Security News > 2022 > August > Xiaomi Phone Bug Allowed Payment Forgery

Smartphone maker Xiaomi, the world's number three phone maker behind Apple and Samsung, reported it has patched a high-severity flaw in its "Trusted environment" used to store payment data that opened some of its handsets to attack.

Researchers at Check Point Research revealed last week in a report released at DEF CON that the Xiaomi smartphone flaw could have allowed hackers to hijack the mobile payment system and disable it or create and sign their own forged transactions.

"We discovered a set of vulnerabilities that could allow forging of payment packages or disabling the payment system directly, from an unprivileged Android application. We were able to hack into WeChat Pay and implemented a fully worked proof of concept," wrote Slava Makkaveev, security researcher with Check Point.

The core issue with Xiaomi phone was the mobile phones payment method and the Trusted Execution Environment component of the phone.

"Left unpatched, an attacker could steal private keys used to sign WeChat Pay control and payment packages. Worst case, an unprivileged Android app could have created and signed a fake payment package," researchers wrote.

"The Asian market," the researchers noted, is "Mainly represented by smartphones based on MediaTek chips." Xiaomi phones that run on MediaTek chips use a TEE architecture called "Kinibi," within which Xiaomi can embed and sign their own trusted applications.

News URL

https://threatpost.com/xiaomi-phones-found-vulnerable-to-payment-forgery/180416/