Secret State Leakage Attacks and Their Impacts on EMV Contactless Payment Apps

This paper analyzes the security of EMV contactless mobile payment (ECM) apps, virtualization of physical EMV chip cards, in a less explored but relevant threat model. In this threat model, a local adversary such as the legitimate ECM app user (possibly, with root privileges) launches attacks to expose the EMV protocol's internal secret states from the app. Such secret leakage combined with the attacker's capability to modify the ECM app behavior can be exploitable for potentially self-serving purposes (e.g., double-spending). To formally study such secret state leakage attacks (SecStLeak) and their impacts, we pose the minimal satisfying cut-set identification problem for the EMV contactless protocol design where the goal is identifying the minimal number of the protocol's secret state fields whose leakage can entail different attacks. We solve this problem by proposing a meta-level protocol analysis approach. Our analysis identified 4 minimal sets of secret state fields that ECM app developers must protect to prevent such attacks. We analyzed 136 Android ECM apps and identified all secret fields for 2 of the 4 minimal sets across 24 apps. In addition, one can leak a third minimal set in 3 of the 24 apps. The potential impact is significant, with these 24 apps having 82 M downloads, 6 coming from developing countries, and 3 operating in a country without support for Google Wallet. To establish our findings' real-world applicability, we demonstrate a core guarantee-violating end-to-end attack on a real ECM app in an isolated test environment. This successful exploitation motivated us to study how developers in the real world protect the secret state fields belonging to the 4 minimal sets to thwart SecStLeak attacks. We observe that a majority of these apps, contrary to EMV standard's recommendation, rely on circumventable, sub-optimal software-only defenses.