Android malware steals payment card data using previously unseen technique

Reverendender , 5 hours ago

Newly discovered Android malware steals payment card data using an infected device’s NFC reader and relays it to attackers, a novel technique that effectively clones the card so it can be used at ATMs or point-of-sale terminals, security firm ESET said.

ESET researchers have named the malware NGate because it incorporates NFCGate, an open source tool for capturing, analyzing, or altering NFC traffic. Short for Near-Field Communication, NFC is a protocol that allows two devices to wirelessly communicate over short distances.

lemmyvore , 5 hours ago

For those confused about how this could work with chip cards, the malware has two components, one installed on the victims phone and one on the attacker’s. The attacker initiates the contactless authentication at an ATM or contactless payment and their phone communicates in real time with the victim’s, which is tricked by the malware into reacting to that event and producing the one time token which is then relayed to the attacker and used.

They also previously social-engineered the card PIN from the victim, in case the contactless event requires it (definitely in case of ATM login).

The fact you can trick the NFC system on the phone into reacting to “phantom” payment events and intercept the resulting token sounds like a pretty big problem. The former should be entirely hardware controlled, and the latter should not allow the token to go anywhere else except to the hardware.

Lojcs , 4 hours ago

The fact you can trick the NFC system on the phone into reacting to “phantom” payment events and intercept the resulting token sounds like a pretty big problem.

That’s not what’s happening though? It’s relaying a physical card’s nfc not tricking mobile contactless payments