At the PCI SSC Europe Community Meeting in Edinburgh last week, two questions came up repeatedly in our conversations with payment industry experts: what does mobile payment security look like in an AI-accelerated threat landscape? And where do software protections fit when almost all devices support hardware-backed cryptography?
At the heart of our answer to both of these questions is the Licel vTEE, which now supports over-the-air delivery of Trusted Application (TA) components implementing mobile apps' most security-critical functionalities, including payment cryptography, identity operations, signing, and app attestation.
This edition of the Layers Bulletin covers that in more detail, as well as our takeaways from Edinburgh, and the latest DexProtector release, which introduces detection of untrusted accessibility services on Android alongside other improvements across both platforms.
At PCI SSC Europe: closing the trust gap
In Edinburgh, our Senior Product Specialist, Ben Thompson, gave a talk about mobile payment apps and the boundaries of secure hardware: what he called the Trust Gap.
Ben spoke about what secure hardware can and cannot protect for mobile payment apps and SDKs. He highlighted gaps where the mobile secure hardware boundary ends; where the workflow leaves secure hardware and is more easily targeted by attackers.
Even when an app uses secure hardware to protect cryptographic keys, attackers can still target sensitive data before it's encrypted. They can hook callbacks, inspect memory buffers, or manipulate legitimate error-handling mechanisms to force cryptographic downgrades. And some security-critical workflows simply cannot be implemented entirely within secure hardware.
This is the Trust Gap that the Licel vTEE, alongside DexProtector and Alice Threat Intelligence, helps organizations to address.
Organizations around the world already use Licel vTEE Trusted Application (TA) components to implement the most sensitive functionality in their apps and SDKs. Examples include payment card Cryptographic Processing Engine TAs for wallet SDKs, DUKPT key management TAs for MPoC-certified SoftPOS solutions, and app attestation TAs for mobile banking applications.
The Licel vTEE combines white-box cryptography, logical isolation, and a dynamically shifting execution environment to protect security-critical operations that hardware alone cannot fully secure.
Rather than exposing these operations as conventional application functions, the vTEE enables them to be executed inside a unique protected virtual machine instance, making them significantly harder for attackers to analyze and manipulate. And there's another major advantage with the Licel vTEE: attackers face a moving target. The virtual machine instance and its cryptographic protections are varied across versions and deployments, forcing attackers to start their reverse engineering work from scratch, again and again.
As AI accelerates the pace of attacks, the ability to change the target for attackers becomes more important by the day. And now, with support for over-the-air delivery of Trusted Application components, we can keep moving that target even after an app is already in users' hands.
What's new with Licel's solutions?
The Licel vTEE now supports over-the-air delivery of Trusted Application components
With the Licel vTEE's new over-the-air (OTA) Trusted Application delivery capability, providers can deploy new security-critical functionality to apps already installed on users’ devices, without releasing a new version to app stores.
The approach follows the GlobalPlatform model already familiar to the payment and telecom industries from provisioning applets to SIM cards and Secure Elements:
- Trusted Applications are delivered over a mutually authenticated, encrypted channel based on GlobalPlatform SCP11a
- Only packages authorized by the app vendor can be installed
- Once delivered, Trusted Applications execute in isolation inside the vTEE
Applus+ Laboratories tested this capability as part of the evaluation that renewed the Licel vTEE's EMVCo SBMP TEE approval on iOS. This marks the third consecutive year of approval for the vTEE on both Android and iOS.
The implications extend beyond convenience.
As attackers develop new techniques, providers can change the protected execution environment, rotate cryptographic protections, and now deliver new TA components to apps already in the field. This helps maintain a moving target even as AI-assisted reverse engineering becomes more capable.
DexProtector 17.0.3: new Anti-Malware accessibility service detection and stronger runtime protection
The latest DexProtector release introduces new detection capabilities on Android and strengthens existing protections across Android and iOS.
The headline addition is detection of untrusted accessibility services in DexProtector Anti-Malware for Android.
Accessibility services can be abused by malicious software to monitor user activity, steal data, manipulate sensitive app workflows, and perform fraudulent transactions. The new detection capability gives protected apps and their backends a signal they can act on when an untrusted or potentially harmful accessibility service is active on the user's device.
Another important addition is support for JWE-encrypted JWTs in Mobile API Protection on both Android and iOS. This enables teams to securely deliver the DexProtector Runtime Engine Attestation Token to their backend for validation and processing using a confidential, standardized format.
The release also includes:
- Enhanced jailbreak and virtualization/simulation detection (iOS)
- Improved integrity checks for runtime compatibility libraries and fat binaries (iOS)
- More specific anti-hooking and anti-code injection detection where memory management behaves in non-standard ways (Android)
- TLS 1.3 support for Public Key Pinning and Certificate Transparency checks (iOS)
- Additional diagnostic information in stack traces in crash reports (iOS)
Please note that version 17.0.3 removes support for Android 4.4.
A new home for mobile channel protection
Our homepage has been redesigned to reflect how we approach security today: protecting the whole mobile channel, from the app and the device it runs on to its communication with backend systems.
It shows how DexProtector, Alice Threat Intelligence, and the Licel vTEE work together across Integrity, Intelligence, and Isolation, and presents the independent evaluations that sit behind them.
Thanks for reading this edition of the Licel Layers Bulletin. We'll be back next month with more product improvement updates and threat intelligence insights.
