Xiaomi phones with MediaTek chips have BIG security flaw, You could lose your bank savings!

tech.hindustantimes.com:

Are you a Xiaomi smartphone user? If yes, you need to be alerted. As per the latest information, a flaw has been discovered in some Xiaomi phone's mobile payment mechanism that could have cost the users their hard earned money. Now, when very few people prefer carrying cash with them, the most common mode of payment is via UPI. But what if someone steals money from your digital wallet and that without your knowledge? Researchers from Check Point Research (CPR) have discovered vulnerabilities in the payment system built into Xiaomi smartphones that could allow forging of payment packages or disabling the payment system directly, from an unprivileged Android application.

"In this report, CPR (Mobile) researchers analyzed the payment system built into Xiaomi smartphones powered by MediaTek chips, which are very popular in China. During these reviews, we discovered vulnerabilities that could allow forging of payment packages or disabling the payment system directly, from an unprivileged Android application," CPR said in the blog post.

The post informed that mobile payment signatures are carried out in the Trusted execution environment (TEE), which has been an integral part of mobile devices and its main purpose is to process and store sensitive security information such as cryptographic keys and fingerprints. Hence, it is assumed that if the TEE is safe, your payments are secure too. The test device used for the research is the Xiaomi Redmi Note 9T 5G with MIUI Global 12.5.6.0 OS.

The researchers discovered that Xiaomi can embed and sign their own trusted applications. "We found that attacker can transfer an old version of a trusted app to the device and use it to overwrite the new app file. Therefore, an attacker can bypass