How Samsung Secures Your Wallet and How To Break It
summary
Reverse engineering shows Samsung Pay uses MST + NFC, a SE embedded in the NFC controller, and a TSM enrollment workflow that creates a supplementary security domain. Research gains root via dirty COW to patch native .odex code and enable verbose logs; those logs leak a long‑lived SSID/session ID (up to ~24h) and other enrollment parameters, letting a custom client talk to TSM and observe SE applet installation. SE keys and token‑generation algorithm remain inaccessible, so tokens aren’t extracted and funds aren’t stolen.
AI-written summary · about
chapters (7)
- 0:00Introduction and background
- 2:05Samsung Pay architecture
- 11:31System level analysis
- 22:05Secure world operations
- 30:52Payment flow mechanics
- 38:16Registration and security
- 58:53Conclusion and Q&A
related talks
19mSamsung Pay: Tokenized Numbers Flaws and Issues
40mExposing The Deep-Secure Elements Of Smartcards
24mPicking Up My Tab...
23mAll Your Payment Tokens Are Mine: Vulnerabilities of Mobile Payment Systems
43mBreaking Samsung's ARM TrustZone
23mPoint of Sale System Architecture and Security
29mSecuring Android: Tackling Advanced Threats and Enhancing App Security
36mPhysical Attacks Against Smartphones