Please use this identifier to cite or link to this item:
Title: PoPL : proof-of-presence and locality, or how to secure financial transactions on your smartphone
Authors: Leguesse, Yonas
Colombo, Christian
Vella, Mark Joseph
Hernandez-Castro, Julio
Keywords: Open source software
Malware (Computer software)
Mobile apps -- Security measures
Issue Date: 2021
Publisher: Institute of Electrical and Electronics Engineers
Citation: Leguesse, Y., Colombo, C., Vella, M., & Hernandez-Castro, J. (2021). PoPL : proof-of-presence and locality, or how to secure financial transactions on your smartphone. IEEE Access, 9, 168600-168612.
Abstract: The security of financial apps on smartphones is threatened by a class of advanced and persistent malware that can bypass all existing security measures. Strong cryptography and trusted on-chip hardware modules are powerless against sophisticated attacks that supplant device owners through device input record/replay functionality, effectively hijacking their credentials, privileges, and actions. In this paper, we introduce Proof-of-Presence and Locality (PoPL), a new security measure that tackles this threat by leveraging sensors to prove the physical presence of device owners and therefore discriminate between malware-initiated transaction requests and legitimate ones. Moreover, PoPL neither imposes the expense of additional hardware nor compromises app usability. In order to demonstrate PoPL's practicality, we developed PoPLar, a challenge puzzle implementation of the PoPL concept that ensures usability even on limited screen sizes by the use of a dendrogram. We have made it available as an open-source library ready to be integrated with minimal effort with existing apps. We demonstrate PoPLar's effectiveness and ease of integration through case studies involving apps from the three top cryptocurrency exchanges and an open-source crypto wallet.
Appears in Collections:Scholarly Works - FacICTCS

Items in OAR@UM are protected by copyright, with all rights reserved, unless otherwise indicated.