HCE cloning FAQ
Our research demonstrated that it is possible to copy mobile contactless card data, enrol it to another phone, and use it for payment. PoC video is available here. Details will be revealed during our talk at HITB conference in Amsterdam Apr 13, 2017. Meanwhile, we are publishing this FAQ to minimize potential misunderstanding.
HCE cloning FAQ
Our research demonstrated that it is possible to copy mobile contactless card data, enrol it to another phone, and use it for payment. PoC video is available here. Details will be revealed during our talk at HITB conference in Amsterdam Apr 13, 2017. Meanwhile, we are publishing this FAQ to minimize potential misunderstanding.
1. What are the exploitation conditions?
In order to access card data stored on a device, the attacker needs to get root access to it. Additionally, each implementation uses different security countermeasures, and thus requires individual effort to exploit it.
2. What are the results of exploiting?
After having successfully cloned the card, the attacker can make contactless payments using his own device – just like a victim user.
3. Which payment applications are potentially vulnerable to cloning?
Any application that uses HCE (Host Card Emulation) technology. Literally, it concerns Android and Windows Phone mobile contactless payments applications. iOS uses a hardware element (so called Secure Element) for storing and accessing card data. It works like a tiny HSM, so stealing payment card data is much more difficult.
4. Is rooting malware real risk?
Yes, there are several examples of mobile malware which exploits vulnerabilities in unpatched Android devices to gain root. E.g.: Gooligan, Godless, Shedun or HummingBad malware families, with infection rates as high as 10 mln devices worldwide.
5. Is it exploited in the wild?
Not to our knowledge.
6. How about transactions above contactless “floor limit”, which require additional authorization (e.g. PIN)?
There are several methods for cardholder verification in such cases:
a) Card PIN entered in payment terminal: Depending on implementation, the attacker may be able to intercept also the card PIN – e.g. if it is set up during card issuing on the same mobile device, the attacker has full control of.
b) CDCVM: Moreover, some applications implement CDCVM (Consumer Device Cardholder Verification Method). It allows to authorize payment using a mobile device – by mobile PIN, pattern, fingerprint, etc. Having root access to the victim’s phone, the attacker is able to intercept this authorization, and then just repeat the same step on his cloned device. Or just bypass it and invoke appropriate CVM API methods in the application.
7. But the payment keys stored on a device are of limited use, and after a few transactions have to be pushed again to the device?
We have proved that the attacker is able to intercept also the payment keys refreshing – get the new keys on his cloned device, and thus make more transactions.
8. Is the cloning process the same for all HCE applications?
Each implementation is different – it may use various security mechanisms, and thus may require changes in the cloning procedure.
We have tested several implementations, and we were able to clone all of them, however some of them required more effort and resources than others.
9. How HCE card cloning risk could be mitigated?
HCE card clonning is possible “by design” and it’s a result of implementing card data storage in the software. That’s why it’s not possible to completely prevent the cloning. Payment providers and banks deploying HCE technology in their mobile payment solutions should use additional countermeasures, such as device scoring, malware detection, integrity protections and server side fraud detection to increase complexity of attack.
10. Why are you publishing this info?
During HCE security assessment performed for our clients, we have noticed that developers are not aware of cloning possibility and such risk usually is not taken into account. Some developers believe that technology is totally immune to cloning because it uses “secure element in the cloud” (statement taken from some HCE library vendors materials). We decided to provide PoC to raise awareness and to encourage developers and security architects to verify their payment systems and introduce additional countermeasures before fraudsters will exploit these new opportunities on a mass scale.
11. Would you publish a working exploit?
No. Our goal is to raise awareness and we are not going to publish any tools that would help to clone card data.
We will share general procedure steps to enable financial institutions testing their systems, but not the exact exploit. If you can prove your identity and non-malicious intent, please contact us for more details.
12. If I’m just an ordinary user – should I be afraid of HCE card cloning?
Probably no – if you follow general mobile payments security guidelines.
13. I’ve never rooted my phone. Am I secure?
It depends. If you have not updated and patched your phone and you are installing applications from unknown sources, then malware can exploit some flaws in the operating system and gain root privileges.
14. How an ordinary user can detect potential fraud?
Similarly like in case of plastic card frauds – you should watch your transaction history. Additionally, some banks offer notifications delivered by email or SMS for transactions above a defined threshold. Just beware that if those notifications are delivered to the same unsecured phone, then they could be blocked or deleted by malware.
