Nullcon Goa 2023 | How I Hacked Your Bank Account: A Detailed Look At UPI Security by Nemo

Abstract:
--------------
UPI needs no introduction, it is the fastest-growing payment method in the world, with billions of transactions flowing through it every month. This talk presents independent security research on UPI, including major vulnerabilities (disclosed and fixed with NPCI’s cooperation), as well as a threat model of how secure UPI really is.
The talk is based on independent research that the author did while at Razorpay, reversing and debugging multiple UPI applications to better understand the underlying security parameters. The first half of the talk goes over UPI’s payment flows, looking deeply into various security properties of the system, and how they differ between various apps. Peppered with a few demos to showcase the reversing process, the rest of the talk will walk the audience through a major vulnerability disclosure - which allowed mass hacking of bank accounts in India.
#hackingUPI #upipayments #Infosec #Nullcon #NullconGoa2023
---------------------------------------------------------------------------------------------------------------------
Follow nullcon on Facebook: / nullcon
Twitter: / nullcon
LinkedIn: / nullcon
Website: nullcon.net

[@VacuumFluctuation]

Superb eye - opener for all in the infosec community. More infosec people should work on UPI security due to its impact & scale but early that's not the reality... That's surprising. 😮

[@anonymouspheonix5198]

Awesome Video

[@kumud-ranjan]

bhai koi easy way m samjha sakta h? to samjha do....

[@surajraika7821]

there is no easy way

[@bhumiputra6108]

Dude reverse engineered a less secure payment application using Frida. Then exploited the Business Logic Flaw(lack of SMS validation) basically bad implementation of Zero Trust on the UPI Backend. This helped him in performing Impersonation attack(Logging in as You) by spoofing the mobile number that was being sent to UPI backend.