Security
2 Security
Security is a crucial aspect in payment processing. Especially when integrating from within a mobile app, you
have to consider the fact that your code - although compiled - is running on an 'untrusted' handset. This means
that in theory, your code or the traffic between app and server can be reverse engineered and any sensitive
information could be retrieved.
This is especially the case for the Shared Key used to sign the initial POST, i.e. produce the HMAC signature, to
the Adyen MPP. Consider flow A illustrated in Diagram 1, This flow assumes that the shared key used for the
HMAC signature calculation is stored within the app. A possible attack from a fraudster to this setup would
include five steps:
a) reverse engineering the app to retrieve the shared key,
b) proceeding with a regular in app payment,
c) intercepting the signature along with the POST data,
d) tampering of the payment data, e.g. To lower the payment amount,
e) new calculation of the signature with the tampered payment data and finally performing the POST
of this data and signature on Adyen Mobile Payment Pages (MPP).
8 Copyright © Adyen B.V. 2011
