CVE-2017-9821
📋 TL;DR
This vulnerability allows attackers to bypass SMS-based authentication in the BHIM Android app by using hardcoded validation strings. Attackers could potentially gain unauthorized access to payment accounts. All users of BHIM version 1.3 for Android are affected.
💻 Affected Systems
- National Payments Corporation of India BHIM application
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover enabling unauthorized financial transactions, identity theft, and financial loss to users.
Likely Case
Unauthorized access to payment accounts leading to fraudulent transactions and potential financial theft.
If Mitigated
Limited impact if multi-factor authentication or additional security controls are implemented beyond SMS validation.
🎯 Exploit Status
Exploitation requires physical access to device or ability to intercept SMS messages. The hardcoded strings are publicly documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 1.3
Vendor Advisory: https://www.npci.org.in/what-we-do/bhim/product-overview
Restart Required: Yes
Instructions:
1. Update BHIM app from Google Play Store
2. Uninstall version 1.3
3. Install latest version
4. Restart device
🔧 Temporary Workarounds
Disable SMS permissions
androidTemporarily disable SMS permissions for BHIM app to prevent exploitation
adb shell pm revoke com.npci.bhim android.permission.RECEIVE_SMS
adb shell pm revoke com.npci.bhim android.permission.READ_SMS
Uninstall vulnerable version
androidRemove the vulnerable app version until update is available
adb uninstall com.npci.bhim
🧯 If You Can't Patch
- Discontinue use of BHIM app version 1.3 immediately
- Monitor financial accounts for unauthorized transactions
- Enable additional authentication methods if available
🔍 How to Verify
Check if Vulnerable:
Check app version in Android settings > Apps > BHIM > App info. If version is 1.3, system is vulnerable.Check Version:
adb shell dumpsys package com.npci.bhim | grep versionNameVerify Fix Applied:
Verify app version is greater than 1.3. Test SMS authentication functionality.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts followed by successful login
- SMS validation using hardcoded strings in app logs
Network Indicators:
- Unusual SMS traffic patterns to/from payment app
- Authentication requests bypassing normal validation
SIEM Query:
source="android_logs" app="BHIM" (event="authentication" AND result="success" AND method="sms")