Xiaomi phones with MediaTek chips vulnerable to forged payments

guest · Aug 12, 2022

August 12, 2022

Security analysts have found security issues in the payment system present on Xiaomi smartphones that rely on MediaTek chips providing the trusted execution environment (TEE) that is responsible for signing transactions.

Attackers could exploit the weaknesses to sign fake payment packages using a third-party unprivileged application.
The implications of such an attack would be to make the payment service unavailable or to sign transactions from the user’s mobile wallet to the threat actor’s account.
Click to expand...

Trusted environment in Xiaomi
Xiaomi phones that run on a MediaTek chip use the “Kinibi” TEE architecture, which creates a separate virtual enclave for storing security keys required for signing transactions.
This space is designed for running trusted apps like Xiaomi’s “thhadmin,” which is responsible for security management, including the ‘Tencent Soter’ embedded mobile payment framework that provides an API for third-party apps to integrate payment capabilities.

Apps like WeChat Pay and Alipay, which collectively have over a billion users, rely on the ‘Tencent Soter’ API to verify payment packages securely and enable financial transactions.
Click to expand...

Attacking Xiaomi’s trusted space
Security researchers at Check Point have found a flaw in the trusted app format that Xiaomi uses, namely the lack of version control. This opens the door for a downgrade attack, meaning that a threat actor could replace a newer, more secure app with an older, vulnerable version.

The researchers were able to use another vulnerability (CVE-2020-14125) in the Tencent Soter trusted app that allows an attacker to extract private keys and sign fake payment packages in the context of an unprivileged user.
Click to expand...

Check Point: Vulnerabilities on Xiaomi’s mobile payment mechanism which could allow forged transactions : A Check Point Research analysis

Highlights:

Check Point Research (CPR) analyzed the payment system built into Xiaomi smartphones powered by MediaTek chips

CPR found vulnerabilities that could allow forging of payment and disabling the payment system directly, from an unprivileged Android application

CPR collaborated with Xiaomi, which acknowledged the vulnerabilities and provided fixes for the vulnerabilities

Click to expand...

Log in or Sign up

Xiaomi phones with MediaTek chips vulnerable to forged payments

guest Guest

Log in or Sign up

Xiaomi phones with MediaTek chips vulnerable to forged payments

guest Guest

Useful Searches