Mining and Exploiting (Mobile) Payment Credential Leaks in the Wild
summary
Built an automated scanner called pk miner that crawls GitHub, ~1 million Android APKs and merchant servers, parses repo history and APKs, and validates leaks by sending crafted requests (about 300s per test). The study finds roughly 20,000 unique payment credentials, including ~5,000 payment keys from 7,000 apks, over 400 active Android signing keys, and ~3,000 client certificates, enabling refunds, transaction downloads, account drains, cross-app notification forgery and account hijacks. Recommendations and responsible disclosures follow.
AI-written summary · about
chapters (10)
- 0:00Start
- 1:47Third-Party Payment Service for Mobile Apps
- 5:21Overview on Payment Credentials
- 6:10Payment Credentials: Payment key
- 20:38Paykey Miner Scanner
- 21:36Paykey Miner: Detector
- 28:57Test Result: Merchant Servers
- 29:55Responsible Disclosure & Longitudinal Study
- 31:32Resolving the Leaking App Identity
- 33:13Suggested Fixings
related talks
53mAre your secrets secure? How mobile applications are leaking millions of credentials
39mAre your secrets secure - How mobile apps are leaking millions of credentials
29mScorthter, Hacking Banks and Cryptocurrency Exchanges through their APIs
45mI just hacked your app!
45mI just hacked your app!
25mMobile App Security: Threat Landscape
42mIf 6,000 Mobile Malware Applications Could Talk! Ow, They Do, And A Lot!
31mHow I hacked 30 mobile banking apps & the future of API Security