Scary, Scary Mobile Banking

Short post to demonstrate really bad mobile payment sample code provided by Mastercard.

For a great tutorial on how to N-O-T develop a mobile payment application, take a look at the sample code provided by Mastercard here. For more Mastercard Open API goodness, check these examples out here and here.

In this snippet from the sample code, they are providing a placeholder for hardcoding your companyID and companyPassword in plaintext string format:

final double amount = Float.valueOf(amountInput.getText().toString());

final String currency = "USD";

final String companyId = "your-company-id-here";

final String companyPassword = "your-company-password-here";

final String messageId = "your-message-id-here";

final String settlementId = "your-settlement-id-here";

final String cardHolderName = cardHolderNameInput.getText().toString();

final String accountNumber = cardNumberInput.getText().toString();

final String expiryMonth = expirationMonthInput.getText().toString();

final String expiryYear = expirationYearInput.getText().toString();

And below, we append this to our request and send!!

request.append("<MerchantIdentity>");

request.append("<CompanyId>");

request.append(companyId);

request.append("</CompanyId>");

request.append("<CompanyPassword>");

request.append(companyPassword);

request.append("</CompanyPassword>");

request.append("</MerchantIdentity>");

Hardcoding your credentials is NEVER (I repeat, NEVER) a good idea. Please don't do this. Your companyID and companyPassword are used for both processing payments, and processing refunds. Fully decompiling an Android application is extremely trivial, as demonstrated here. There are also applications floating around that allow 1-click rooting. You don't have to be an uber elite expert to do this stuff.

What concerns me most is the de-centralization of highly sensitive information. This is a bigtime mobile trend. If you are writing code like this and giving 50 employees an Android phone or tablet, what is the likelihood that at least 1 of them will end up getting lost at some point? What is the likelihood that at least one of those devices will get owned at some point? What is the likelihood that a malicious employee would take this information and rob your company blind? Pretty high, in my opinion.

In a perfect world, this type of architecture would involve a very simple upstream web service and web server where the credentials could be stored in a secure way. The web service would ask for the credit card information, and THAT'S IT. There's less of a risk of data leakage with one target instead of 50.

There are lots of very important design aspects to consider when rolling out this type of capability. If you are in the business of losing money, then copy and paste this code and begin processing mobile payments. And don't even consider putting something like this in the Android market because I will find it ;)

-Jack