Summary of Apple Pay security strengths and weaknesses

Keeping credit card numbers out of the transaction process can help consumers alleviate and mitigate the risks of various data breaches, but this does not mean that criminals will give up the idea of ​​stealing digital assets.

The picture shows an iPhone 6 making an NFC payment using the Apple Pay function.

Apple Pay is now officially online and operational. As an ordinary consumer, I am inexplicably excited about it, but I am also concerned about its security, just like those who work in security affairs. In order to dispel my own doubts and those of my readers, let's consider Apple Pay from various angles - both from the perspective of consumers and from the perspective of security experts.

When I was considering buying an iPhone 6, Apple Pay was the feature that stood out to me. Apple Pay only works (in impressively seamless fashion) on the iPhone 6 and 6 Plus. It also works on the iPhone 5 series, but that requires you to use the older phone with the upcoming Apple Watch. It can also be used to make in-app purchases on some iPad models. But for now, the only way to fully experience the Apple Pay experience is to buy and use a recent iPhone. Here's how it works. You register your supported credit card in the Passbook app on your device. When you want to buy something at a retail store that supports Apple Pay, you point your mobile device at the store's near-field communication (NFC) payment terminal, and your payment information is transmitted from your iPhone to the payment terminal via a wireless radio frequency connection. Next, you scan your fingerprint using the TouchID sensor on your phone to confirm your identity and complete the purchase. If everything goes well, your phone will verify that your fingerprint matches and notify you that the transaction has been approved. Although it sounds complicated, it actually takes only one step and is quite smooth. Please note that you may still need to take additional payment steps, such as signing a receipt, depending on the specific requirements of the merchant and the actual amount of the goods purchased.

From a consumer's perspective, it's all so simple and innocent. The only relatively troublesome part is to confirm that the merchant can support this payment technology. For now, the overall proportion of merchants that accept Apple Pay is still relatively small, and the decision of some retail stores to finally abandon the Apple Pay plan has attracted a lot of media attention. But if we are lucky, this situation will gradually improve over time, and more merchants and card issuers will sign relevant support agreements, and we will usher in a wider range of applicable environments.

So, is the NFC payment wave launched by Apple Pay safe or not? Let's start with the positive side. The key is that merchants can no longer obtain our actual credit card account number; all they can actually see is the consumer's credit card's "device account number" (DAN), which is (most likely) a one-time account number. In the field of transaction payment, the DAN acts as a token, and each device can obtain its own unique DAN through calculation. During the transaction process, the DAN will be combined with a one-time transaction ID, ensuring that it is difficult for attackers to forge our DAN by reusing it or transferring it to other devices.

In addition, if the security information of the relevant retailers that we have used Apple Pay for transactions is leaked, our card-issuing bank should be able to provide us with a new DAN information without changing the account number. This new processing method is obviously more perfect than the credit card mechanism currently widely used in the United States, but I personally hope that these DAN information can be one-time and have random and dynamic generation characteristics, that is, using a high-strength random password source like the built-in encryption hardware of the iPhone. Perhaps all this will become a reality in the next version of Apple Pay.

But while I've done my best to pick out some security factors that could be improved with Apple Pay, it's already much better than what's currently available. Even the much-hyped Europay Mastercard Visa (EMV) system doesn't completely prevent consumers from giving their credit card numbers to merchants. Most EMV cards still have magnetic stripes that contain your account information, so there's still a chance that payment terminals can read your account numbers from those EMV smart chips. And as we learned from last year's Target breach, the payment terminals themselves can be tampered with, making them a great jumping-off point for thieves looking to steal your account data.

Therefore, although I am already using Apple Pay from a consumer's perspective, from the perspective of a security expert, I must admit that there are still many factors that may lead to potential risks. If ordinary consumers and merchants intend to migrate their payment platforms to Apple Pay or other systems that also use the DAN mechanism to ensure transaction security, perhaps for a long time in the future we will still need to deal with and fight against the big data leaks that Target and Home Depot have encountered, and eventually move towards a more secure asset protection track. But does this mean that criminals who are waiting for an opportunity to steal property will retreat or even give up? The answer is of course no.

If payment terminals eventually no longer need access to real account data, they will no longer be viable targets. In this case, our adversaries will directly focus on the next weak link in the transaction chain - most likely the mobile device itself. With this in mind, I looked up the recent Masque attack on iOS devices and it piqued my interest. The fact that the Masque attack was exposed so soon after the launch of Apple Pay seems to be a pure coincidence, but it is enough to remind us not to be foolish enough to introduce this kind of financial malware to our devices.

In fact, currency transactions are now widely accepted on the iOS platform, so it is natural to imagine that iOS will face a greater number of potential threats than other mobile platforms in the future.

But does this mean that we should completely stay away from services like Apple Pay? This is a matter of opinion, and I believe everyone will give their own answer, but I personally still welcome this kind of technology and hope that one day it will allow me to go out without carrying a credit card - at least getting rid of the bulging wallet will make me feel happy.

Original link: http://www.computerworld.com/article/2849680/security0/apple-pay-s-security-pros-and-cons.html

Nuka-Cola Translation