STK IMPLEMENTATION IN SMS BANKING IN M-PESA -KENYA, EXPLOITS AND FEASIBLE SOLUTIONS Doreen Nyaketcho, Dale Lindskog, Ron Ruhl Information Systems Security, Concordia University College of Alberta, Edmonton, Canada
[email protected], {dale.lindskog, ron.ruhl}@concordia.ab.ca Abstract – STK is used in Kenya to facilitate SMS M-Pesa is a mobile banking service developed to Banking using primarily GSM phones for transmission allow Kenyans to transfer money via SMS using the of the SMS messages. While providing a valuable Subscriber Identity Module (SIM) card in their cell banking solution it is not without security risk, some of phone. It does not require users to have a bank which has been exploited. This paper will describe the account, it provides easy and convenient banking underlying architecture of Kenyan STK based M-Pesa services, and M-Pesa is used by over 50% of Kenya`s banking, various vulnerabilities will be discussed and adult population, including those without bank methods suggested to overcome them. accounts [1]. It functions as an electronic wallet that Keywords: STK, SIM Tool Kit, M-Pesa, SMS Banking, holds up to a maximum of 100,000 Kenyan shillings GSM. (approximately $1,200 USD), from which users can I. INTRODUCTION buy digital funds from an M-Pesa agent and transfer the funds via SMS to other mobile phone users, who Mobile Banking, also known as m-banking or SMS in turn redeem it for conventional cash from any banking, is a term used to refer to various banking agent [2]. related tasks performed via mobile devices, such as balance checks, account transactions, or payments.