom["Mesaje adi kaayi mumvuija, miyuki milama, mikanda ya dipeta, anyi tshisangilu tshia pa buatshi tshia ku biro panyima pa bamane kuenza scanner wa code QR anyi kubueja code wa 8-Char"] --> AppType{"Ntshiamu kayi tshia dituma dia mesaje tshivuabu basue?"}

    AppType -->|"WhatsApp (QR Code OR 8-Character 'Link with Phone Number' Code)"| WAPath["KUTUA 1A: Fungula WhatsApp -> Paramètres -> Linked Devices -> Tap Every Device Listed -> Tap 'Log Out'"]

    AppType -->|"Tshimanyishilu (Linked Desktop QR)"| SigPath["TSHINYI 1B: Fungula tshimanyinu -> Malongolola -> Biamu bidi bipetangana -> Fina pa tshiamu tshia mudimu tshidi katshiyi tshimanyike -> Fina pa 'Unlink'"]

    AppType -->|"Telegrame (QR Login / Active Session)"| TGPath["TSHIPA 1C: Kangula Telegram -> Malongolola -> Biamu -> Fina pa 'Terminate All Other Sessions' + Enable 2-Step Verification Password"]

    AppType -->|"Discord ('Scan QR Code' Nitro / Server Verification Scam)"| DiscPath["TSHIPA 1D: Fungula Discord -> Malongolola -> Biamu -> 'Patukila mu biamu bionso bimanyike' + Shintulula mot de passe wa Discord diakamue (Upingaja tshimanyinu tshia Master Auth) + Umbusha karte ka difuta kavuabu balame"]

    WAPath --> AuditSaved["MUSHINDU 2: Tangila 'Mukenji wa wewe nkayebe / Mesaje adibu balame / Difunda kudi wewe nkayebe' ne 'Miyuki milama' bua kumona malu adi muena tshibawu muangate anyi mutume"]
    SigPath --> AuditSaved
    TGPath --> AuditSaved
    DiscPath --> AuditSaved

    AuditSaved --> SecretsExposed{"Mêyi a tshisokomenu, miaku ya ntete, API Keys, anyi foto ya ID ivuaku milamibue mu miyuki yebe anyi?"}

    SecretsExposed -->|"Eyowa: Mulamibue mu 'Message milama' anyi mu miyuki ya lelu"| RotateSecrets["MUSHINDU WA KUENZA: Shintulula meyi a tshisokomenu onso adibu baleje, uteke Crypto mu tshiambilu tshipiatshipia tshia seed, ne uteke credit bikala ID/SSN mupatuke"]
    SecretsExposed -->|"Kakuena malu a mushinga mu miyuki to"| NotifyContacts["TSHIPA 3: Umbusha miyuki misokoka, umbusha mesaje a dishima bua muntu yonso, ne udimuija bantu baudi uyukila nabu bua kubenga kutua pa ma link"]

    RotateSecrets --> NotifyContacts

Mushindu kayi QRLJacking ("Ghost Pairing") Udi wenza mudimu kunyima kua tshibuelelu¶

Bua tshinyi QRLJacking (Quick Response Code Login Jacking) kulua tshintu tshidi tshitamba kunanga kudi bisumbu bia ba-espion bidi bikuatshisha kudi mbulamatadi (APT28, Star Blizzard, UNC4221) ne bena tshinyangu ba malu a mfranga badi bashipa ba kamona kamba, balombodi ne bantu badi benza mudimu ne makuta matuku onso anyi? Bualu udi upita bionso bia kale bia bukubi bidi mu konte webe:

1. Bua tshinyi SMS 2FA, Two-Step Verification PINs, ne Registration Lock kabiena bimana to QRLJacking¶

Padi muntu udi ukubunda ukeba kuiba konte webe wa WhatsApp, Signal, anyi Telegram mu mushindu wa kale (pa kufunda nimero webe wa telefone mu telefone mupiamupia), udi ukuma bimanu bibidi: 1. Badi ne tshia kuangata SMS wa nomba 6 anyi dibikila dia dîyi dituma kudi tshiamu tshieba tshia telefone. 2. Nansha bobu bapeta mesaje au, badi batua Two-Step Verification PIN / Registration Lock PIN.

QRLJacking udi wenda unyunguluka bimanu bionso bibidi pa kupingaja njila wa tshibuelelu: 1. Tshitupa 1 (Muena lukuna udi wenza tshibuelelu tshia mudimu): Tshiamu tshia Node.js / Playwright tshia muena lukuna tshidi tshiunzulula tshikebelu tshia bushuwa tshidi katshiyi ne mutu pa web.whatsapp.com, discord.com/login, anyi web.telegram.org. Tshiamu tshia mbulamatadi etshi tshidi tshipatula code QR wa cryptographic pairing udi ne muoyo, udi ushintuluka (udi ne mushinga munkatshi mua tusunsa 20 too ne ku 60, udi wenda ushintuluka misangu yonso ku diambuluisha dia WebSocket). 2. Tshitupa 2 (Muntu udi uluisha udi utuma code wa QR pa dibeji dia dishima): Muluishi udi ubueja tshimfuanyi tshia QR tshia WebSocket munda mua dibeji dia ku Enternete dia dishima: - "Cloudflare / WhatsApp Security Check: Scan this QR code in WhatsApp (Settings > Linked Devices) bua kujadika konte webe ne kupangisha diimanyika." - "Dibikila dia tshisumbu tshia bena mutumba: Tangila ne WhatsApp bua kubuela mu tshisumbu tshia VIP的投资/Crypto/Neighborhood Group." - "Dikokangana Wick / Captcha.bot Dijadika dia tshilaminu: Tangila code QR ewu ne Discord Mobile App bua kunzulula njila yonso idi mu tshilaminu etshi." - "WhatsApp 8-Character Code Lure (Link with Phone Number)": Pamutu pa kuleja kode wa QR nansha kakese, muena tshibawu udi utua "Link with phone number" pa web.whatsapp.com tshibuelelu, ufunda nomero webe wa telefone, upeta kode wa maleta 8 (G4M9-K2L8), ne udi ukuleja mukenji udi wamba ne: "Bua kujadika ne: udi muntu / RSVP ku tshibilu etshi, funda code G4M9-K2L8 padi WhatsApp umueneka mu telefone webe." 3. Tshitupa 3 (Telefone webe udi ufunda tshifungu tshia patoke tshia muntu udi ukubunda): Bu muudi wenza scanner wa QR code (anyi ufunda code wa maleta 8) munda mua telefone webe wa kumpala ukadi mujadikibue, WhatsApp/Signal/Telegram/Discord udi wangata bualu ebu bu **udi **mu tshianza tshieba tshia portable. Telefone webe udi upatula tshifungu tshipiatshipia tshia dimanyisha dia bintu bia bungi, udi ufunda tshifungu tshia patoke tshia muena tshibawu (Curve25519), ne diakamue udi usangisha ne utuma malu masokoka a mesaje ebe a matuku mashale aa buludiludi mu tshiamu tshia mudimu tshia muena tshibawu.

2. Difuanyikija dia tshisanji: Tshidi muena tshinyangu upeta paudi utangila code QR wende wa kubuela¶

Tshitupa 1: Dilama dia malu a tshimpitshimpi ku tshisanji ku tshisanji ne malu a mikenji¶

1. WhatsApp: Kukonkonona ne kumbusha bintu bidi bipetangana (Ne kuimanyika dibunda dia maleta 8)¶

1. Kangula WhatsApp ku telefone webe wa kumpala.
2. Fina pa Settings (kuinshi ku dia balume pa iPhone) anyi pa Three-Dot Menu (kuulu ku dia balume pa Android) -> fina pa Linked Devices.
3. Kumpala kua wewe kuela "Log Out" pa tshiamu tshiudi kuyi mumanye, wangate tshimfuanyi tshia Linked Devices tshikebelu shi udi dijinga ne bijadiki bia muaba wa mudimu, dilondangana, anyi dikonkonona dia bampulushi:
4. Fina pa tshiamu tshiudi kuyi mumanye (Google Chrome (Windows) anyi Mac OS): WhatsApp nealeje tshimanyinu tshia ndekelu tshia mudimu ne imue misangu tshimenga/muaba wa tshisangilu atshi.
5. Fina pa Log Out pa tshiamu tshionso tshidibu baleje (nansha biobi bimueneka bu "Google Chrome", patuka mu bionso bia kudibi bua wikale mujadike 100% ne: tshibuelelu tshia tshiamu tshia mudimu tshia muntu udi ukubunda ntshinyanguke; udi mua kupingaja tshiamu tshiebe tshia ku bianza tshia bushuwa pashishe).
6. Tangila tshilaminu tshieba tshia WhatsApp tshia "Archived" diakamue:
7. Tangila ku mutu kua liste webe wa Chats ne tuaku pa Archived.
8. Bena tshinyangu badi bangata tshisanji tshia WhatsApp ku Enternete batu misangu yonso Balama ne Bakanga miyuki ya balunda/bena mu dîku badibu bashima bua se: padi mulunda webe ukuandamuna ne: "Bushuwa, konte webe wa Zelle anyi wa ku banke udi tshinyi?", kakuena dimanyisha didi dipatuka pa tshiamu tshiebe tshia telefone to.
9. Kangula muyuki wonso mu tshilaminu, umbusha mesaje onso a dishima adi muena tshibawu mutume (Fina ne kulama > Supula > Supula bua muntu yonso), ne ubikile anyi ufunde diakamue bantu abu.
10. Jima "Link with Phone Number" Push Prompts pa kulengulula kode idi kayiyi milomba:
11. Shi udi mupeta dimanyisha dia ku WhatsApp diamba ne "Udi ukeba kulamakaja tshiamu kampanda anyi? Funda kode..." paudi kuyi anu mulombe kode ku ordinatere webe, tuaku pa Dismiss / Cancel diakamue; muntu mukuabu mufunde nomba webe wa telefone mu web.whatsapp.com tudi batekemene ne udi mua kubueja code wabu.

2. Telegram: Tshia kuenza pikala Telegram ukupangisha bua kujikija tshisangilu tshia muena tshinyangu (The 24-Hour New Device Rule)¶

Telegram udi ne mukenji wa bukubi udi mumanyike bibi: Tshisangilu tshipiatshipia tshidi tshibuela katshiena mua kujikija tshisangilu tshia kale tshidi tshienza mudimu too ne padi tshisangilu tshipiatshipia tshibuela mu meba 24. - Tshilejilu A (Telefone webe uvua mubuele mu Telegram kumpala kua muena tshinyangu kuenza scanner wa QR code): Bu mudi telefone webe muikale tshia kale ne tshikebelu tshia QR tshia muena tshibawu tshidi tshipiatshipia, telefone webe udi mua kujikija tshisangilu tshia muena tshibawu diakamue kayi ne diindila nansha dikese. Enda ku Settings > Devices, tuaku pa tshisangilu tshia muena tshinyangu, ne tuaku pa Terminate Session (anyi tuaku pa Terminate All Other Sessions). - Tshilejilu B (Muena tshibawu uvua muindile mêba 24 kunyima kua yeye mumane kulamakaja tshisangilu tshiabu tshia QR, mujikije tshisangilu tshiebe tshia ku telefone, ne udi anu mubuele mu telefone webe lelu): Mpindieu telefone webe udi muangatshibue bu "tshiamu tshipiatshipia (tshidi katshiyi ne mêba 24)", nunku paudi utua tshiala pa tshisangilu tshia muena tshibawu bua kutshijikija, Telegram udi upatula tshilema tshidi tshiamba ne: "Bua malu a bukubi, kuena mua kujikija tshisangilu tshia kale ku tshiamu tshipiatshipia tshidibu basuike to. Suaku windile mêba 24."*** Mona mushindu wa kutshimuna dikanga dia mêba 24 diakamue: 1. Tangila shi udi na tshiamu tshikuabu tshia kale (bu mudi iPad, telefone wa kale, anyi ordinatere webe wa kumbelu udi ne Telegram Desktop) udi mubuele mu konte webe wa Telegram kukadi mêba mapite pa 24; kangula Parametres > Appareils pa tshiamu tshia kale ne ujikije muntu udi ukubunda diakamue. 2. Diakamue, ndaku ku Malongolola > Malu masokoka ne bukubi > Dijadika dia malu abidi (Mot de passe wa mu ditu) ne enza mudimu ne mot de passe wa mu ditu anyi ushintulule mot de passe webe wa mu ditu udiku + Email wa dipingaja bua muntu udi ukubunda kakukukanga to. 3. Teka Malongolola > Biamu > Kujikija bikondo bia kale ku tshikondo tshipi menemene (1 week), ikala munda mua Settings > Devices tshiamu tshia nzembu padi tshikondo tshia mêba 24 tshijika (anyi tangila muntu udi ukubunda udi ukeba kujikija tshisangilu tshiebe tshipiatshipia), ne tuaku pa Terminate All Other Sessions diakamue padi dididishi dia mêba 24 dijika.

3. Discord: Kupingana kunyima kua "Scan QR Code / Fake Verification Bot / Free Nitro" Hijack¶

Bua tshinyi dikuata dia QR dia Discord didi ne njiwu ya pa buayi: Bishilangane ne WhatsApp Web (mudi dipima dia QR dienza anu tshikondo tshikese tshidi katshiyi mua kushintulula mot de passe webe anyi nimero ya telefone), dipima dia code QR wa kubuela mu Discord (Settings > Scan QR Code) udi upesha tshikebelu tshia muena tshinyangu tshimanyinu tshijima tshia dianyisha dia muena mudimu. Mu masekonde 5 a tshikebelu tshieba, script wa bot wa muntu udi ukubunda: - Mashinyi users/@me/billing/payment-sources ne usumba 10x $9.99 anyi $99.99 Discord Nitro Gift Subscriptions ku diambuluisha dia Visa, Mastercard, anyi PayPal (utuma mapa a Nitro kudi muena tshinyangu). - Udi utuma DM wa dishima ("Bro check out this game I'm testing" anyi "Free $50 Steam gift card") kudi muntu yense udi mu liste wa balunda bebe ne kudi tshiamu tshionso tshia Discord tshiudi mubuela. - Udi ulekela ** udi utungunukaDiscord Backup Code anyi udi ushintulula app.asar desktop client** pikala malware uvua kabidi wenza mudimu.

Malu malelela a dipingaja dia Discord: 1. Kangula Discord -> Malongolola a muena mudimu (Tshimfuanyi tshia tshiamu) > Konte wanyi > Shintulula mot de passe. Kushintulula mot de passe webe wa Discord kudi kujimija diakamue tshimanyishilu tshionso tshia dianyisha tshidiku mu biamu bionso ne mu script, ne kushipa muntu udi ukubunda mu sekonde umue. 2. Enda ku Malu a muena mudimu > Biamu ne tuaku pa Kupatuka ku bintu bionso bimanyike bua kupeta tshipiminu tshimpe. 3. Enda ku Malongolola a muena mudimu > Konte wanyi > Dijadika dia malu a bungi: - Fina pa Tangila kode ya tshilaminu > Kuenza kode mipiamipia (bualu script wa muena tshibawu uvua muangate kopi wa kode yebe ya kale ya Discord ya nomba 8 musangu muibidi uvua mubande kode wa QR). - Umbusha nomba yonso idi kayiyi mimanyike ya Security Keys / Passkeys anyi SMS Backup Auth idi muena tshibawu muele. 4. Enda ku Parametres de l'utilisateur > Facture ne Abonnéments / Inventaire des cadeaux: - Butula karte ka mfranga ne malanda onso a PayPal. - Shi muntu udi ukubunda musumbe Discord Nitro Gifts kayi muanyishibue pa karte kebe, KUENJI kufunda difutu dia karte ka mfranga ku banke webe to (Njila wa Discord udi ukandika bua kashidi konte yonso wa Discord udi ufila difutu dia ku banke). Pamutu pa nanku, utume diakamue Discord Trust & Safety / Unauthorized Transaction Refund Ticket ku dis.gd/billing kuamba ne: konte webe uvua munyanguke ku diambuluisha dia dishima dia QR; Discord Support udi mua kujimija mapa a Nitro adi kaayi mapingane ne kukupingajila makuta ku karte kebe kuyi mukandika konte webe to.

Tshitupa 2: Kuenza mudimu ne dipatula dia bintu bia mu "Message Saved" / "Message Yourself"¶

Paudi wipata muntu udi ukubunda mu Linked Devices, pitshisha minite 10 bua kukontonona malu a mushinga adibu baleje mu miyuki yebe:

1. Kangula muyuki weba nkayebe (Message Yourself pa WhatsApp, Saved Messages pa Telegram, Note to Self pa tshimanyishilu):
2. Ukadiku mudifundile mesaje mot de passe, nomba wa njila wa ku banke, foto wa karte kebe ka mfranga, foto wa passport/mukanda wa diendesha, dibeji dia bitadi, tshifungu tshia SSH, anyi 12/24-word crypto seed phrase anyi?
3. Bienza nkayabi QRLJacking ndongamu (EvilQr, QRLJacker, ne Telegram/WhatsApp dumpers) badi balongolola bua kuangata 100 pa lukama ya bintu biebe bia kuyukila nabi ne mifundu mu 15 secondes ya kumpala ya QR scan.
4. Shi tshiambilu tshia crypto seed anyi tshifungu tshia pa nkayebe tshivua tshiteka anyi tshikuata foto mu miyuki yebe, angata bu tshidi tshinyanguka mpindieu ne ulonde tshietu cryptocurrency wallet drain ne seed-phrase compromise mulombodi.
5. Shi tshimfuanyi tshia karte kebe ka bukubi, ka mukanda wa diendesha, anyi ka passport mu miyuki yebe, enza tshipungidi tshia tshianana ku Equifax, Experian, ne TransUnion ku diambuluisha dia diandamuna dia buivi bua bumuntu mulombodi.
6. Keba mu kazubu kebe ka muyuki bua kupeta miaku idi ne njiwu mikole:
7. Mu tshikebelu tshia kuulu tshia WhatsApp, Signal, Telegram, anyi Discord, keba umue ku umue bua:
   • password / passcode / PIN
   • login / account
   • bank / routing / IBAN
   • seed / phrase / wallet / 0x
8. Shintulula tshijadiki tshionso tshidi tshimueneka mu bipeta bia dikebulula.

Tshitupa 3: Dikuba dia kashidi ku QR Code ne dikuata dia biamu bia mudimu¶

Teka bintu bitanu ebi bia bukubi lelu bua wewe nansha muena mu diku diebe kabakushima bua kulamakaja tshiamu tshia mudimu tshibi to:

• 1. Umvua dishilangana didi pankatshi pa tshiamu tshia foto tshia pa tshibidilu tshia telefone webe ne tshiamu tshia "Link a Device" tshidi mu tshiamu:
• Normal QR Codes (menu ya mu restoran, tike ya tshibilu, code ya Wi-Fi, njila ya bantu bonso, anyi WhatsApp/Telegram mulelela wa.me / t.me miaba ya dibikila dia kasumbu) idi mifunda ne iPhone webe wa pa tshibidilu anyi tshiamu tshia foto tshia Android, tshidi tshileja URL (https://...).
• In-App "Link a Device" Scanners (WhatsApp > Settings > Linked Devices > Link a Device, Signal > Linked Devices, Discord > Scan QR Code) bidi anu bua kubueja ordinatere muibidi mu konte webe. Kukangula nansha kakese Settings > Linked Devices pa kumbusha wewe musombe kumpala kua tshiamu tshiebe tshia ku bianza tshiudi ufuma ku diunzulula web.whatsapp.com paudi nkayebe.
• 2. Ela Biometric App Lock & Passkeys pa WhatsApp, Signal, ne Telegram:
• Nansha mudi WhatsApp ulomba ID wa mpala / ID wa kulenga / Tshimanyinu tshia munu kumpala kua kunzulula Link a Device tshiamu tshia foto, udi uteka App Lock (Settings > Privacy > App Lock / Screen Lock) udi ukandika muntu udi musombe telefone webe udi kayi mukanga mu tusunsa 15 mu fete, mu bar, anyi mu biro bua kukangula WhatsApp ne kuenza scanner wa QR code mu telefone wende bua kutangila mesaje ebe mu tshimpitshimpi mu matuku 14 adi alonda.
• (Note: Diteleja dia mu nzubu ku diambuluisha dia WhatsApp Web / Signal Desktop / Telegram Web, mudi muena mudimu nebe anyi muena mudimu nebe udi ne mukawu wangata telefone webe udi kayi mukanga munkatshi mua masekonde 10 paudi mu tshiibi tshia tshina tshia mâyi ne ubala kode wa QR mu portable wabu, mmumue wa ku mishindu mitamba kuenzeka ya dienda dia bantu.)
• 3. Dikonkonona Settings > Linked Devices Musangu umua ku ngondu ku ma apps onso a mesaje:
• Ikala ne tshibidilu tshia kunzulula ku ngondo yonso Linked Devices / Active Sessions mu WhatsApp, Signal, Telegram, Discord, ne Google/Apple ID bua kujadika ne: kakuena biamu bia mudimu anyi biamu bia mudimu bidi kabiyi bimanyike to.
• 4. Teka ON Two-Step Verification (Registration Lock / Cloud Password):
• Nansha mudi Two-Step Verification kayi ukandika QRLJacking (bualu QRLJacking bidi bienzeka munda mua telefone webe ukadi mubuele), udi wenza mudimu ne Two-Step Verification mu WhatsApp (Settings > Account > Two-step verification), Tshimanyishilu (Settings > Account > Registration Lock), ne Telegram (Settings > Privacy and Security > Two-Step Verification) udi ukandika muena lukuna bua kubandisha tshisangilu tshia mulunda mu dikuata dia nomba ya telefone ya kumpala.
• 5. Kuena ne bua kulama mêyi a tshisokomenu, miaku ya ntete anyi foto ya ID mu "Messages Saved" anyi "Note to Self":
• Umbusha meyi onso a tshisokomenu, binjinjimbi bia karte ka mfranga, ne miaku ya seed mu programe yebe ya mesaje lelu (Delete for Everyone) ne ubateke mu tshiamu tshia tshisokomenu tshidi katshiyi ne dimanya (Bitwarden, 1Password, KeePassXC, anyi Apple Passwords).

Nomba ya tshimpitshimpi ya mu tshijengu ne mikenji ya bibambalu¶

Bantu badi kabayi banyishibue bua kubuela mu konte ya mesaje ya pa nkaya ku diambuluisha dia QRLJacking anyi disangisha dia tshiamu tshia mudimu tshidi katshiyi tshiumvuika ntshilema bilondeshile mikenji ya diteleja, dilondangana ne dienza mudimu bibi ne ordinatere pa buloba bujima:

• États-Unis ne Canada:
• Midimu ya tshimpitshimpi: Ela 911 pikala dikuata dia konte didi dilomba dilondangana dia mu nzubu, dienda masandi, anyi njiwu ya lukasa ya bukubi bua mubidi.
• FBI Centre Crime Complaint Center (IC3) & CISA: Leja dikuata dia konte ya QR-code ne dishima dia malu a mfranga ku ic3.gov (CISA ne FBI mbapatule mibelu misunguluke pa bidi bitangila tshiena-Russie/APT Signal ne WhatsApp tshienzedi tshia QR tshidi tshitangila mbulamatadi, basalayi, ne ba kamona kamba).
• Tshibambalu tshia diluisha dishima tshia mu Canada (CAFC): Luapolo ku antifraudcentre-centreantifraude.ca anyi 1-888-495-8501.
• Bukalenge bua ditunga:
• Midimu ya tshimpitshimpi: Ela 999 (anyi 101 bua bampulushi badi kabayi benza mudimu wa tshimpitshimpi).
• Action Fraud & NCSC: Kumanyisha dibuela dia mesaje didi kadiyi dianyishibue muinshi mua Computer Misuse Act 1990 ku actionfraud.police.uk (0300 123 2040) ne kumanyisha URL ya QR mibi kudi NCSC ku ncsc.gov.uk.
• Buobumue bua matunga a ku Mputu:
• Midimu ya tshimpitshimpi: Ela 112 mu matunga onso adi mu UE.
• Bibambalu bia malu a tshinyangu bia ku Enternete ne ENISA: Luapolo ku diambuluisha dia tshibuelelu tshia malu a tshinyangu tshia ku Enternete tshia Europol (europol.europa.eu/report-a-crime/report-cybercrime-online).
• Australie ne Nouvelle-Zélande:
• Midimu ya tshimpitshimpi: Ela 000 mu Australie anyi 111 mu Nouvelle-Zélande.
• ReportCyber (ACSC) & Scamwatch (Australia): Report WhatsApp/Telegram "Hi Mum / Impersonation" ne QR account takeovers ku cyber.gov.au (1300 CYBER1) anyi scamwatch.gov.au.
• CERT NZ (New Zealand): Report at cert.govt.nz.
• India ne Asia-Pacifique:
• India National Cyber Crime Reporting Portal: Dial 1930 anyi kumanyisha dikuata dia WhatsApp/Telegram ku cybercrime.gov.in.
• Bampulushi ba mu Singapour (SPF Tshibambalu tshia diluisha dishima) ne CSA: Bikila 1799 (ScamShield) anyi 1800-722-6688 (Singapore mmupeta mavuala a bungi a dishima dia "Singpass / Election / Survey" WhatsApp Web QR-linking scams).

Nkonko itubu bela misangu ya bungi¶

Mmunyi mudi muntu mua kubala mesaje anyi a WhatsApp anyi a Signal mu ordinatere wende padi WhatsApp ne Signal bikale "End-to-End Encrypted"?¶

Difunda dia ku ndekelu too ne ku ndekelu (`E2EE`) udi umvuija ne: mesaje adi masokoka pankatshi pa biamu bia konte webe ne biamu bia muena mudimu webe bua se: nansha bafidi ba ngenyi anyi tshiamu tshia mesaje nkayatshi kabatshiyi mua kuyibala padibu bayibala to. Ino, paudi ubala muntu udi uluisha `WhatsApp Web` anyi `Signal Desktop` QR code ku diambuluisha dia telefone webe Biamu bia mudimu scanner (anyi padi muntu udi ne bukenji bua kumona telefone webe udi kayi mukanga udi utangila tshiamu tshia portable wende), telefone webe udi uleja ordinatere wa muntu udi ukubunda bu umo wa ku ndekelu weba wa ku ndekelu too ne ku ndekelu udi ne tshisokomenu. Kubangila anu dîba adi too ne paudi ufina pa "Log Out" mu Linked Devices, telefone webe udi ufunda kopi wa mesaje onso bua tshifungu tshia tshikebelu tshia muena tshibawu.

Ndishilangana kayi didi pankatshi pa kuenza scanner wa code QR ne tshiamu tshianyi tshia iPhone/Android Camera ne kuenza scanner mu tshiamu tshia WhatsApp/Signal/Discord tshia "Linked Devices" scanner?¶

Paudi utangila QR code ku diambuluisha dia **iPhone anyi Android Camera app**, QR code utu ne njila wa ku Enternete (`https://...`), bidi mua kufikisha ku site wa dishima ([kulekela](qr-code-phishing-quishing-parking-meter-decals-and-malicious-redirects.md)) udi ukulomba bua kufunda mot de passe anyi nimero ya karte ka mfranga, **kadi anu kuenza scanner wa URL wa ku Enternete ne tshiamu tshiebe tshia foto tshia pa tshibidilu kakuena mua kusangisha tshisangilu tshia WhatsApp Web anyi tshia Signal Desktop nkayatshi to**. Kadi, padi muena tshinyangu ukusaka bua kunzulula **WhatsApp / Signal / Telegram / Discord -> Settings -> Linked Devices -> Link a Device** ne kuleja *tshiamu* tshia scanner tshia mu app ku QR code wabu (anyi kufunda code wabu wa maleta 8), udi wenza mudimu ne tshiamu tshia cryptographique tshidi tshifila tshianza tshia muntu udi uluisha diakamue kubuela mu konte webe kuyi muanji kufunda mot de passe to.

Muntu udi uluisha udi mua kulamakaja WhatsApp Web anyi Signal Desktop tshisangilu tshitshidi anu tshibala mesaje anyi kunyima kua meme mumane kuela "Log Out / Unlink" mu Linked Devices anyi?¶

Tòo, ki mbua mesaje mapiamapia adibu batuma panyima pa wewe mumane kuapatula to. Dîba diudi utua Patuka / Kupatuka muinshi mua Malongolola > Biamu bia mudimu, telefone webe wa kumpala udi umbusha tshifungu tshia tshiamu tshia mudimu tshidi pa tshiamu tshia mudimu ne udi unyungulula tshifungu tshia dituma dia bintu bia bungi (`Sender Key` ratchets) ne bantu bebe bonso ne miyuki ya mu kasumbu. Tshiamu tshia mudimu tshia muena tshinyangu tshidi tshipatuka diakamue ne katshiena mua kujingulula mukenji mukuabu udi ubuela anyi udi upatuka to, nansha mudiye ulama mesaje onso a kale avua tshiamu tshiabu tshia mudimu tshimane kuangata mu tshikondo tshivuabu babuelakane.

Mmunyi muvua muena dibaka anyi mulume anyi mukaji udi ne mukawu mua kubala mesaje anyi onso a WhatsApp anyi a Telegram kayi muele programe wa spyware mu telefone wanyi?¶

Mushindu wa kumpala udibu benza nende mudimu kudi bantu badi bateleja malu a mu nzubu bua kubala malu adibu bayukila nabu mu WhatsApp, mu Signal, mu Telegram anyi mu iMessage udi ulomba kakuena programe wa tshimpitshimpi mu telefone webe to: paudi mulale anyi mu tshina tshia mâyi, muntu udi unzulula telefone webe (mumanye code webe wa nomba 4 too ne ku 6), udi unzulula `WhatsApp > Settings > Linked Devices > Link a Device`, ne udi ubala kode wa QR mu tshiamu tshiabu tshia ku bianza anyi tshia tablete (`web.whatsapp.com`). Bu mudi telefone webe wenza mudimu bimpa kunyima kua bualu ebu, bantu badibu bakengesha batu misangu ya bungi bapitshisha ngondo ya bungi kabayi bamanye ne: tshiamu tshia kubandila natshi tshidi tshipeta mesaje onso mu tshimpitshimpi. Tangila misangu yonso `Settings > Linked Devices` mu ma app onso a difundilangana mesaje, shintulula code wa tshibuelelu tshia telefone webe, ne enza mudimu ne **App Lock** munda mua WhatsApp, Signal, ne Telegram.

Bua tshinyi WhatsApp uvua mupatule dimanyisha dilomba bua "Bueja code bua kusangisha tshiamu tshipiatshipia" pamvua tshiyi muanji kunzulula WhatsApp Web?¶

WhatsApp muvudije tshintu tshidibu babikila ne: "Link ne nimero ya telefone pamutu pa" pa `web.whatsapp.com` bua bena mudimu badi ne biamu bia foto bia telefone binyanguke. Bualu muntu yonso udi mumanye nimero webe wa telefone wa nomba 10 udi mua kufunda nimero webe wa telefone mu `web.whatsapp.com` ne ufina pa "Next", muntu udi ukubunda udi mua kuenza mudimu ne dimanyisha adi mu telefone webe dîba kayi dionso padiye ukubikila anyi ukufundila mesaje wenza bu udi muena mudimu wa WhatsApp anyi muendeshi wa bintu udi ukulomba bua "funda kode wa maleta 8 `XXXX-XXXX` bua kujadika konte webe". Kuena ne bua kufunda maleta 8 mu WhatsApp to, anu wewe nkayebe mumulombe ku tshiamu tshiebe tshia ordinatere kukadi masekonde 5.

Malu adi apetangana¶

• QR code phishing (quishing), parking meter decals, ne malicious redirects
• Code star-code wa muena mudimu (*72) dituma dia mabikila ne diangatshila dia PIN ya mesaje
• Dishintakaja dia SIM: mushindu kayi wa kujingulula, kuimanyika, ne kupingana ku dikuata dia SIM
• Stalkerware, spyware, ne keylogger detection mu telefone
• OAuth udi witaba dishima, difila dia bintu bibi kudi bantu bakuabu, ne dijimija dia token wa API
• Nomba ya njiwu bilondeshile ditunga

Miaba ne buludiki bua mbulamatadi¶

• Tshibambalu tshia bukubi bua ku Enternete ne tshia bintu bia mudimu (CISA), Tshibambalu tshia bukubi bua ditunga (NSA), & FBI (United States): Joint Cybersecurity Advisory on Russian State-Sponsored and Cybercriminal Targeting of Signal, WhatsApp, and Telegram via Malicious "Linked Devices" QR Codes (QRLJacking / Ghost Pairing).
• Kukangula mudimu wa bukubi bua programe ya pa buloba bujima (OWASP): QRLJacking (Quick Response Code Login Jacking) Mulongo wa dibunda ne mishindu ya kukandamena dikuata dia tshisangilu.
• Tshibambalu tshia bukubi tshia ku Enternete tshia ditunga (NCSC) (Royaume-Uni) & Cyber Security Agency of Singapour (CSA): Mamanyisha a bantu bonso pa malu a tshinyangu a WhatsApp Web QR Code, 8-Character Pairing Code Social Engineering, ne Linked-Device Auditing.
• WhatsApp Security Whitepaper (Meta) & Signal Protocol Specifications: Multi-Device End-to-End Encryption Architecture, Companion Device Key Revocation, and Sender Key Ratcheting.