Google Wallet PIN Cracked by Brute Force Attack

First, the sky is not falling and chances are you are safe, but if you use Google Wallet, you should know that the PIN security has been cracked. Who is affected? You are vulnerable if: 

You have a phone with Google Wallet set up 

Your phone is rooted 

You don’t use lock screen security (PIN, pattern, face unlock, etc) 

You lose your phone 

Basically, you need either a Nexus S or Galaxy Nexus that has been rooted. Everyone else can stop reading now. 

What happened? 

Google Wallet stores your four-digit PIN number in a database on the phone. It uses SHA256 hex-encoding, which means all that is needed to crack the encryption is to generate at most 10,000 SHA256 hashes…a simple task for any smartphone to accomplish. This is called abrute-force attack. 

Google knows about this issue, but to fix it and make it more secure, they would have to move the PIN security to be maintained by your bank. This would force Google to update their terms of service and would require us to trust in the bank’s security. We’re not sure at the moment if this will happen. The banks may decide to simply take the risk of leaving it as it is rather than take on the responsibility of maintaining the PIN security. 

Another possible fix would be to switch from a four-digit PIN to a more secure password that requires at least six digits and a mix of letters and numbers. We’re used to these types of passwords online, but not when you’re trying to check out at a store and there are people in line behind you. Plus, anything more complicated than entering a four-digit PIN would essentially kill the product since it would simply be too inconvenient to use. I doubt this will happen. 

How can I protect myself? 

The best thing you can do to protect yourself is to configure a passcode on your lock screen. If you are rooted, you could unroot, but I’m sure most people who are rooted want to stay that way. Of course, the most important thing is to not lose your phone. 

See the vulnerability in action.The folks at zvelo have posted up a video showing how easy it is to crack the PIN.

Click for video

http://www.youtube.com/watch?v=P655GXnE_ic&feature=player_embedded