potential malware issue?

[card-io]

potential malware issue?

[dgoldman-pdx]

@seamug thanks for that link. Yes, this presentation does a good job of introducing several avenues of attacking a mobile app, especially an iOS POS app. It also provides some really good advice about how to design a POS app, and how to manage its distribution.

In the case of card.io, all that our library does is provide your app a way for the user to visually or manually enter their credit card information. That information is then handed over to your app. By the definition of this task, the information must be handed over in an unencrypted form. So that's an unavoidable point of vulnerability -- if someone has compromised your app.

On a jailbroken device, there's essentially nothing that an attacker can't get to. In implementing card.io, we've taken several steps (of which some were alluded to in this video) to make our library itself more difficult to analyze and compromise. But it's not possible to block all possible avenues of attack, especially on a jailbroken device. And, in any case, card.io eventually hands the unencrypted card information to your app.

As discussed in the video, if you are building a POS app and want to ensure that credit card information is extremely difficult to intercept, you will need to use a hardware card reader that performs hardware encryption before handing the data over to your app.