Security exploit on Google wallet on Android

[azrin640]

Google promises Wallet is now safe, disables prepaid cards
By: Dan Graziano | Feb 13th, 2012 at 08:30AM 1 Comments Filed Under: Mobile, Security


Two recently uncovered securityexploits concerning Google Wallet have left users questioning just how safe the product really is. A security firm exposed a vulnerability last week that allowed hackers to bypass PIN protection, but it was only present on rooted devices. A second exploit, however, did not require a handset to be rooted, leaving all Google Wallet users exposed. By wiping stored Google Wallet data from within a device’s settings, an unauthorized user will be able to access a user’s prepaid funds without needing to know his or her Google Wallet pin. The company has acknowledged both security exploits, and it now says Google Wallet is safe and “offers advantages over the plastic cards and folded wallets in use today.” Read on for more.

Google has suggested that users who are interested in Wallet do not root their devices because the feature is not supported on rooted phones. “That’s why in most cases, rooting your phone will cause your Google Wallet data to be automatically wiped from the device,” said Osama Bedier, vice president of Google Wallet and Payments. To address the second issue, the Mountain View-based company has temporarily disabled provisioning of prepaid cards as a precautionary measure. The service will remain disabled until a permanent fix is available.

“We strongly encourage anyone who loses or wants to sell their phone to call Google Wallet support toll-free at 855-492-5538 to disable the prepaid card,” Google said in a statement. “We are currently working on an automated fix as well that will be available soon. We also advise all Wallet users to set up a screen lock as an additional layer of protection for their phone.”

source : BGR

Makes you wonder on the security of Android

[chrisy520]

It's not a big issue really. You have more chance of losing your actual wallet.

Someone has to physically have your phone.
Said phone has to be rooted.
Your phone has to have no device password set.

There's some other things that have to be in place first too but I only remember the main ones. I haven't anywhere that this pertains to non rooted phones, from real sources.

I worry more about someone breaking into my car than this.

Here's the real scoop, and not the paranoid bashing version:http://m.androidcentral.com/google-w...curity-cracked

Heck, if I lost my BlackBerry without a device password I'd be in trouble too! All my info is on here. Much more access than just a Google Wallet account!

[avt123]

This isn't BlackBerry news or a rumor. This thread belongs here...

http://forums.crackberry.com/android-f169/

[chrisy520]

There's already blogs, threads and news of this on Android Central.

The OP is just a BlackBerry fanyboy that is trying to bash Android.

[kbz1960]

Kind of like the assumption that since the pb can or could be rooted no enterprise will use it yet it takes all that for it to be done.

Don't know that the article is bashing any more than a bad article is bashing RIM. Sounds like a warning for people who use google wallet.

[chrisy520]

Na, this thread isn't a warning. If it was, it would be posted where Android user are! Lol. Android Central.

[kbz1960]

I thought there were plenty here? Or is it just a very vocal minority?

[chrisy520]

I would guess they also frequent Android forums. That CrackBerry is a secondary stop. . No?

[kbz1960]

Could be, dunno. I've seen some state this site is more fun.

So why are most of the bad news post on here about RIM started by apple and android fans? Vocal minority again I suppose. Are those bashing threads? Every one of them?

[avt123]

Now this is in the right forum. Ty mods.

[sleepngbear]

Hmmm ... this is considered bashing of Android (which it isn't) and is a no-no, even though this is a BlackBerry-focused site, but repetitive postings of meaningless businesses and insignificant government agencies supposedly dropping RIM on this same BlackBerry-focused site and anything else negative that anybody can dig up is ok, huh? Well isn't that special.

[chrisy520]

It's good the Google acknowledged the issue and is fixing it.

4 digit PINs aren't very secure to begin with.

[kbz1960]

Originally Posted by chrisy520

It's good the Google acknowledged the issue and is fixing it.

4 digit PINs aren't very secure to begin with.

Agreed ..........

[rmjones101]

While it's a Google goof, I dunno I'd classify it as an Android issue. It's the result of the faulty design of an app and service, not the OS.

Which is the predominate reason that when the announcement of mobile payments and services were in development, I decided that I'd wait a while for bugs to be ironed out before I fully commit to it. I've used Google wallet, but I limited the account to prepaid (which is now disabled by Google until it's fixed) so that worse case scenario I lost at most a few dollars.

The issue also showcases why I'm supportive of ISIS and Google Wallet competing, and hope neither of them actually "win" any kind of status as the go-to mobile payments service. With the two competing against each other, they will both be in a constant state of development and improvement. As it stands now though... mobile payments is still in its infancy (embryonic actually).

[avt123]

Exactly. I don't think I read anything about Android being the issue, but the app itself is. Rooting just made it easier at first (obviously) and stock wasn't hard as well.