Picking Up My Tab...
summary
Researchers demonstrate a practical attack called Synchronized Token Lifting and Spending (STLS) that sniffs an offline payment token on NFC/MST, audio or on-screen QR, then actively disrupts the local POS (network jammer, UI overlay or pairing popup) and relays the still-valid token to a colluder who redeems it elsewhere. Proof-of-concept uses a coil antenna and decoder, audio recorder, malware that grabs front/back camera reflections and overlays UI, and Bluetooth jamming. Proposed fix POSAUTH binds tokens to a printed POS ID and short validity.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:39Mobile Payment - A Convenient Life Style
- 2:12Offline Mobile Payment Working Flow
- 3:41Security Guarantees
- 4:14Assumption: Passive Adversaries
- 4:57Break it with an active adversary
- 5:28Attacks against Offline Payment
- 6:13Samsune Pay
- 9:35Devices to launch the attack
- 10:56Attacking Sound Pay - Adversary Model
- 11:16Attacking Sound Pay-Sniffing and Jamming
- 14:14Prevent Legal Scanning
- 15:02P2P Mode Attacks
- 16:13P2P Mode Attack Adversary Model
- 17:32Preventing sniffed QR code from legal scan
- 19:06POSAUTH, restrict the use of sniffed tokens
related talks
23mAll Your Payment Tokens Are Mine: Vulnerabilities of Mobile Payment Systems
19mSamsung Pay: Tokenized Numbers Flaws and Issues
23mPoint of Sale System Architecture and Security
38mMission mPOSsible
33mHacking Next-Gen ATMs: From Capture to Cashout
50mBreaking Payment Points of Interaction (POI)
01h 02mHow Samsung Secures Your Wallet and How To Break It
59mA Journey to Protect Points-of-Sale