Picking Up My Tab: Understanding and Mitigating Synchronized Token Lifting and Spending in Mobile Payment Xiaolong Bai1;∗, Zhe Zhou2;3;∗, XiaoFeng Wang3, Zhou Li4, Xianghang Mi3, Nan Zhang3, Tongxin Li5, Shi-Min Hu1, Kehuan Zhang2;y 1Tsinghua University, 2The Chinese University of Hong Kong, 3Indiana University Bloomington, 4IEEE Member, 5Peking University
[email protected], {zz113, khzhang}@ie.cuhk.edu.hk, {xw7, xmi, nz3}@indiana.edu,
[email protected],
[email protected],
[email protected] Abstract ning of QR code printed on the POS terminal. When combined with a short valid period, POSAUTH can en- Mobile off-line payment enables purchase over the sure that tokens generated for one transaction can only be counter even in the absence of reliable network connec- used in that transaction. tions. Popular solutions proposed by leading payment service providers (e.g., Google, Amazon, Samsung, Ap- ple) rely on direct communication between the payer’s 1 Introduction device and the POS system, through Near-Field Com- The pervasiveness of mobile devices has profoundly munication (NFC), Magnetic Secure Transaction (MST), changed the ways commercial activities are conducted. audio and QR code. Although pre-cautions have been Particularly, mobile payment, in which a payment trans- taken to protect the payment transactions through these action is carried out between a smartphone and a point of channels, their security implications are less understood, sale (POS) system, becomes increasingly popular, with particularly in the presence of unique threats to this new over 1 trillion dollars revenue projected for 2019 [49]. e-commerce service. Leading e-commerce providers (e.g., PayPal, Amazon, In the paper, we report a new type of over-the-counter Google, Alibaba) and smartphone manufacturers (e.g., payment frauds on mobile off-line payment, which exploit Samsung, Apple) all come up with their own solutions the designs of existing schemes that apparently fail to and competing with each other for market shares.