Abstract:Mobile off-line payment enables purchase over the counter even in the absence of reliable network connections. Popular solutions proposed by leading payment service providers (e.g., Google, Amazon, Samsung, Apple) rely on direct communication between the payer's device and the POS system, through Near-Field Communication (NFC), Magnetic Secure Transaction (MST), audio and QR code. Although pre-cautions have been taken to protect the payment transactions through these channels, their security implications are less understood, particularly in the presence of unique threats to this new e-commerce service. In the paper, we report a new type of over-the-counter payment frauds on mobile off-line payment, which exploit the designs of existing schemes that apparently fail to consider the adversary capable of actively affecting the payment process. Our attack, called Synchronized Token Lifting and Spending (STLS), demonstrates that an active attacker can sniff the payment token, halt the ongoing transaction through various means and transmit the token quickly to a colluder to spend it in a different transaction while the token is still valid. Our research shows that such STLS attacks pose a realistic threat to popular offline payment schemes, particularly those meant to be backwardly compatible, like Samsung Pay and AliPay. To mitigate the newly discovered threats, we propose a new solution called POSAUTH. One fundamental cause of the STLS risk is the nature of the communication channels used by the vulnerable mobile off-line payment schemes, which are easy to sniff and jam, and more importantly, unable to support a secure mutual challenge-response protocols since information can only be transmitted in one-way. POSAUTH addresses this issue by incorporating one unique ID of the current POS terminal into the generation of payment tokens by requiring a quick scan-ning of QR code printed on the POS terminal. When combined with a short valid period, POSAUTH can ensure that tokens generated for one transaction can only be used in that transaction.

TinMan: eliminating confidential mobile data exposure with security oriented offloading

AppShell: Making Data Protection Practical for Lost or Stolen Android Devices

Taming Information-Stealing Smartphone Applications (On Android)

Hybrid User-level Sandboxing of Third-party Android Apps.

CodeTracker: A Lightweight Approach to Track and Protect Authorization Codes in SMS Messages

AirBag: Boosting Smartphone Resistance to Malware Infection.

Owner-Centric Protection of Unstructured Data on Smartphones.

Dtee: A Declarative Approach to Secure IoT Applications Using TrustZone

Secure Session on Mobile: an Exploration on Combining Biometric, Trustzone, and User Behavior

vTrust: Remotely Executing Mobile Apps Transparently With Local Untrusted OS

Building trusted path on untrusted device drivers for mobile devices

Sensitive Data Protection on Mobile Devices

Picking Up My Tab: Understanding and Mitigating Synchronized Token Lifting and Spending in Mobile Payment

TaintDroid

TaintART: A Practical Multi-level Information-Flow Tracking System for Android RunTime.

Software Abstractions for Trusted Sensors

Enabling Secure and Usable Mobile Application: Revealing the Nuts and Bolts of software TPM in todays Mobile Devices

Taintmini: Detecting Flow of Sensitive Data in Mini-Programs with Static Taint Analysis.

A Data Security Protection Mechanism Based on Transparent Biometric Authentication for Mobile Intelligent Terminals

Protecting mobile devices from physical memory attacks with targeted encryption

MobSafe: Cloud Computing Based Forensic Analysis for Massive Mobile Applications Using Data Mining