Security Analysis of Unified Payments Interface and Payment Apps in India
Security Analysis of Unified Payments Interface and Payment Apps in India Renuka Kumar1, Sreesh Kishore , Hao Lu1, and Atul Prakash1 1University of Michigan Abstract significant enabler. Currently, there are about 88 UPI payment apps and over 140 banks that enable transactions with those Since 2016, with a strong push from the Government of India, apps via UPI [40,41]. This paper focuses on vulnerabilities smartphone-based payment apps have become mainstream, in the design of UPI and UPI’s usage by payment apps. with over $50 billion transacted through these apps in 2018. We note that hackers are highly motivated when it comes to Many of these apps use a common infrastructure introduced money, so uncovering any design vulnerabilities in payment by the Indian government, called the Unified Payments In- systems and addressing them is crucial. For instance, a recent terface (UPI), but there has been no security analysis of this survey states a 37% increase in financial fraud and identity critical piece of infrastructure that supports money transfers. theft in 2019 in India [12]. Social engineering attacks to This paper uses a principled methodology to do a detailed extract sensitive information such as one-time passcodes and security analysis of the UPI protocol by reverse-engineering bank account numbers are common [17, 23, 34, 57, 58]. the design of this protocol through seven popular UPI apps. Payment apps, including Indian payment apps, have been We discover previously-unreported multi-factor authentica- analyzed before, with vulnerabilities discovered [9,48], and tion design-level flaws in the UPI 1.0 specification that can an Indian mobile banking service was found to have PIN lead to significant attacks when combined with an installed recovery flaws [47].
[Show full text]