Social News XYZ     

Xiaomi fixes bugs in its mobile payment mechanism

Xiaomi fixes bugs in its mobile payment mechanism

New Delhi, Aug 12 (SocialNews.XYZ) Global smartphone player Xiaomi has fixed some bugs that were identified in its mobile payment mechanism by cyber security researchers, Check Point Research (CPR) said on Friday.

Left unpatched, an attacker could steal private keys used to sign Wechat Pay control and payment packages, and an unprivileged Android app could have created and signed a fake payment package.


The cyber-security researchers disclosed its findings to Xiaomi, which acknowledged and issued immediate fixes for the bugs.

"We discovered a set of vulnerabilities that could allow forging of payment packages or disabling the payment system directly, from an unprivileged Android application," said Slava Makkaveev, security researcher at Check Point.

Over 1 billion users could have been affected by the bugs, if left unpatched.

"We were able to hack into WeChat Pay and implemented a fully worked proof of concept. Our study marks the first time Xiaomi's trusted applications are being reviewed for security issues," Makkaveev added.

The cyber-security company immediately disclosed the findings to Xiaomi, which "worked swiftly to issue a fix".

The devices studied by CPR were powered by MediaTek chips.

The team detailed two ways to attack the trusted code.

"First, from an unprivileged Android app, where the user installs a malicious application and launches it. The app extracts the keys and sends a fake payment packet to steal the money," said the CPR team.

Second, if the attacker has the target devices in their hands.

"The attacker roots the device, then downgrades the trust environment, and then runs the code to create a fake payment package without an application," it added.

Source: IANS

Facebook Comments
Xiaomi fixes bugs in its mobile payment mechanism

About Gopi

Gopi Adusumilli is a Programmer. He is the editor of SocialNews.XYZ and President of AGK Fire Inc.

He enjoys designing websites, developing mobile applications and publishing news articles on current events from various authenticated news sources.

When it comes to writing he likes to write about current world politics and Indian Movies. His future plans include developing SocialNews.XYZ into a News website that has no bias or judgment towards any.

He can be reached at

%d bloggers like this: