Samsung Pay exploit could allow hackers to “skim” credit cards, in theory
Apparently, every time the Samsung Pay app is opened, even without initiating a transaction, it automatically generates a token. If the user initiates a purchase, that generates another token even if the purchase is canceled. The problem here, Mr. Mendoza claims, is that all these generated tokens remain active even after the session ends. This means that they can still be used for purchases, although not on the device they were generated on, if they were to be intercepted by a third party in the span of 24 hours (that's how long they remain active).
In the video below, Mendoza demonstrates how tokens can be easily collected with a skimming device attached to his wrist. After obtaining a token, he then loads it into a tool called “MagSpoof”, which he uses to make a purchase with.
Samsung has since issued an official statement on the matter, admitting that such attacks are possible, but maintaining that they would be “extremely difficult” to pull off:
The possibility of a Samsung Pay user transmitting a payment token using user authentication such as fingerprint, having a fraudster capture the data on a separate device, and the fraudster relaying the token at a credit card reader for a successful transaction is extremely unlikely. In order for this “token skimming” to work, multiple difficult conditions must be met. First the user must permit the token and cryptogram generation with his or her own authentication method. This pair of token and cryptogram (also known as a “payment signal”) must be transmitted to the POS for each transaction and cannot be used for multiple transactions.
Then the fraudster needs to capture the signal on a device that is within very close proximity to the Samsung phone. Due to the short-range nature of MST, it is difficult to capture the payment signal. Even if the fraudster was able to capture the signal, the fraudster would have to ensure that the original payment signal of the legitimate user does not get to the issuer for approval. Otherwise the captured signal would be useless. Ensuring this may require the fraudster to jam the connection between the phone and POS terminal or to quickly complete the transaction before the legitimate user’s signal reaches the payment terminal and the card issuer. Because users typically permit the cryptogram generation just before their payment at the POS, these conditions would be very difficult to meet in practice. When any transaction happens, the legitimate Samsung Pay user would get immediately a Samsung Pay transaction notification on the smartphone screen. The users would take any necessary action with his or her issuer with payment transaction including un-familiar one. In summary, Samsung Pay’s multiple layers of security make it extremely difficult to make a purchase by skimming a token.
Then the fraudster needs to capture the signal on a device that is within very close proximity to the Samsung phone. Due to the short-range nature of MST, it is difficult to capture the payment signal. Even if the fraudster was able to capture the signal, the fraudster would have to ensure that the original payment signal of the legitimate user does not get to the issuer for approval. Otherwise the captured signal would be useless. Ensuring this may require the fraudster to jam the connection between the phone and POS terminal or to quickly complete the transaction before the legitimate user’s signal reaches the payment terminal and the card issuer. Because users typically permit the cryptogram generation just before their payment at the POS, these conditions would be very difficult to meet in practice. When any transaction happens, the legitimate Samsung Pay user would get immediately a Samsung Pay transaction notification on the smartphone screen. The users would take any necessary action with his or her issuer with payment transaction including un-familiar one. In summary, Samsung Pay’s multiple layers of security make it extremely difficult to make a purchase by skimming a token.
This statement was issued by Samsung two days ago, on August 7. Earlier today, Mendoza uploaded a new “uncut” video on his YouTube channel, again demonstrating the same security flaw. As far as the video goes, Mendoza does not touch on the topic of user authentication at all. Furthermore, since there is no other way of transmitting a payment token without some sort of authentication – be it a password or a fingerprint – he seemingly authenticates the app himself while the phone is off camera for a second and mentions nothing of it. After that, he quickly manages to “capture” a token and successfully completes a purchase with it – swiftly receiving a notification from Samsung Pay on his phone – demonstrating yet again that there is a hole in the security system.
In any case, we wouldn't worry ourselves too much over this exploit, given all the requirements that have to be met in order for fraudsters to steal our precious tokens. Still, we are glad that Mr. Mendoza has brought this security flaw to light, and we certainly hope that Samsung does its best to resolve the issue.
source: Salvador Mendoza (YouTube) via ZDNet
FCC OKs Cingular\'s purchase of AT&T Wireless
Things that are NOT allowed:
To help keep our community safe and free from spam, we apply temporary limits to newly created accounts: