Near-Field Communications and Mobile Payment Services
Summary
PDF p.275Near-field communication (NFC) is a type of radio frequency ID (RFID) technology used in smartphones for various functions, including reading RFID tags, pairing devices, and making contactless payments. While convenient, NFC has security vulnerabilities such as eavesdropping and data corruption.
In plain words
Supplementary — not from your PDFNFC is a very short-range form of RFID used for reading tags, pairing devices, sharing information and contactless payments. NFC itself doesn't encrypt, so apps must, or eavesdropping is possible. Other risks include malicious tags directing phones to bad sites, skimming in crowds, and data corruption through RF interference. Mobile wallets such as Apple Pay and Google Pay send a one-time token instead of the real card number, which limits the damage if a transaction is intercepted.
Detailed explanation
PDF p.275-
NFC Functions
- Reading RFID Tags: Used for applications like "smart" posters.
- Pairing Devices: Configures connections like Bluetooth.
- Information Exchange: Shares contact cards and other data.
-
Security Concerns
- Vulnerabilities: Exploits in handling tags can direct devices to malicious webpages.
- Lack of Encryption: Allows eavesdropping and on-path attacks if data is not encrypted by software services.
Mobile Payment Services
Mobile Wallet Apps
- Function: Use NFC for contactless payments at point-of-sale (PoS) machines.
- Configuration: Users enter credit card information into a mobile wallet app.
- One-Time Token: Wallet app transmits a token instead of the actual credit card information.
- Major Apps: Apple Pay, Google Pay, Samsung Pay.
NFC Attack Types
- Eavesdropping: Certain antenna configurations can pick up NFC signals from a distance.
- Skimming: Attackers can skim information from NFC devices in crowded areas.
- Data Corruption: Similar to a DoS attack, flooding the area with RF signals to interrupt data transfer.
Important terms
taken from the text above- Reading RFID Tags
- Used for applications like "smart" posters.
- Pairing Devices
- Configures connections like Bluetooth.
- Information Exchange
- Shares contact cards and other data.
- Lack of Encryption
- Allows eavesdropping and on-path attacks if data is not encrypted by software services.
- One-Time Token
- Wallet app transmits a token instead of the actual credit card information.
- Major Apps
- Apple Pay, Google Pay, Samsung Pay.
- Eavesdropping
- Certain antenna configurations can pick up NFC signals from a distance.
- Skimming
- Attackers can skim information from NFC devices in crowded areas.
- Data Corruption
- Similar to a DoS attack, flooding the area with RF signals to interrupt data transfer.
Examples & real-world scenarios
Supplementary — not from your PDF- Paying with a phone wallet that sends a one-time token.
- An NFC tag on a poster opening a website.
- Turning NFC off when not in use.
Scenario
A user taps a phone on a tampered 'smart poster' and is taken to a fake login page. User awareness, and prompts before opening links from tags, reduce the risk.
Common mistakes
Supplementary — not from your PDF- Assuming NFC encrypts data by itself.
- Thinking mobile wallets send the real card number to the terminal.
Practical skills
Supplementary — not from your PDF- Explain why tokenization protects mobile payments.
What I should remember
Key Points PDF p.275-
NFC Functions
- Reading Tags: For applications like smart posters.
- Pairing Devices: Configures Bluetooth and other connections.
- Information Exchange: Shares data like contact cards.
-
Security Concerns
- Vulnerabilities: Handling tags and lack of encryption.
- Eavesdropping and Skimming: Risks from antenna configurations and crowded areas.
-
Mobile Wallet Apps
- Payment Services: Use NFC for contactless payments.
- One-Time Token: Ensures secure transactions.
- Major Apps: Apple Pay, Google Pay, Samsung Pay.