Google Wallet Cracker Exposes PIN on Rooted Android Devices

Using Google Wallet for shopping is incredibly convenient. Just enter your PIN, wave the phone at the reader, and your transaction is complete. If your phone got stolen, a thief would still need the PIN to make purchases, and Google Wallet locks up tight after five bad PIN guesses. However, a newly discovered vulnerability lets that thief extract the Google Wallet PIN from a rooted phone without making any bad guesses. An engineer at Web categorization provider zvelo made the discovery and reported it on the company's blog, after notifying Google.

Mining for Data

Last year security firm ViaForensics reported that Android apps for Foursquare, Netflix, LinkedIn, and others don't adequately protect the user's stored personal information. More recently ViaForensics researchers released a report on Google Wallet security. The report concluded that while full credit card numbers are well-secured, other easily extracted private information could be used for a social engineering attack.

Joshua Rubin, a researcher at zvelo, found the report interesting and dug more deeply into the data stored by Google Wallet. In the course of his investigation, he discovered a way to crack the PIN.

Hashing Things Out

The Google Wallet PIN isn't stored in plain text; that would be plain stupid. As in many security situations, Google Wallet uses a hash of the PIN instead. Hashing, sometimes called one-way encryption, involves boiling down a document, password, or other sensitive data into a special code. There's no way to get back to the original from the code, and the hashing algorithm is designed to minimize the possibility that different originals could hash to the same code.

To check whether you've entered the right password, an app simply applies the hashing algorithm to what you typed. If it matches the stored code, you got it right. The same technique can be used to verify that a document or other file hasn't been modified.

What Rubin realized is that hashing isn't effective when the number of possible originals is small. There are only 10,000 possible values for a PIN consisting of four numeric digits. He quickly whipped up a Google Wallet Cracker program that would check all 10,000 against the stored hash, revealing the correct PIN.

Protect Yourself

You might think that Google could solve this problem by moving the PIN hash inside what's called the Secure Element (SE). However, doing so could run up against a problem of legality and ownership. According to Rubin, "The fear is that Google might no longer be responsible for the security of the PIN, but rather the banks themselves." While we wait for them to work out a solution, there are a number of things you can do to prevent a thief from cracking your Google Wallet PIN.

First and foremost, don't root your phone. Doing so pokes holes in the device's existing security. Yes, there are apps that don't work on an un-rooted phone. Just say no to those apps.

Rubin recommends that you enable a lock screen option, disable USB debugging, enable full disk encryption, and keep your Android device fully up to date. These are all good steps to take for Android security, whether or not you use Google Wallet. Check Rubin's full post for full details as well as a video showing how easy it is to crack the PIN on a rooted phone.

About Our Expert

Neil J. Rubenking

Principal Writer, Security

My Experience

When the IBM PC was new, I served as the president of the San Francisco PC User Group for three years. That’s how I met PCMag’s editorial team, who brought me on board in 1986. In the years since that fateful meeting, I’ve become PCMag’s expert on security, privacy, and identity protection, putting antivirus tools, security suites, and all kinds of security software through their paces.

Before my current security gig, I supplied PCMag readers with tips and solutions on using popular applications, operating systems, and programming languages in my "User to User" and "Ask Neil" columns, which began in 1990 and ran for almost 20 years. Along the way, I wrote more than 40 utility articles, as well as Delphi Programming for Dummies and six other books covering DOS, Windows, and programming. I also reviewed thousands of products of all kinds, ranging from early Sierra Online adventure games to AOL’s precursor Q-Link.

In the early 2000s, I turned my focus to security and the growing antivirus industry. After years of working with antivirus, I’m known throughout the security industry as an expert on evaluating antivirus tools. I serve as an advisory board member for the Anti-Malware Testing Standards Organization (AMTSO), an international nonprofit group dedicated to coordinating and improving testing of anti-malware solutions.

The Technology I Use

Much of the testing I do, particularly testing with real-world ransomware, is just plain dangerous. To perform such tests safely, I sequester them inside virtual machines managed by VMWare Workstation. For cross-platform testing, I use a MacBook Air, a Google Pixel 4, and a 6th-generation iPad.

I rely on my Delphi coding skills to create and maintain small applications. These include programs to check whether an antivirus correctly handled the malware it detected, launch dangerous URLs and record the security program’s reaction, and analyze the malware that I collect for use in testing. I also wrote a tiny browser and text editor for use in testing security apps that have predefined reactions for known products.

I do my writing and research on a Dell OptiPlex desktop, relying on Microsoft Word (my fingers know all the shortcuts). Many of my articles include charts and analysis; Excel is my go-to for those. When work hours end, though, I escape the bounds of Microsoft and Windows. There’s an iPhone in my pocket, I relax with my oversized iPad, and my Kindle Oasis is always loaded with the best science fiction and fantasy.

Read the latest from Neil J. Rubenking

Read full bio