[Samsung Galaxy Nexus] miasma:
I am finally able to disclose a major vulnerability I found in Google Wallet.

The vulnerability is that the Google Wallet PIN can be exposed without a single invalid attempt. This renders all the security of the secure element void.

Please see below for our press release, detailed blog posting, demonstration app and source code.

Feel free to ask me any questions or report any issues.

The app is also able to give you some useful information about the state of your secure element. This may be helpful for people with SE issues.

https://zvelo.com/news/press-releas...vers-google-wallet-pin-security-vulnerability

https://zvelo.com/blog/entry/google-wallet-security-pin-exposure-vulnerability

http://dl.dropbox.com/u/10770509/WalletCracker.apk

https://github.com/rubixconsulting/WalletCracker

Here is a video demonstration of the vulnerability:

[YOUTUBE]P655GXnE_ic[/YOUTUBE]

We reported this issue to Google on December 21.

Google has a fix, but it is up to the banks to decide if it will be released. We are hoping the publicity will cause the banks to make the right decision.

Right now, there is a possibility that the fix will never be released.

Google believes that the change required may constitute a "change of agency" regarding who does the PIN verification (if it is done inside the secure element). If the banks then become responsible for the PIN verification, the PIN becomes subject to the same regulations and procedures as an ATM PIN. The banks may choose to accept the risk as is rather than take on the increased cost and overhead associated with the change. Please spread the word so that we might be able to leverage them to make the correct decision.

What can you do to lower your risk profile?

Reset Google Wallet from within the wallet app itself, then uninstall it (this wipes everything from the device)

-- OR -- (any one of these will help, but #1 is the most important)

1. Add a screen lock (not the slide lock)

2. Disable USB debugging

3. Enable full disk encryption

4. Unroot if rooted

5. Use only the stock ROM and ensure it is up to date

6. Install an app that gives you the ability to "remotely wipe" the device if it is lost (lookout is one example)

EDIT: DETAILS OF SECOND VULNERABILITY

Regarding the second vulnerability announced today. This is the issue where, by uninstalling or resetting the Wallet App, and then re-configuring it for the same user, they are given the chance to enter a new PIN and will gain access to the previous user's prepaid card.

We had planned on not disclosing this vulnerability until later, but since it is already public, I can report that we were aware of it as well.

We reported it to Google on January 4th and they are presently working on a fix for it.

The fix involves, partially, linking the prepaid account to the users GAIA (Google account) instead of the hardware device ID. But they still have not confirmed to me how they will challenge a user to prove their identity before re-activating a previously activated prepaid card.

Please note that this issue ONLY affects people's pre-paid accounts, not Citi MasterCard or any other type of account in Google Wallet.

EDIT 2: CLARIFICATION ON WHO IS AT RISK

We have just added a new post that details why users who have not already rooted their phones are still at risk from these Google Wallet issues. We believe there was a lot of confusion about what it means to be rooted as compared to just attaining root privileges.

The issues we bring up, surrounding privilege escalation vulnerabilities, have grave consequences for android (and all mobile device) security, not just Google Wallet.

Hopefully our discussion of these issues will make developers more aware of them before they are written into new apps.

https://zvelo.com/blog/entry/google-wallet-security-about-that-rooted-device-requirement