Security analysis of smartphone point-of-sale systems

6th USENIX Workshop on Offensive Technologies, WOOT 2012

Volumn , Issue , 2012, Pages

  Frisby, WesLee ^a   Moench, Benjamin ^a   Recht, Benjamin ^a   Ristenpart, Thomas ^a  

^a UNIVERSITY OF WISCONSIN MADISON   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

APPLICATION PROGRAMS; AUDIO SYSTEMS; CRYPTOGRAPHY; ELECTRONIC COMMERCE; FIRMWARE; SMARTPHONES;

CARDHOLDER DATA; CRYPTOGRAPHIC KEY; MAGNETIC STRIPES; PAYMENT CARD; POINT OF SALE; POINT-OF-SALE SYSTEMS; SECURITY ANALYSIS; SOFTWARE APPLICATIONS;

MOBILE SECURITY;

EID: 85084162004     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (32)

1. bcrypt, 2002. http://bcrypt.sourceforge.net/.
2. PCI Data Security Standard v 2.0, 2010. https://www.pcisecuritystandards.org/security_standards/documents.php.
3. An Open Letter to the Industry and Consumers, 2011. www.sq-skim.com.
4. Java cryptography architecture reference guide, 2011. http://docs.oracle.com/javase/6/docs/technotes/guides/security/crypto/ CryptoSpec.html#PBEEx.
5. Android javax.crypto API, 2012. http://developer.android.com/reference/ javax/crypto/package-summary.html.
6. Apple App Store, 2012. http://www.apple.com/itunes.
7. Chip and PIN, 2012. Homepage: http://www.chipandpin.co.uk/.
8. Google Play, 2012. https://play.google.com/store.
9. NFC Forum, 2012. http://www.nfc-forum.org/.
10. RFID, 2012. Homepage: http://www.rfid.org/.
11. ANSI X9.24-1992. Financial Services Retail Key Management, 1992.
12. T. Armstrong. Stealing apps, installing ads, 2011. http://www.securelist.com/en/blog/208193251/Stealing_apps_installing_ads.
13. L. Cai and H. Chen. TouchLogger: inferring keystrokes on touch screen from smartphone motion. In Proceedings of the 6th USENIX conference on Hot topics in security (Hot-Sec’11). USENIX Association, Berkeley, CA, USA, pages 9–9, 2011.
14. W. Enck, P. Gilbert, B. Chun, L. Cox, J. Jung, P. McDaniel, and A. Sheth. Taintdroid: an information-flow tracking system for realtime privacy monitoring on smartphones. In Proceedings of the 9th USENIX conference on Operating systems design and implementation, pages 1–6. USENIX Association, 2010.
15. A. Felt, M. Finifter, E. Chin, S. Hanna, and D. Wagner. A survey of mobile malware in the wild. In Proceedings of the 1st ACM workshop on Security and privacy in smartphones and mobile devices, pages 3–14. ACM, 2011.
16. M. Fossi. Symantec report on the underground economy, 2008. Symantec Corporation.
17. F. Hechler. Encrypt/decrypt strings, 2009. http://www.androidsnippets.com/ encryptdecrypt-strings.
18. X. Jiang. GingerMaster: First Android Malware Utilizing a Root Exploit on Android 2.3 (Gingerbread), 2011. http://www.csc.ncsu.edu/faculty/jiang/GingerMaster.
19. X. Jiang. Security Alert: New Android SMS Trojan – YZHCSMS – Found in Official Android Market and Alternative Markets, 2011. http://www.csc.ncsu.edu/faculty/jiang/YZHCSMS/.
20. X. Jiang. Security Alert: New Stealthy Android Spyware – Plankton – Found in Official Android Market, 2011. http://www.csc.ncsu.edu/faculty/jiang/Plankton/.
21. X. Jiang. Security Alert: New RootSmart Android Malware Utilizes the GingerBreak Root Exploit, 2012. http://www.csc.ncsu.edu/faculty/jiang/RootSmart.
22. Kevin McCallum. Losses mount from skimming scam at Lucky store in Petaluma, 2011. http://www.pressdemocrat.com/article/20111205/ARTICLES/111209763/1350?Title= Losses-mount-from-skimming-scam-at -Lucky-store-in-Petaluma.
23. M. Meriac and H. Plötz. Analyzing a modern cryptographic RFID system, 2010. Presentation at the 27th Chaos Computer Congress.
24. National Institute of Standards and Technology. FIPS PUB 46-3: Data Encryption Standard (DES). Oct. 1999. supersedes FIPS 46-2.
25. R. Wang and S. Chen and X. Wang and S. Qadeer. How to Shop for Free Online – Security Analysis of Cashier-as-a-Service Based Web Stores. In Proceedings of the 32nd IEEE Symposium on Security and Privacy, 2011.
26. Rui Wang and Shuo Chen and XiaoFeng Wang. Signing Me onto Your Accounts through Face-book and Google: a Traffic-Guided Security Study of Commercially Deployed Single-Sign-On Web Services. In Proceedings of the 33rd IEEE Symposium on Security and Privacy, 2012.
27. G. Shah, A. Molina, and M. Blaze. Keyboards and covert channels. In Proceedings of the 15th conference on USENIX Security Symposium, volume 15, 2006.
28. Smart Card Alliance. Card Payments Roadmap in the United States: How Will EMV Impact the Future Payments Infrastructure?, 2011. http://www.smartcardalliance.org/resources/pdf/Payments_Roadmap_in_the_ US_020111.pdf.
29. T. Vidas, D. Votipka, and N. Christin. All your droid are belong to us: A survey of current android attacks. In Proceedings of the 5th USENIX conference on Offensive technologies, pages 10–10. USENIX Association, 2011.
30. Waterloo Region Record. Police warn against newest scam, 2009. http://www.sparkfun.com/tutorial/news/SparkFun-PINScam.pdf.
31. J. Winters. Credit card skimmers discovered inside local gasoline pumps, 2012. http://www.times-herald.com/Local/ Credit-card-skimmers-discovered-in -gasoline-pumps-2119062.
32. W. Zhou, Y. Zhou, X. Jiang, and P. Ning. Detecting repackaged smartphone applications in third-party android marketplaces. In Proceedings of 2nd ACM Conference on Data and Application Security and Privacy (CODASPY 2012), 2012.