Xiaomi Mobile Payment Vulnerability

Vulnerabilities in Xiaomi’s mobile payment could lead to an attacker stealing private keys used to sign Wechat Pay control and payment packages.

The flaws were found in Xiaomi’s trusted execution environment (TEE), the system element responsible for storing and managing sensitive information such as keys and passwords.

The devices were powered by MediaTek chips and were found to be susceptible to two different kinds of attacks targeting the vulnerability.

The first one was from an unprivileged malicious Android app, installed and launched by a user. In this case, the app would be able to extract the keys and send a fake payment packet to steal the money.

The second attack method involved the physical possession of the device by the attacker. In this case, they could root the device, downgrade the trust environment, and then run the code to create a fake payment package without an application.

Researchers disclosed the vulnerabilities to Xiaomi, and the phone manufacturer acknowledged and promptly patched them.

Researchers from checkpoint research have documented this vulnerability.