Pierluigi Paganini October 08, 2015

Chinese Hackers who allegedly compromised servers at LoopPay, the Samsung subsidiary, appear interested in spying on targets through Samsung Pay technology.

The Samsung subsidiary LoopPay has been the victim of a security breach that is worrying the security industry. The investigators speculate that attackers’ motivation is the cyber espionage and excluded a financial crime.  If confirmed the security breach could have worse consequences.

The news that Chinese Hackers Breached LoopPay, the core of Samsung Pay system, has been provided by the The New York Times and has been confirmed by Samsung with an official statement.

“Today, the New York Times reported on an incident that targeted LoopPay’s office network. The article raised questions as to the effect of this on the recently launched Samsung Pay service. The first thing to know is that Samsung Pay was not impacted and at no point was any personal payment information at risk. This was an isolated incident that targeted the LoopPay office network, which is a physically separate network from Samsung Pay. The LoopPay incident was resolved and had nothing to do with Samsung Pay.” acknowledged  Samsung.

Samsung minimized the incident reporting that only LoopPay’s office network was affected, anyway, no personal payment information was exposed. Samsung added that systems at Samsung Pay haven’t been impacted.

The network at LoopPay was breached in February, shortly before Samsung bought the company for US$250 million. The experts believe that attackers have already breached the company at that time.

“LoopPay did not learn of the breach until late August, when an organization came across LoopPay’s data while tracking the Codoso Group in a separate investigation.” states The New York Time.

According to The New York Times, the attack was conducted by the Chinese hackers belonging to the Codoso Group.  The Codoso group (aka Sunshop Group) hit Forbes visitors with zero-day exploits early this year, it is known in the security community for its attacks against against many entities in various industries including the US Government, Military, Defense Industrial, Think tanks covering foreign affairs, Financial services, Energy firms, and Political dissident groups.

The New York Times sustains the hackers did not act to steal consumer data for sale, it is likely they were interested in accessing to LoopPay’s code to develop the capability to collect information on individuals. The information managed by LoopPay could be used to trace “persons of interest,” knowing their purchases, habits and locations.

The security experts fear that the hackers of the Codoso group may have already infiltrated other systems inside their target, as usually happen when APT conduct long-term espionage campaigns.

“Once Codoso compromises their targets — which range from dissidents to C-level executives in the U.S. — they tend to stay there for quite a long time, building out their access points so they can easily get back in,” said John Hultquist, the head of intelligence on cyberespionage at iSight Partners, a security firm. “They’ll come back to a previous organization of interest again and again.”

Samsung Pay is a technology that allows to pay with your a mobile device, experts sustain that it is more secure than traditional credit cards because each transaction is associated with  a one time encrypted token.

LoopPay hasn’t notified law enforcement about the intrusion because it believed no customer data or financial information had been stolen.

Pierluigi Paganini

(Security Affairs – LoopPay , Samsung Pay)