a Google Wallet vulnerability was found making both rooted and untampered devices with the application vulnerable to hackers. The crack exposed the PIN within seconds, and was since temporarily patched by Google. This patch disabled the use of prepaid cards, and since then we hadn't heard much on the subject. Google is pushing three security fixes today that not only allow for prepaid card usage with Wallet, but offer core system fixes.
Tagged: Google Wallet
can now be compromised on any device - rooted or not. Wallet Cracker, an application developed by Zvelo, can easily unveil your four digit PIN protecting your entire digital wallet. It's a good thing this security firm found the vulnerabilities before a malicious hacker took advantage of them.
Smartphone Champ, has discovered another way to get into a private Google Wallet account, no root required. Technically this is more of a lopphole than a crack, if only because it uses Android's default setting to achieve access. The gist is that all you need to do to wipe the security PIN is to delete the app's stored data via the Settings menu, essentially resetting it to the state it was in when you downloaded it from the Android Market. This is a common Android function and is even recommended sometimes when an app is misbehaving. Wipe the data, re-launch the app, and you (or anyone who has your phone) can access Wallet, associate it with your Google account (without entering a password) and set up a new PIN. Then they can spend the money at any online or retail store that accepts Google Wallet - all without root. Watch as Hashim demonstrates: [youtube Rh1ytHrhj2E] This is a much bigger problem than the previous leak, because anyone with physical access to your phone has the ability to do this quickly and easily. The problem lies with Google Wallet's authentication system: though funds are added into your account and virtually "kept" by Google, the authentication is linked to a single device, not your account. Compare this with any banking app, which keeps your account password connected to your username. Odds are overwhelming that Google will address this loophole very soon. In the meantime, the best way to stay protected while using Google Wallet is to set up a PIN or lock pattern on your device itself - without the PIN or pattern, a thief would have to completely wipe your phone to access any apps or data. [timeline] [via 9to5Google, via AndroidandMe]
recently exposed vulnerability in the Google Wallet app which potential thieves to steal your PIN code if you're running a rooted version of Android. The crack can be applied even after a PIN or password is changed, but again, only on rooted devices. After The Next Web posted the story from the original source, Google itself responded - though there isn't much information on an actual resolution. Essentially, Google reminds users that a stock phone cannot be affected in this manner, and recommends that root users refrain from downloading Google Wallet at all. Here's the full text of their reply:
The zvelo study was conducted on their own phone on which they disabled the security mechanisms that protect Google Wallet by rooting the device. To date, there is no known vulnerability that enables someone to take a consumer phone and gain root access while preserving any Wallet information such as the PIN.We strongly encourage people to not install Google Wallet on rooted devices and to always set up a screen lock as an additional layer of security for their phone.That's a disappointing answer, but not an unexpected one. When you unlock or root a device, you're always running at least some kind of risk, to your hardware, your software, and even your personal data. The possibility that 1) your rooted phone would get stolen by 2) someone with the technical knowledge to pull a similar hack off and 3) the knowledge that both your banking information is on the phone and that it's possible to retrieve it is remote to say the least. Considering the low saturation of NFC payment systems, especially in the US, it would seem that root users just need to do without for now. This isn't the first time that Google has essentially ignored the considerable percentage of Android users who root: there's still no way to legally watch movies or TV shows downloaded from the Android Market on a rooted device. While this is thought to be a measure insisted upon by the various entertainment studios, that doesn't make the refusal of service any less annoying. Even so, it's not Google's responsibility to cover every contingency of every Android modification: If you modify the software on your phone or tablet, you're responsible for any change in functionality or security. That seems like a reasonable position, if at times frustrating one.
conflict between Google and Verizon over Google Wallet. The Google Wallet NFC payment app will work on the Nexus, but Verizon blocked the app from the smartphone. This is thought to be due to Verizon ready to roll out its own NFC payment app in conjunction with ISIS.
Galaxy Nexus, which may bother some folks when that phone finally lands in the US. However, if you are the security-conscious sort that may not be a big deal to you in the wake of a recent report by a security firm called viaForensics that is claiming that the Google Wallet app isn't secure enough. American Banker reports that viaForensics found that app stores enough data on the phone itself that a well-crafted email from a nefarious sort could fool many users into giving up more credit card details.
partnered with ISIS to support their future NFC payment service, there was skepticism whether or not this was indeed the reason Google Wallet was to be unsupported on the Galaxy Nexus. It turns out this little feature may be the cause for the seemingly infinite delays, and until Verizon and Google sort it out - we may not see the Nexus on shelves. A source over at Phandroid mentioned the new target date for the Galaxy Nexus will be December 15th, but don't get excited quite yet.
Google Wallet isn't going to work on anything besides the Nexus S 4G for the foreseeable future. Yes, that includes Verizon's Galaxy Nexus, and very probably AT&T and T-Mobile versions, if they ever appear. Computer World broke the story, though I'd be wary of anything labelled "confirmed" from that particular source. Unfortunately, the news is not entirely unexpected. Why? Verizon, AT&T and T-Mobile have already begun an initiative to create an NFC payment network for the United States, and have gotten Samsung, HTC, Motorola and LG in on the system. ISIS is currently set to launch sometime next year. The simplest answer to a lack of Google Wallet integration with the U.S. version of the Galaxy Nexus is that Verizon doesn't want to compete with Google for NFC payments, a field that many consider to be on the cusp of mass consumer adoption. This hasn't been confirmed, but it seems like the most likely culprit. This is annoying in many ways. One, consumers shouldn't be forced to use a carrier-supplied system on an "open" smartphone, especially since the Nexus line is supposed to be free of carrier interaction. We've already seen a disturbing first move by Verizon with included bloatware apps. Two, why should Verizon block, or even be allowed to block, apps that compete with its services? After all, you can still access YouTube and Movies in the Android Market, even though Verizon offers V-Cast videos. Of course, the wonderful thing about the Nexus line is a rabid community dedicated to modding it and improving it. Solutions to Verizon's meddling have already appeared in the form of custom kernels and carrier ID tweaks. It takes a lot to keep Android users from doing what they want, especially when devices aren't saddled with locked bootloaders. If you want to use Google Wallet on the Galaxy Nexus, or any AT&T, Verizon or T-Mobile Android phone, get comfortable with root tools and custom ROMs. [device id=1740] [via Droid Life]