Check Point Research (CPR) has found vulnerabilities that allow forging payments and disabling the payment system directly from an unprivileged Android application. CPR shared all findings responsibly with Xiaomi. The manufacturer was able to confirm the vulnerabilities and, based on the resulting collaboration, eliminate the threat.

The interest of hackers in gaining access or even control over virtual payment channels is correspondingly great!

According to the latest statistics, the Far East and China accounted for two-thirds of global mobile payments in 2021. That's roughly equivalent to $4 billion in mobile wallet transactions. Hackers are therefore very interested in gaining access or even control over virtual payment channels.

Xiaomi can embed and sign its own trusted applications.

CPR discovered that attackers can transfer an old version of a trusted application to the device and use it to overwrite the new app file. This allows an attacker to bypass security fixes made by Xiaomi or MediaTek in trusted applications by downgrading them to unpatched versions. The researchers discovered several vulnerabilities in the trustworthy app “thhadmin”, which is responsible for security management. These vulnerabilities could be exploited to obtain stored keys or execute code in the context of the app to perform malicious actions.

The vulnerability was patched by Xiaomi in June 2022 after it was disclosed.

In addition, researchers were able to determine how the downgrade vulnerability in Xiaomi's TEE could allow the old version of the Wechat app to steal private keys. This presented reading vulnerability was also patched by Xiaomi after disclosure and cooperation. The downgrade issue confirmed by Xiaomi and belonging to a third party will be resolved soon.

Source: Check Point Software Technologies Ltd.

Also read:
Not a fake: The beach picture of the explosion in Crimea


If you enjoyed this post and value the importance of well-founded information, become part of the exclusive Mimikama Club! Support our work and help us promote awareness and combat misinformation. As a club member you receive:

📬 Special Weekly Newsletter: Get exclusive content straight to your inbox.
🎥 Exclusive video* “Fact Checker Basic Course”: Learn from Andre Wolf how to recognize and combat misinformation.
📅 Early access to in-depth articles and fact checks: always be one step ahead.
📄 Bonus articles, just for you: Discover content you won't find anywhere else.
📝 Participation in webinars and workshops : Join us live or watch the recordings.
✔️ Quality exchange: Discuss safely in our comment function without trolls and bots.

Join us and become part of a community that stands for truth and clarity. Together we can make the world a little better!

* In this special course, Andre Wolf will teach you how to recognize and effectively combat misinformation. After completing the video, you have the opportunity to join our research team and actively participate in the education - an opportunity that is exclusively reserved for our club members!


Notes:
1) This content reflects the current state of affairs at the time of publication. The reproduction of individual images, screenshots, embeds or video sequences serves to discuss the topic. 2) Individual contributions were created through the use of machine assistance and were carefully checked by the Mimikama editorial team before publication. ( Reason )