17 ms·

How secure is this? Waving a device near something to complete a money transaction seems too easy. At Defcon 18, there was a presentation on how to access RFI

by jim_h 16y ago

How secure is this? Waving a device near something to complete a money transaction seems too easy. At Defcon 18, there was a presentation on how to access RFID from long range (http://www.youtube.com/watch?v=nEBrslz0Xf4 http://www.youtube.com/watch?v=nEBrslz0Xf4). It makes me nervous that other people can also do this stuff. There are already cards that do NFC, such as MBTA (public transportation) Charlie cards and American Express credit cards. However once NFC becomes even more common, will this invite the bad kind of hackers to bump up their efforts to steal your money? So, how secure is this?

exit 16y ago
a phone can show you a "confirm this payment" prompt though, which i imagine puts it a step above paypass/oyster card type pieces of plastic.
- jim_h 16y ago
  A phone can also have a virus or trojan horse app on it. Even easier to take your money if you can get access directly on the phone. Forget radio waves, just get the user to install an app on there that will transfer funds over. I think all of the smart phone operating systems have had a trojan horse app on them at some point. Most of them probably just did simple things before like a backdoor, making phone calls or stealing info. If your phone also controls your money...
  - drdaeman 16y ago
    Considering that traditional credit card security is based on just knowledge of simple shared secret - (card number, name, expiry date, cvv2) 4-tuple, and considering this secret is shared with everyone you do business with, this is still certainly more secure. Also, trojans still have to compromise the OS security. It's not the same deal as with non-secure information (like spyware games accessing the contacts list, just because users don't care about app permissions) - the certificate store will be certainly guarded way more carefully.
    - jim_h 16y ago
      With more users 'jailbreaking' or 'rooting' their phones, it's not as 'secure' as before. The point of doing those things is to break the phone's security and allow you to do more things. What if the creator decided to put in a little extra code.. or it introduced more vulnerabilities.. * I'm not trying to make you guys paranoid. Just wondering about the possibilities and playing devil advocate.
      - drdaeman 16y ago
        Well, not exactly, "jailbreaking" is about user gaining access to a phone, not applications. I don't know the details (I don't own iPhone or Android device, and N900 comes with root access almost out-of-box), but I believe pure jailbreaking shouldn't hurt OS security mechanisms too much. I may be wrong, though. However, you have a point: classic "dancing bunnies" problem[1] is certainly out there. Promise average user nice things, ask him to do some cryptic actions, and he'll happily follow your instructions without really understanding any consequences. [1]: http://en.wikipedia.org/wiki/Dancing_bunnies http://en.wikipedia.org/wiki/Dancing_bunnies
      - drivebyacct2 16y ago
        Drdaeman, it opens up the possibility of such "hostile" data access. For an application to simply start accessing random data in such a way that it could "access" financial details or actually interact with a payment provider... it would have to explicitly be given root permission. I give very few applications root. Terminal gets it, Rom Manager gets it. That's it. A random app from the Market? Hell no, it's not getting root and it's not getting access to my data. The thing is, this vector already exists. Download the Paypal app. Login. Now download drivebyacct2's malicious app on the Market. If you grant it root access through SuperUser, it could theoretically read out your Paypal credentials and do all kinds of stuff. Personally, I consider it to be very low risk.
richcollins 16y ago
Don't know how secure it is in this implementation but it should be easy to implement something that requires you to cryptographically sign the transaction.
- fakespastic 16y ago
  Would have to be a rolling-key, I'm guessing...but as I mentioned in another comment, the interval would be the kicker. Maybe it's simpler, now that I think of it. A rolling-key system with 2-way authentication, a one-time key becoming invalid after a transaction is made.
  - richcollins 16y ago
    Couldn't you just type in a passphrase on your phone and have it sign the transaction?
    - fakespastic 16y ago
      Whatever solution is created, I don't want to have to manually verify every transaction.

by jim_h 16y ago

exit 16y ago

a phone can show you a "confirm this payment" prompt though, which i imagine puts it a step above paypass/oyster card type pieces of plastic.

jim_h 16y ago
A phone can also have a virus or trojan horse app on it. Even easier to take your money if you can get access directly on the phone. Forget radio waves, just get the user to install an app on there that will transfer funds over. I think all of the smart phone operating systems have had a trojan horse app on them at some point. Most of them probably just did simple things before like a backdoor, making phone calls or stealing info. If your phone also controls your money...
- drdaeman 16y ago
  Considering that traditional credit card security is based on just knowledge of simple shared secret - (card number, name, expiry date, cvv2) 4-tuple, and considering this secret is shared with everyone you do business with, this is still certainly more secure. Also, trojans still have to compromise the OS security. It's not the same deal as with non-secure information (like spyware games accessing the contacts list, just because users don't care about app permissions) - the certificate store will be certainly guarded way more carefully.
  - jim_h 16y ago
    With more users 'jailbreaking' or 'rooting' their phones, it's not as 'secure' as before. The point of doing those things is to break the phone's security and allow you to do more things. What if the creator decided to put in a little extra code.. or it introduced more vulnerabilities.. * I'm not trying to make you guys paranoid. Just wondering about the possibilities and playing devil advocate.
    - drdaeman 16y ago
      Well, not exactly, "jailbreaking" is about user gaining access to a phone, not applications. I don't know the details (I don't own iPhone or Android device, and N900 comes with root access almost out-of-box), but I believe pure jailbreaking shouldn't hurt OS security mechanisms too much. I may be wrong, though. However, you have a point: classic "dancing bunnies" problem[1] is certainly out there. Promise average user nice things, ask him to do some cryptic actions, and he'll happily follow your instructions without really understanding any consequences. [1]: http://en.wikipedia.org/wiki/Dancing_bunnies http://en.wikipedia.org/wiki/Dancing_bunnies
    - drivebyacct2 16y ago
      Drdaeman, it opens up the possibility of such "hostile" data access. For an application to simply start accessing random data in such a way that it could "access" financial details or actually interact with a payment provider... it would have to explicitly be given root permission. I give very few applications root. Terminal gets it, Rom Manager gets it. That's it. A random app from the Market? Hell no, it's not getting root and it's not getting access to my data. The thing is, this vector already exists. Download the Paypal app. Login. Now download drivebyacct2's malicious app on the Market. If you grant it root access through SuperUser, it could theoretically read out your Paypal credentials and do all kinds of stuff. Personally, I consider it to be very low risk.

richcollins 16y ago

Don't know how secure it is in this implementation but it should be easy to implement something that requires you to cryptographically sign the transaction.

fakespastic 16y ago
Would have to be a rolling-key, I'm guessing...but as I mentioned in another comment, the interval would be the kicker. Maybe it's simpler, now that I think of it. A rolling-key system with 2-way authentication, a one-time key becoming invalid after a transaction is made.
- richcollins 16y ago
  Couldn't you just type in a passphrase on your phone and have it sign the transaction?
  - fakespastic 16y ago
    Whatever solution is created, I don't want to have to manually verify every transaction.