sageer-m-kabeer / mtn-request-to-pay-auto-confirmation-attack

mtn-request-to-pay-auto-confirmation-attack

MTN Request to Pay with Auto Confirmation Attack Introduction This report describes a cybersecurity pentesting attack on the MTN Request to Pay with Auto Confirmation feature. The attack involves reverse engineering the momo merchant app to send a request to pay and then using USSD to confirm the request to pay without the victim's knowledge or consent.

Attack Description The attack is carried out in the following steps:

The attacker reverse engineers the momo merchant app to identify the function that sends a request to pay. The attacker then develops a new app or script that can call this function. The attacker sends a request to pay to the victim's phone number. The victim receives a notification on their phone asking them to confirm the request to pay. The attacker then uses USSD to confirm the request to pay without the victim's knowledge or consent. Impact If the attack is successful, the attacker can steal money from the victim's MTN Mobile Money account.

Mitigation MTN can mitigate this attack by implementing the following measures:

Educate customers about the attack. Customers should be advised to be careful about confirming requests to pay, especially if they do not recognize the sender. Implement additional security measures for the Request to Pay feature. For example, MTN could require customers to enter a PIN or password before confirming a request to pay. Git Readme.md File MTN Request to Pay with Auto Confirmation Attack This repository contains a report on a cybersecurity pentesting attack on the MTN Request to Pay with Auto Confirmation feature. The attack involves reverse engineering the momo merchant app to send a request to pay and then using USSD to confirm the request to pay without the victim's knowledge or consent.

Usage

To read the report, simply clone this repository and open the README.md file in a text editor.

Contributing

If you have any feedback or suggestions, please feel free to create an issue or pull request in this repository or contact me directly via [phone] or [email protected].

License

This report is licensed under the MIT License. Author : SHIELD SHIELD

Conclusion This attack is a serious threat to MTN Mobile Money customers. MTN should take steps to educate customers about the attack and implement additional security measures for the Request to Pay feature.