Google users warned of threat to smartphone wallets

Feb 10, 2012
Users of Google smartphone wallets were being warned on Friday that there is a way to crack pass codes intended to thwart thieves from going on illicit shopping sprees.

Users of Google smartphone wallets were being warned on Friday that there is a way to crack pass codes intended to thwart thieves from going on illicit shopping sprees.

Zvelo Labs researcher Joshua Rubin was featured in a video at the company's website demonstrating software that quickly figures out a Google (PIN), provided the crook has the .

Rubin said that Google has been alerted to the vulnerability and is moving swiftly to fix it. He has not made his wallet "Cracker" application public.

This video is not supported by your browser at this time.

"Google Wallet allows only five invalid PIN entry attempts before locking the user out," Rubin said in a blog post.

"With this attack, the PIN can be revealed without even a single invalid attempt," he continued. "This completely negates all of the security of this mobile phone payment system."

Google declined an AFP request for comment.

"Once attackers get your PIN, they have full access to any stored in the app and they can use your phone to make purchases," McAfee researcher Jimmy Shah said in a blog post.

"As a user of Google Wallet, the main security you see is the PIN," McAfee added.

"What makes Wallet easy for you to use now makes it easy for attackers to use; they can now spend your money and credit just as if your phone were an ATM card."

Rubin dismissed the threat of hackers picking Google Wallets remotely, explaining that physical access is needed to get priority access to controls in a process called "rooting."

Security specialists advise Google Wallet users not to "root" smartphones, and to enable such as full-disk encryption and screen locks.

Google Wallet is available only on Nexus S and Galaxy Nexus smartphones. Google said it planned to expand the feature to more Android phones.

Google Wallet uses a near field communication (NFC) chip embedded in a phone to allow a user to "tap-and-pay" for purchases at a checkout register equipped with the PayPass system from CitiMasterCard.

Customers can also use a Google Prepaid card to pay for purchases, topping up the Google card with any payment card, and take advantage of Google Offers, the Mountain View, California-based company's online discount coupon program.

In addition to allowing for mobile payments, Wallet allows consumers to pay using gift cards and to redeem promotions such as discounts or coupons.

Explore further: Digital dilemma: How will US respond to Sony hack?

add to favorites email to friend print save as pdf

Related Stories

PayPal letting Google phones swap cash

Jul 13, 2011

Online financial transactions giant PayPal on Wednesday showed off a mini-program that lets people exchange money by touching together a pair of Google smartphones.

Recommended for you

Digital dilemma: How will US respond to Sony hack?

10 hours ago

The detective work blaming North Korea for the Sony hacker break-in appears so far to be largely circumstantial, The Associated Press has learned. The dramatic conclusion of a Korean role is based on subtle ...

UN General Assembly OKs digital privacy resolution

13 hours ago

The U.N. General Assembly has approved a resolution demanding better digital privacy protections for people around the world, another response to Edward Snowden's revelations about U.S. government spying.

Online privacy to remain thorny issue: survey

14 hours ago

Online privacy will remain a thorny issue over the next decade, without a widely accepted system that balances user rights and personal data collection, a survey of experts showed Thursday.

Spain: Google News vanishes amid 'Google Tax' spat

Dec 16, 2014

Google on Tuesday followed through with a pledge to shut down Google News in Spain in reaction to a Spanish law requiring news publishers to receive payment for content even if they are willing to give it away.

User comments : 1

Adjust slider to filter visible comments by rank

Display comments: newest first

chromosome2
not rated yet Feb 12, 2012
The only phones that have Google Wallet have operating systems that the carriers haven't had an opportunity to screw up, so, I don't see why one would root them. I rooted my HTC Incredible because my first phone was the Droid and I couldn't stand sense, and gosh darnit, if I'm going to buy a $700 pocket computer, it's going to do what *I* want it to do. The Nexus phones already do that.

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.