They discover a serious vulnerability in certain Xiaomi mobile models that allows forging payments | Technology

Written by ebookingservices

If you make mobile payments with your Xiaomi phone, it is likely that you may be vulnerable to this security issue.

Cybercriminals are always on the lookout for different popular phone vulnerabilities to attempt to perpetrate attacks on a large set of users, and Xiaomi smartphones based on MediaTek processors are in danger due to their payment system.

And as the researchers at checkpointhave found security problems in the payment system present in these phones that provide a trusted execution environment (TEE) responsible for signing transactions.

With this the hackers could exploit these weaknesses to sign fake payment packages when using an unprivileged third-party application.

The researchers explain that the affected Xiaomi phones use the “Kinibi” TEE architecture, which creates a virtual enclave to store the security keys needed to sign these types of transactions.

They say that it is designed to run trusted applications such as Xiaomi’s “thhadmin” which is responsible for security management within the integrated mobile payment framework called ‘Tencent Soter’.

However, apps like WeChat and Alipay rely on Tencent Soter to securely verify these payment packages.

this opens the door to a degradation attackwhere a malicious actor could replace a newer, more secure app with an older, more vulnerable version.

The researchers were able to use another vulnerability in Tencent Soter that allows an attacker to extract private keys and sign fake payment packages in the context of an unprivileged user.

They recommend that if you have a Xiaomi device based on Mediatek you must apply all security updates from June 2022.

It is recommended that you disable mobile payments completely until the update comes in the next week or at least minimize the number of apps installed on the device.

About the author


Leave a Comment