Tap-Tap and Pay (TTP): Preventing Man-In-The-Middle Attacks in NFC Payment Using Mobile Sensors
Maryam Mehrnezhad, Hao Feng, SF Shahandashti · School of Computing Science Technical Report Series · 2014
• Using ambient sensors: to measure the characteristics of the surrounding environment, such as light, sound, temperature and GPS. The underlying assumption is that the malicious and honest readers should be in two different locations with different environments. • Problem: All these solutions will not work if the two readers are located in the same environment (e.g., in two nearby stalls in the same mall). In this work, we present TTP as a countermeasure that defends against the reader-and-ghost attack even when the malicious and honest readers are in the same environment. Our solution is based on the following observation: As the result of physical tapping between a pair of sensor-rich devices (say two NFC-enabled phones acting as a card and a reader), the tapping event causes unpredictable but strongly correlated vibrations at both sides, which are hard to reproduce and can be reliably measured by accelerometer sensors.