Samsung Pay: Tokenized Numbers Flaws and Issues
summary
Samsung Pay’s tokenization leaks practical attack surface: MST magnetic transmissions can be captured and replayed with cheap hardware — MST capture via Raspberry Pi Zero + CR card reader — then replayed with a MaxSpoof-style emulator to complete real purchases (demonstrated on a vending terminal and cross-border in Mexico). Offline “provision” tokens keep a constant middle counter so tokens generated in airplane mode are reusable until sync — provision token counter stays constant in offline mode — and on-device databases use static encryption keys and near-duplicate virtual cards after re-enrollment.
AI-written summary · about
chapters (8)
- 0:00Start
- 1:28Terminology
- 2:08Analyzing Tokenized Numbers (Token)
- 4:17Offline mode
- 5:10Files Structure
- 6:29Flaws and Issues
- 8:37Attacks
- 14:28Black Hat Sound Bytes
related talks
01h 02mHow Samsung Secures Your Wallet and How To Break It
23mAll Your Payment Tokens Are Mine: Vulnerabilities of Mobile Payment Systems
24mPicking Up My Tab...
06mHuman-in-the-Loop for Secure Digital Wallets Transactions
23mPoint of Sale System Architecture and Security
59mHow Smartcard Payment Systems Fail
35mEveryone can see your credit card details
38mMission mPOSsible