Samsung Pay Leaks Mobile Device Information

Researcher at Black Hat Europe will show how Samsung Pays security falls short and ways attackers could potentially bypass it.

Mobile users installing Samsung Pay on their devices could have sensitive information stolen by attackers due to a newly discovered weakness in the app that leaks the digital tokens that secure transactions and other technical information such as network traffic logs.
An attacker could capture this information without having to authenticate to the device, according to a Tencent researcher who goes by the name of HC, who at Black Hat Europe 2017 next month will present his findings on the Samsung Pay security weaknesses.
This information can let the attacker learn much more about the internal mechanisms of Samsung Pay and allow them to use it to their advantage to go even deeper into Samsung Pay, HC says.
The attacker, for example, could take the information and use it to view communication between users and their banks in plain text. With enough information, HC notes, an attacker could create another token to withdraw money from users bank accounts.
Samsung Pays tokens are unique alphanumeric identifiers generated via algorithms and designed to eliminate the need to use a credit card or debit card number.
This is not a vulnerability in Samsung Pay, but a mistake in Samsung Pays app. The mistake is you dont need privileges to get access to the phone log system, says HC, who has notified Samsung about the issue.
HC conducted his research using a Samsung Galaxy S6 but says all Samsung Galaxy smartphones that feature Samsung Pay may be at risk.
The purpose of
HCs presentation
is to discuss Samsung Pays security and how to generate a token without the device being physically present, which is different than a
2016 Black Hat Samsung Pay demonstration
by another security researcher, HC notes.
Although HC in his research had aimed to generate a token without a Samsung Galaxy device, he acknowledged he was not able to achieve that goal because of the strength of the encrypted traffic and difficulty in accessing the secure chip to crack the encrypted key.
It is possible to compromise Samsung Pay with the right tools and skills, HC says, noting in his particular case the desired tools were not immediately available.
Related Content:
6 Real Black Friday Phishing Lures
Samsung KNOX Takes Some Knocks
Todays New Payment Card Security In A Nutshell
Apple Pay Fraud Gives Us A New Reason To Hate Data Breaches And SSNs

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity
agenda here
.

Last News
▸ Hackers exploit admin usernames in WordPress. ◂ Discovered: 27/12/2024 Category: security	▸ Open Group Releases Security Standard For Tech Supply Chain ◂ Discovered: 27/12/2024 Category: security	▸ Syrian Electronic Army hacks Guardian Twitter. ◂ Discovered: 27/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Samsung Pay Leaks Mobile Device Information