Abstract:The massive growth of smart mobile devices has attracted numerous apps to embed third-party in-app payment, which involves more sophisticated interactions between multiple participants compared to traditional payments. Therefore, such payment is error prone and could be exploited easily, leading to serious financial deceptions. To investigate current third-party mobile payment ecosystem and find potential security threats, we conduct an in-depth analysis against China–world’s largest mobile payment market. We study four mainstream third-party mobile payment cashiers, and conclude unified process models. We also summarize the security rules that must be regulated by cashiers and merchants and illustrate four types of attacks if violating these rules. Besides, we also detect seven cases of security rule violation on both Android and iOS platform. Our detection result shows that hundreds of popular apps violate at least one security rule, and hence face with various security risks, allowing attackers to consume commodities or services without purchasing them or deceiving others to pay for them. Our further investigation reveals that cashiers as well as merchants should be responsible for those vulnerable cases. We also performed proof-of-concept attacks in real world, reported these issues to all involved parties and helped them fix the vulnerabilities.

RESEARCH ON APPLICABILITY OF SAFETY STANDARD IN MOBILE PAYMENT FIELD

RESEARCH ON METHOD OF SECURITY COMPLIANCE DETECTION AND ANALYSIS FOR MOBILE PAYMENT SYSTEM

Study on Compliance of Personal Biometric Information Processing Protocols in Financial APPs

Mobile Payment with Alipay: an Application of Extended Technology Acceptance Model.

Study Of Mobile Payments System

Mobile Payment Framework Based on 3G Network

An Integrated Mobile Phone Payment System Based on 3G Network.

Security Analysis of Third-Party In-App Payment in Mobile Applications

Perceived Mobile Information Security and Adoption of Mobile Payment Services in China

Secure remote mobile payment architecture and application

Analysis of Security Performance about the Implementations of NFC Mobile Payment

Design and Analysis on Error Handing and Controlling Protocol in Mobile Payment

Research and Practice on System Engineering Management of a Mobile Payment Project

Antecedents of Trust and Continuance Intention in Mobile Payment Platforms: the Moderating Effect of Gender.

Analysis of the Technical Characteristics of Java Card and Its Application

A Payment Model of Mobile Phone Based on Third-Party Security

Systematic survey of mobile payments, protocols, and security infrastructure

Identity Authentication Security Management in Mobile Payment Systems

Discussion on Technical Field and Deleloping Startegy of Mobile Payment

Recent Advancement in Mobile Payment Security Systems

Mobile Payment in China: Practice and Its Effects