Authors
“Tarjeta BIP!” is the electronic payment system used in Chile to pay for public transportation via NFC incorporated in the user’s smartphone. Numerous projects enabling mobile NFC ticketing for public transportation have been already executed worldwide. This is a trend. It means that criminal minds should be interested in it. Moreover, they are.
More and more people keep talking about the feature of payments via NFC. The problem in this particular case is that somebody reversed the “Tarjeta BIP!” cards and found a means to re-charge them for free. So, on Oct. 16 the very first widely-available app for Android appeared, allowing users to load these transportation cards with 10k Chilean pesos, a sum equal to approximately $17 USD.
|
1 |
MD5 (PuntoBIP.apk) = 06a676fd9b104fd12a25ee5bd1874176 |
Immediately after appearing on the Internet, many users downloaded it and proved they were able to recharge their travel cards. All they had to do is to install the mentioned app on a NFC capable Android device, to approach the travel card to the phone and then to push the button “Cargar 10k”, which means “Refill the card with 10,000” Chilean pesos.
According to the metadata of the .dex file package, it was compiled on October 16, 2014 and it has 884.5 kB (884491 Byte) size. The feature it incorporates interacts directly with the NFC port: android.hardware.nfc
The app has four main features: “número BIP” – to get the number of the card, “saldo BIP” – to get the available balance, “Data carga” – to refill available balance and finally, maybe the most interesting is “cambiar número BIP” – allowing the user to change the card number altogether. Why would we say this last feature is the most interesting? Well, a source suggested the authorities were going to block fraudulently refilled BIP cards. However, as we can see, the app is able to change the BIP number.
Since the original links to download the app were taken down, new links appeared, now pointing to new servers and actually hosting a new app:
|
1 |
MD5 (PuntoBIP-Reloaded.apk) = 2c20d1823699ae9600dad9cd59e03021 |
This is a modified version of the previous app, compiled on the next business day Oct 17, 2014 and which is a lot bigger 2.7 MB (2711229 Byte). This includes an advertisement module which shows ads via the doubleclick network.
Since both apps allow users to hack a legitimate application, they are now detected by Kaspersky as HEUR:HackTool.AndroidOS.Stip.a
Since the app is a hot one and a lot of people from Chile are looking for it, I expect some bad guys to come along and create fake similar apps but trojanized to infect mobile users and take some advantage of their interest.
At the same time, it is important to mention that mobile payments are getting more and more popular. NFC is one of the most promising ports in this field. This is a good example of how fresh new payment schemes often present the same old problems.
Thanks to Roman Unuchek for his analytical insights.
You may follow me on twitter: @dimitribest
Authors
Android NFC hack allow users to have free rides in public transportation
From the same authors
In the same category
Alejandro
Just a small correction. Tarjeta bip! Is, as the name says it, a card (tarjeta = card). There is no integration with mobile phones in the bip! Network. The app just refills the card, which you later use to validate on the subway or bus.
The Chilean Govt has blocked near 10 thousand cards so far.
Zerial
Alejandro : more than 19.000 cards blocked
Danish Jafri
In public transport such frauds can work for a day or two. these days its very easy to catch reload transactions if happened from an unknown device e.g. a mobile phone like happened in this case. So for a fraudulent its a benefit of few bugs.
Anyways interesting article and interesting fraud…