Google Wallet Hacked Again: This time it's scarier - simple and no root needed

[dgstorm]

Security systems seem to fall quickly with today's tech, but this particular bit of news makes you wonder how such an obvious design flaw made it past Google to begin with. Just one day after we found out about an exploit in Google Wallet that would allow a phone thief to "brute force" hack his way into your mobile wallet account, a far easier method than the previous one has been discovered. In fact, this easier method doesn't even require your phone to be rooted, nor does it require the thief to be very tech-savvy at all. Here's a quote from the Talk Android article with the details,

Basically all individuals have to do to access a user’s funds is clear the data in the app settings— which forces Google Wallet to prompt them to enter a new PIN. After the new PIN is entered, it’s as simple as adding a Google Prepaid Card tied to the device and then there the ability to access any available funds.

That's pretty scary, and what is even more scary is that this has been confirmed by multiple sources, and Google even issued a statement on the issue,

”We strongly encourage anyone who loses or wants to sell their phone to call Google Wallet support toll-free at 855-492-5538 to disable the prepaid card. We are currently working on an automated fix as well that will be available soon. We also advise all Wallet users to set up a screen lock as an additional layer of protection for their phone.”

You can see the exploit in action in the video above. Hmmm... if I wanted to use the Google Wallet service, I think I would consider waiting until Google worked out a fix for this. What do you guys think?

Source: Android.net via TalkAndroid

[syndicate0017]

I stated in a thread about this last night that its really not a big deal. Its still safer than losing your wallet. Plus if my phone is lost/stolen, first thing I'm doing is reporting it to Verizon who will block all phone and data access on the device rendering Google wallet useless anyway.

Sent from my Galaxy Nexus using Tapatalk

[2THEXTRM]

I dont even keep the paypal app on my phone. Google offering $10 to open an account shows how eager they were to get into the electronic funds biz. Their greed apparently outweighed the security issues of their clients. Glad i dont have a phone capable of using wallet.

Sent from my VTAB1008 using DroidForums

[Dusty]

So, once again the lesson to the story is...


PUT A LOCK SCREEN ON YOUR JUNK.

Seems to be some type of a pattern here. Hmmm.
I mean, seriously!? How hard is it for people to understand that if you are going to use your device as a sensitive information access point you may want to AT LEAST lock the front door!

[dgstorm]

So, once again the lesson to the story is...


PUT A LOCK SCREEN ON YOUR JUNK.

Seems to be some type of a pattern here. Hmmm.

Very wise advice! And, as you point out... it should be obvious.
I mean, seriously!? How hard is it for people to understand that if you are going to use your device as a sensitive information access point you may want to AT LEAST lock the front door!

This is very wise advice! And, as you pointed out... it should be obvious.

[akhenax]

I find it hilarious that users were complaining and hacking their devices and concocting an install process to install Google Wallet.

I never thought I would say this, but Big Red was right all along.

[sb1831]

I find it hilarious that users were complaining and hacking their devices and concocting an install process to install Google Wallet.

I never thought I would say this, but Big Red was right all along.

True. I remember when everyone was pissed because they thought they Galaxy Nexus was being delays because of Google Wallet. It turns out the app has no place on a phone to begin with and VZW was right.

[wolstonc]

Its harder to install Google wallet than it is to hack it. But I still wouldn't call vzw right. They had no idea of this when they decided to block it

Sent from my Galaxy Nexus using DroidForums

[Dusty]

I'd be willing to bet the rest of the money I make for the rest of the year that the primary reason VZW was against Google Wallet was because they didn't get a cut in the action. They spend more time and money in trying to lure you into using their bloat than security measures.

[syndicate0017]

I'd be willing to bet the rest of the money I make for the rest of the year that the primary reason VZW was against Google Wallet was because they didn't get a cut in the action. They spend more time and money in trying to lure you into using their bloat than security measures.

Exactly. It has nothing to do with a "design flaw" that is easily counteracted by being pro-active and de-activating your phone in the event it's lost or stolen. That's why VZW is trying to create a wallet-like app of their own. They don't get a cut out of Google Wallet.