Samsung both denies and admits mobile payment vulnerability

Samsung said that reports of a vulnerability in Samsung Pay mobile payments were "simply not true" -- but also admitted that token skimming was, in fact, possible but difficult enough that the potential risk was acceptable

Security researcher Salvador Mendoza demonstrated a flaw in Samsung Pay at Black Hat last week, in which the tokens used to secure transactions could be predicted, and used to authorize fraudulent payments.

Samsung responded with a statement calling the report "simply not true."

"Samsung Pay is safe, secure and consumers can be assured that there is no known risk associated to using our payment service," the company said.

But then, in a separate, more detailed document, Samsung admitted that it is possible to capture a token, but said that it was extremely difficult to do so.

[ MISSED THE SHOW: Catch up on all that happened at Black Hat ]

"This skimming attack model has been a known issue reviewed by the card networks and Samsung Pay and our partners deemed this potential risk acceptable given the extremely low likelihood of a successful token relay attack," Samsung said.

The company did not respond to a request for additional information.

Mendoza posted a follow-up video on Tuesday, again demonstrating the vulnerability.

"I made this video without cutting or editing nothing from it making a transaction using MagSpoof," he said in a note posted along with the video. MagSpoof is an open-source application that lets users spoof magnetic stripe codes. "According to Samsung statement this transaction had to be declined. But it went through."

"They are not addressing the main problem," Mendoza told CSO Online.

In particular, the fact that an attack is difficult is not a particular barrier in a world where criminals routinely package and sell ready-to-go exploits to one another.

"An attacker has to prepare a complete scenario to be successful," he said. "But that does not mean that it is complex or expensive. Basically, each tool that I made costs around $50. So many people with computer science knowledge could make something similar."

He added that he notified Samsung about the issue in May, and the company asked him for more details about the vulnerability.

"The communication was fluent and adequate," he said. "After many emails, I sent my presentation a couple of weeks before Black Hat. But after that, they did not respond any more related to the issues."

Jonathan Sander, vice president of product strategy at Lieberman Software

"I've seen Mendoza's research, and watched the videos, and it seems like he's got a pretty airtight case, that's for sure," said security expert Jonathan Sander, vice president of product strategy at Lieberman Software.

The main problem seems to be that the tokens generated by Samsung Pay are, to some degree, sequential, making it possible to predict future tokens.

"I feel empathy for Samsung," he added. "Clearly they have done a lot to wrap this in secure layers. They might have committed an error along the way, the sequential thing, but they clearly took a lot of effort to protect it with many layers of protection and authentication. What this shows is that Samsung is like every other company on Earth, which is fallible."

The initial reaction to downplay the vulnerability is a typical public relations move, he added.

"You get some kind of breach, you get the first carpet-bomb marketing reply, and a week later a more detailed reply with a mea culpa and some sort of fix," he said. "Essentially, they're stalling for time, while they figure out how to fix this vulnerability."

He added that Samsung may be under additional pressure because of its low market share in the mobile payments space.

In late July, Apple announced that its Apple Pay platform accounts for three quarter of all contactless payment transactions, leaving just 25 percent for Samsung Pay and Google's Android Pay.

RELATED VIDEO:

Join the PC World newsletter!

Error: Please check your email address.

Tags samsungblack hat

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Maria Korolov

CSO (US)
Show Comments

Essentials

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?