Security countermeasures

The NFC Wallet SDK includes countermeasures for common mobile threats.

This page lists the runtime security countermeasures built into the NFC Wallet SDK.

Coverage by flow

SDK initialization and provisioning

Provisioning includes wallet secure enrollment and Tokenization.

During SDK initialization and provisioning, the NFC Wallet SDK protects against:

• Debugger attached
• Man-in-the-middle (MITM) attack
• Digital wallet application data backup
• Rooted mobile device
• SDK Bind
• Use of emulator
• Non-designated application signing certificate

Payment

During payment, the NFC Wallet SDK protects against:

• Debugger attached
• Digital wallet application data backup
• SDK Bind
• Non-designated application signing certificate

Countermeasures

Countermeasures applied for each threat are listed below.

Debugger attached

• Threat: An attacker attempts to reverse engineer the digital wallet application by attaching a debugger at runtime.
• Applies to: SDK initialization, provisioning, payment
• Build type: release
• SDK behavior: Return an error when a debugger is detected during the flow.

Man-in-the-middle (MITM) attack

• Threat: An attacker attempts to intercept or modify the communication channel between the digital wallet application and the NFC Wallet backend.
• Applies to: SDK initialization, provisioning
• Build type: release
• SDK behavior: When using the release build with a misconfigured TLS (SSL) certificate, the following errors may occur:

  • HttpStatusCode: -2
  • ErrorMessage: Unable to communicate with gateway.
  • SdkErrorCode: COMMON_COMM_ERROR

Digital wallet application data backup

• Threat: Data stored in the digital wallet application is backed up and restored to a different device.
• Applies to: SDK initialization, provisioning, payment
• Build type: release, dev
• SDK behavior: Wipe local digital wallet application data.

Rooted mobile device

• Threat: Running the digital wallet application on an Android rooted device.
• Applies to: SDK initialization, provisioning
• Build type: release, dev
• SDK behavior: Return an error during SDK initialization and provisioning when the device is detected as rooted. After enrollment, a change in device root state triggers the server to prompt the end user to re-enroll on the next SDK call to the server (via the ProvisioningServiceListener.onError() callback).

SDK Bind

• Threat: The SDK bundle (.aar) contains two main artifacts (.jar and .so). These artifacts are bound and must be used together. Always use the same build type for both artifacts.
• Applies to: SDK initialization, provisioning, payment
• Build type: release, dev
• SDK behavior: Return an error when the .jar and .so artifacts do not match.

Use of emulator

• Threat: Using an emulator to make NFC transactions.
• Applies to: SDK initialization, provisioning
• Build type: release, dev
• SDK behavior: The SDK cannot be initialized in an emulator. An error will be returned when an emulator is detected.

Non-designated application signing certificate

• Threat: The digital wallet application must be signed with a designated certificate. The SDK uses the signing certificate hash to verify application authenticity. See Fetching application binding key for more information.
• Applies to: SDK initialization, provisioning, payment
• Build type: release, dev
• SDK behavior: Return an error when the application signing certificate does not match the designated certificate.