GoQR.me QR Code Reader misbehaving

[mattem]

I have an XSOAR 8.5 instance with a playbook which makes use of the GoQR.me QR Code Reader integration.

It had been working nicely in the playbook for months, but has begun to misbehave.

In the playbook, images are extracted from a phishing email and stored in XSOAR, and the IDs of the images are fed through

!goqr-read-qr-code-from-file entry_id= with either a single value (rarely) or in most cases an array of EntryIDs as "Entry_ID= [/"first_id",/"second_id"....]

This had been working for a few months, but starting late last week it began to return errors as follows, after 120 seconds:

Reason

Error from QR Code Reader - goqr.me is : Script failed to run: Error: [Traceback (most recent call last): File "<string>", line 76, in <module> File "<string>", line 63, in main File "<string>", line 21, in read_qr_code File "<string>", line 93, in getFilePath File "<string>", line 289, in __do ValueError: timeout while waiting for answer: request 968af3ca-046f-48c3-82df-4e3a10613969. Wait time:2m0s (1515) ] (2604) (2603)

If I run !goqr-read-qr-code-from-file with a single EntryID, I get a sensible response.

If I submit two IDs, I get the script error above.

Is anyone else having this issue, and can anyone shed any light on what's going wrong?

[mattem]

I have an update on this.

After reconfiguring the integration to run on an engine, and setting up tcpdump to monitor all connections to the four publicly listed IP addresses of api.qrserver.com, I can see traffic between the engine and the API server if I submit a single Entry_ID

If I submit more than one Entry_ID, the engine server doesn't even try to connect to the API server.

So something in the Integration has broken such that it does not attempt to contact the API server in the event that more than one Entry_ID is supplied. But this worked perfectly earlier in the year.

[oromeromoya]

Hi @Mattern

Thanks for reaching out to us about this topic. Can you please answer the following questions?

- Have you recently applied an update/fix to your XSOAR environment?

- Which is the current version of XSOAR and GoQR.me QR Code Reader integration? (can you please refer us to the version/scenario where the integration ran as expected?)

- If you submit more than one Entry_ID and it stops working as expected, it is probable that the automation code will require some update to process other IDs again. As a workaround (if any update was installed for the integration), you should try rolling back to the version that was working previously.

[mattem]

Hi @oromeromoya,

Thanks for replying.

We have applied patches to the environment, but none that patched the goQR.me content pack.
While I can't see any indications in the error thrown by the script that forms part of the QR code integration that indicate we're running into a rate limiting problem, there does seem to be an issue with the number of items we're submitting to the goQR API.

Executing a QR code read for a dozen or so Entry_IDs generally works. I haven't established a magic number of Entry_IDs which causes the call to consistently fail with a large number of indicators.

In concert with Customer Success, we're looking to alter our playbook to reduce the number of items we submit in a single call, and we're also going to try out the XSOAR-native QR code reader to see if it better handles what we're trying to do.

I'll post back here once we've made some configuration and engineering changes to report progress.

[mattem]

Working with Customer Success and an XSOAR Engineer we've made a large number of changes to the over-elaborate Phishing playbook which has reduced the number of assets we have to pass to the goQR.me integration. We also opted to start using CV for QR code reading, with the rationale being that we couldn't control access to or performance of an external API, but we can sure use a lot of CPU time in docker containers running CV to do scanning within XSOAR. CPU time costs us nothing, and as yet our platform's not busy enough to need to offload the processing to an external provider.