Attacker then emulates the card and makes withdrawals or payments from victim’s account.
There is nothing being subverted, nfc has applications other than contactless payments that require it acting as the reader, which is why it’s supported. It would be better if it was behind an explicit permission (just like other sensors would) but limiting it to only responding to readers is like limiting Bluetooth to audio transmission.
This isn’t about subscribing to NFC events, the malware is creating fake NFC events without the NFC sensor being involved in a physical interaction with a tag or reader.
No? The nfc sensor is next to the credit card, which is why it’s able to communicate with it to relay it.
Why would it need to create fake events? How would that even help?
There’s no credit card involved in this scenario.
- The attacker uses phone A and touches the ATM NFC reader. This creates a NFC event on phone A that requests a token.
- Phone A sensds the request data to the malware running on victim’s Phone V.
- The malware on phone V creates a fake NFC event that makes it look like the phone V was touched against the ATM. <-- this is the huge security issue IMO
- The app on phone V that’s currently associated with NFC contactless payments responds to the fake NFC event by issuing a token.
- The malware on Phone V sends the token to phone A.
- Phone A uses the token to “prove” to the ATM that the real customer is in front of it.
- The ATM asks for the PIN and the attacker supplies the correct PIN (which they’ve previously obtained via social engineering).
- Attacker can now withdraw cash from the ATM from the victim’s account.
