CSCvs55128 - [ENH] ESA should scan the QR and barcodes in the emails

[cdion]

Hello ppl,

any ideas on QR (Quishing) protection with ESA SEGs topic?

Looks like that even with Image-Analysis feature, SEGs are not able to scan (suspicious) URLs encoded as QRs in message embedded pictures.

There is a feature request [CSCvs55128] since 2019, but looks like we haven't any progress on this field.
Any fresh update is highly appreciated.

thanks and regards,

Chris

[System Administrator]

I'm going to second this request.  Attackers are adapting.  We are seeing a MAJOR uptick in the number of emails that are purely image-based with zero textual component.  This is an abhorrent weak point with the ESAs and is requiring organizations such as ours to seek out this feature in competitor products.

To compound this issue, these image-only email attacks using QR codes introduce additional strain on any company's last line of defense (the end user) to recognize malicious/phishing emails that have made it past the ESAs.  Many companies are working toward cloud-based solutions that require MFA products which can use QR codes which are indistinguishable to the naked eye.  Our organization must now be increasingly cautious with any legitimate use of QR codes or solutions that use them until this gaping hole in the ESAs is addressed.

Time to stop buying competitors and enhance what you already provide.

[knasterlaster]

push

[deborah_walmer-basembe@dai.com]

Please add this feature

[betachang]

Please add this feature

[JvBNL]

Don'.t want to call this a feature, but a core requirement anno 2024
This is already a major attack vector and the lack of response is ridiculous.  Has cisco been sleeping ?
An option to just identify and block QR's in general would also be appreciated.

[patrick.d]

Cisco is falling behind in this area. Agree with JvBNL, this isn't a feature request but a basic core requirement. It's just silly that Cisco chooses to ignore this attack vector.

[mattdrury]

This is a a fundamental need at this point, and I think I've done as much customizing as I can to deal with this. At some point, Cisco need to step up.