Abstract:Mobile off-line payment enables purchase over the counter even in the absence of reliable network connections. Popular solutions proposed by leading payment service providers (e.g., Google, Amazon, Samsung, Apple) rely on direct communication between the payer's device and the POS system, through Near-Field Communication (NFC), Magnetic Secure Transaction (MST), audio and QR code. Although pre-cautions have been taken to protect the payment transactions through these channels, their security implications are less understood, particularly in the presence of unique threats to this new e-commerce service. In the paper, we report a new type of over-the-counter payment frauds on mobile off-line payment, which exploit the designs of existing schemes that apparently fail to consider the adversary capable of actively affecting the payment process. Our attack, called Synchronized Token Lifting and Spending (STLS), demonstrates that an active attacker can sniff the payment token, halt the ongoing transaction through various means and transmit the token quickly to a colluder to spend it in a different transaction while the token is still valid. Our research shows that such STLS attacks pose a realistic threat to popular offline payment schemes, particularly those meant to be backwardly compatible, like Samsung Pay and AliPay. To mitigate the newly discovered threats, we propose a new solution called POSAUTH. One fundamental cause of the STLS risk is the nature of the communication channels used by the vulnerable mobile off-line payment schemes, which are easy to sniff and jam, and more importantly, unable to support a secure mutual challenge-response protocols since information can only be transmitted in one-way. POSAUTH addresses this issue by incorporating one unique ID of the current POS terminal into the generation of payment tokens by requiring a quick scan-ning of QR code printed on the POS terminal. When combined with a short valid period, POSAUTH can ensure that tokens generated for one transaction can only be used in that transaction.

Secure Payment System Utilizing MANET for Disaster Areas

Bargain Security Model Based on Mobile Agent

Mobile Payment Framework Based on 3G Network

An Investigation on Using Web Services for Micro-Payment

Picking Up My Tab: Understanding and Mitigating Synchronized Token Lifting and Spending in Mobile Payment

A Delay-Tolerant Payment Scheme Based on the Ethereum Blockchain

Dual-Anonymous Off-Line Electronic Cash for Mobile Payment

A Novel NFC-Based Secure Protocol for Merchant Transactions

An Integrated Mobile Phone Payment System Based on 3G Network.

Secure remote mobile payment architecture and application

Research on Offline Transaction Model in Mobile Payment System

Lightweight Security for Mobile Commerce Transactions

Secure Mobile Payment Via Trusted Computing

A Secure and Authenticated Mobile Payment Protocol Against Off-Site Attack Strategy

Machine learning for mobile network payment security evaluation system

Nfc Secure Payment And Verification Scheme For Mobile Payment

Mobile Based Secure Digital Wallet for Peer to Peer Payment System

Study Of Mobile Payments System

An innovative electronic group-buying system for mobile commerce

OPPay: Design and Implementation of a Payment System for Opportunistic Data Services.

Secure Mobile Payment Architecture Enabling Multi-factor Authentication