5 ms·

Google Wallet hacked again; new exploit doesn't need root access [video]

35 points by kemper 15y ago

cleverjake 15y ago
Does this only affect the prepaid card, as opposed to the ones that are added by the user?
ge0rg 15y ago
TL;DR: By deleting the Wallet application data from Android prefs you can assign a new PIN and access the Wallet (e.g. on a stolen phone). This looks like a typical authentication-done-wrong problem on Google's side here... Not sure if it really qualifies for the name "hack" though.
- joenathan 15y ago
  This only works if you don't have a lock screen gesture or lock screen pin, and if you don't have one of those then you must not be concerned about others having access to your data.
  - barrkel 15y ago
    Defense should be defense in depth. Just because I once left my front door open overnight doesn't mean I don't value all my possessions.
    - joenathan 15y ago
      Not setting your lock screen security is not like leaving your front door open once, it's like not having a front door at all.
      - barrkel 15y ago
        Gesture screen lock security is no security at all - smudges mean the screen can almost always be unlocked at will. More likely is an encrypted phone with PIN or password entry on startup (that's what I use). But that still leaves the phone open to use when it's powered up, in standby. There's a reason why password change dialogs in OSes ask for your previous password before letting you change it. Just relying on a single layer is foolhardy. For things as critical as money, you need multiple hurdles.
casca 15y ago
This shows particularly poor design by Google. There are a number of ways that mobile devices can be compromised and Google cannot account for all of them, but this is the most basic level. If you're trying to protect an application from a device that's been stolen, assume that the attacker has unlocked, physical access. The only platform that has a claim to a safe lock-screen is Blackberry because they: - Require the password before allowing any USB access - Will wipe the device after 5 failed password entries by USB or on the console
- tehaugmenter 15y ago
  This is why large scale companies will most likely never move to an Android based device. Sad but true. Blackberries they control through their BES Server and set the failed attempts to anything they want. Its like having Active Directory on a phone system.
  - abraham 15y ago
    Android supports device administration which can be used to required pins/passwords, require encryption, and even remotely whip the device. http://developer.android.com/guide/topics/admin/device-admin.html http://developer.android.com/guide/topics/admin/device-admin...
mpclark 15y ago
It's worth noting that this and other recent problems are only with Google's mobile wallet implementation, not an issue with NFC.

35 points by kemper 15y ago

Does this only affect the prepaid card, as opposed to the ones that are added by the user?

ge0rg 15y ago

TL;DR: By deleting the Wallet application data from Android prefs you can assign a new PIN and access the Wallet (e.g. on a stolen phone). This looks like a typical authentication-done-wrong problem on Google's side here... Not sure if it really qualifies for the name "hack" though.

joenathan 15y ago
This only works if you don't have a lock screen gesture or lock screen pin, and if you don't have one of those then you must not be concerned about others having access to your data.
- barrkel 15y ago
  Defense should be defense in depth. Just because I once left my front door open overnight doesn't mean I don't value all my possessions.
  - joenathan 15y ago
    Not setting your lock screen security is not like leaving your front door open once, it's like not having a front door at all.
    - barrkel 15y ago
      Gesture screen lock security is no security at all - smudges mean the screen can almost always be unlocked at will. More likely is an encrypted phone with PIN or password entry on startup (that's what I use). But that still leaves the phone open to use when it's powered up, in standby. There's a reason why password change dialogs in OSes ask for your previous password before letting you change it. Just relying on a single layer is foolhardy. For things as critical as money, you need multiple hurdles.

casca 15y ago

This shows particularly poor design by Google. There are a number of ways that mobile devices can be compromised and Google cannot account for all of them, but this is the most basic level. If you're trying to protect an application from a device that's been stolen, assume that the attacker has unlocked, physical access. The only platform that has a claim to a safe lock-screen is Blackberry because they: - Require the password before allowing any USB access - Will wipe the device after 5 failed password entries by USB or on the console

tehaugmenter 15y ago
This is why large scale companies will most likely never move to an Android based device. Sad but true. Blackberries they control through their BES Server and set the failed attempts to anything they want. Its like having Active Directory on a phone system.
- abraham 15y ago
  Android supports device administration which can be used to required pins/passwords, require encryption, and even remotely whip the device. http://developer.android.com/guide/topics/admin/device-admin.html http://developer.android.com/guide/topics/admin/device-admin...

mpclark 15y ago

It's worth noting that this and other recent problems are only with Google's mobile wallet implementation, not an issue with NFC.