All Your Payment Tokens Are Mine: Vulnerabilities of Mobile Payment Systems
summary
Shows that offline mobile payment tokens sent over QR, audio or MST are trivially sniffed and replayed: researchers extend MST range to 2-meter MST sniff, record and replay vending-machine audio, capture live QR via front-camera reflection, and use a commercial jammer to sever POS→backend so tokens stay valid. Attackers write replayed tokens onto magstripes with a $20–$30 magnetic-writer and use a Bluetooth-pairing UI trick or QR overlay to keep tokens alive; fixes include backend revocation and camera-use checks.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:12Mobile payment is so popular!
- 1:13Mobile payment don't use network
- 2:09Offline payment schemes
- 4:22Security weak points
- 5:03Security is not that bad
- 6:10Practical Attacks
- 7:28MST based mobile payment
- 12:23Devices used to attack MST
- 14:29Attack Sound Pay
- 15:45Attack QR code payment, sniffing
- 16:55Attack QR code payment, interrupting
- 17:45A security flaw
- 19:31Bonus attack, token sniffing
- 20:04Bonus attack, token protection
- 21:15Remedy
related talks
24mPicking Up My Tab...
19mSamsung Pay: Tokenized Numbers Flaws and Issues
38mMission mPOSsible
23mPoint of Sale System Architecture and Security
37mFirst Contact - Vulnerabilities in Contactless Payments
59mHow Smartcard Payment Systems Fail
06mHuman-in-the-Loop for Secure Digital Wallets Transactions
01h 02mHow Samsung Secures Your Wallet and How To Break It