A hard-to-detect security flaw in mobile payments has been discovered in the Swish payment app when it was combined with Mobile BankID. The flaw allows users to view other users' payment history simply by changing an option in the service's payment history.
The Swish app is designed as a simple alternative to credit card machines and allows card payments to be made simply by touching the machine to the mobile phone. Combined with the free app from each bank, the user can easily make the payment they want anywhere.
This is done in Sweden through the Mobile BankID application, which allows the user to make transactions in real time via their mobile phone.
According to the person who reported the problem, who goes by the nickname Nullbyte (@nbyte, on Twitter), Mobile BankID would open with a confirmation request that sent a unique reference number back to the phone. Nullbyte, however, noticed that the app's payment history also included the MSISDN reference number, which is the phone number.
So anyone could easily request payment history by changing the MSISDN number, i.e. the mobile number. This is because the application sends this number to confirm the authenticity of the person using the application and not to unlock the right to use it.
This problem appears to have existed since the launch of the application, in December 2012, with Swish users reaching 1.7 million today.
The problem was fixed within a week of being discovered by Nullbyte, who first reported the problem to the company that made the app, which directed him to send a private message to the company's Facebook page. When Nullbyte said he didn't have a Facebook account, the company directed him to the bank where he maintains a personal account to resolve the problem.
