PSA: Google Wallet susceptible to 'brute-force' PIN attacks (update: affects rooted products)

Security hounds at zvelo have found a vulnerability in the search engines Wallet which means your precious PIN could be "easily revealed." Digging with the app's code and taking advantage of Google's open assets to show its contents, they uncovered a piratical treasure chest of information: unique user IDs, Google username and passwords, and also the PIN saved like a SHA256 hex-encoded string. Because this string may carry four numbers, it takes only a "trivial" brute-pressure attack including no more than 10,000 information to decode it. To prove their point, the scientists designed a Wallet Cracker application -- demoed following the break -- that does the task faster than you are able to say "unpredicted overdraft."

Google continues to be receptive to those findings, nevertheless its attempts in a fix have to date been hampered by the necessity to coordinate using the banks, since altering how a PIN is saved may also change which agency accounts for its security. Meanwhile, zvelo recommends that you will find some measures customers may take themselves, apart from placing a protective give their pockets: avoid rooting your phone, enable your lock screen, disable USB debugging, enable Full Disk File encryption and your phone up-to-date.

Update: Google has responded by emphasizing it's only customers of rooted products who're in danger. Inside a statement to TNW it stated: "We strongly persuade folks not to install Google Wallet on rooted products and also to always generate a screen lock being an additional layer of to safeguard their phone."

[Because of everybody who sent this in.]

Continue reading through PSA: Google Wallet susceptible to 'brute-force' PIN attacks (update: affects rooted products)

PSA: Google Wallet susceptible to 'brute-force' PIN attacks (update: affects rooted products) initially made an appearance on Engadget on Thu, 09 February 2012 05:07:00 EDT. Please visit our terms to be used of feeds.

Permalink      zvelo    Email this   Comments

solar power government