Near Field Communication (NFC) and contactless applications are increasing at unprecedented rate and their value is being recognised by the financial industry (Ok et al., 2011). Attacks are also increasing and they can compromise the business value on NFC applications (Murdoch and Anderson, 2010, Trend Micro, 2015). The present paper analyse the anatomy of possible attacks, uncovering vulnerabilities and suggesting possible countermeasures. The value of the paper is found in the contribution to practical mitigation of risk in the mobile payment financial business, with respect to the technology side. Host Card Emulation (HCE) is a technology solution that permits the creation of a virtual representation of a smart card using only software components, effectively eliminating the need for Secure Element hardware in the device. NFC/HCE technologies has proved itself very vulnerable in a variety of aspects. The paper would go through specific vulnerabilities and vulnerable situation, like: a non-secure-device/cloud communication channel; access to data saved locally in wallet; reusability of token; use of fake POS; malware and fake application; specific vulnerabilities of “Tap & Pay”; device/cloud decoupling. Countermeasures that have been proved effective are offered to readers along with Organisational aspects to be taken into account.

Cavallari, M., Adami, L., Tornieri, F., Organisational aspects and anatomy of an attack on NFC/HCE mobile payment systems, Paper, in ICEIS 2015 - 17th International Conference on Enterprise Information Systems, Proceedings, (Barcellona, 27-30 April 2015), Springer, Barcellona 2015: 685-700 [http://hdl.handle.net/10807/67687]

Organisational aspects and anatomy of an attack on NFC/HCE mobile payment systems

Cavallari, Maurizio;Adami, Luca;
2015

Abstract

Near Field Communication (NFC) and contactless applications are increasing at unprecedented rate and their value is being recognised by the financial industry (Ok et al., 2011). Attacks are also increasing and they can compromise the business value on NFC applications (Murdoch and Anderson, 2010, Trend Micro, 2015). The present paper analyse the anatomy of possible attacks, uncovering vulnerabilities and suggesting possible countermeasures. The value of the paper is found in the contribution to practical mitigation of risk in the mobile payment financial business, with respect to the technology side. Host Card Emulation (HCE) is a technology solution that permits the creation of a virtual representation of a smart card using only software components, effectively eliminating the need for Secure Element hardware in the device. NFC/HCE technologies has proved itself very vulnerable in a variety of aspects. The paper would go through specific vulnerabilities and vulnerable situation, like: a non-secure-device/cloud communication channel; access to data saved locally in wallet; reusability of token; use of fake POS; malware and fake application; specific vulnerabilities of “Tap & Pay”; device/cloud decoupling. Countermeasures that have been proved effective are offered to readers along with Organisational aspects to be taken into account.
Inglese
ICEIS 2015 - 17th International Conference on Enterprise Information Systems, Proceedings
ICEIS 2015 - 17th International Conference on Enterprise Information Systems
Barcellona
Paper
27-apr-2015
30-apr-2015
Cavallari, M., Adami, L., Tornieri, F., Organisational aspects and anatomy of an attack on NFC/HCE mobile payment systems, Paper, in ICEIS 2015 - 17th International Conference on Enterprise Information Systems, Proceedings, (Barcellona, 27-30 April 2015), Springer, Barcellona 2015: 685-700 [http://hdl.handle.net/10807/67687]
File in questo prodotto:
Non ci sono file associati a questo prodotto.

I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.

Utilizza questo identificativo per citare o creare un link a questo documento: http://hdl.handle.net/10807/67687
Citazioni
  • ???jsp.display-item.citation.pmc??? ND
  • Scopus 6
  • ???jsp.display-item.citation.isi??? ND
social impact