Zvelo engineer Joshua Rubin has released details of a security vulnerability in rooted Android phones running Google Wallet. Rubin was able to crack and expose the four digit PIN used to protect access to Google Wallet and recommends that Android NFC phone users who want to use Google Wallet do not root their phones.

In a blog entry Rubin reveals that a hidden file on a phone running Google Wallet contains data that can be decoded to reveal an encrypted PIN:

The lynch-pin, however, was that within the PIN information section was a long integer “salt” and a SHA256 hex encoded string “hash”. Knowing that the PIN can only be a 4-digit numeric value, it dawned on us that a brute-force attack would only require calculating, at most, 10,000 SHA256 hashes. This is trivial even on a platform as limited as a smartphone.

“Google Wallet allows only five invalid PIN entry attempts before locking the user out,” Rubin continues. “With this attack, the PIN can be revealed without even a single invalid attempt. This completely negates all of the security of this mobile phone payment system.”

Rubin proposes that the only way to properly solve the issue is to move the PIN verification to the secure element, but goes on to outline why this may be difficult to do quickly.

Zvelo has disclosed its findings to Google and says the company “confirmed the PIN vulnerability and moved quickly towards releasing a fix”.

A video produced by Zvelo shows Rubin’s “Wallet Cracker” app in action:

Update: Google has issued the following statement:

“The Zvelo study was conducted on their own phone on which they disabled the security mechanisms that protect Google Wallet by rooting the device. To date, there is no known vulnerability that enables someone to take a consumer phone and gain root access while preserving any Wallet information such as the PIN.

We strongly encourage people to not install Google Wallet on rooted devices and to always set up a screen lock as an additional layer of security for their phone.”

Next: Visit the NFCW Expo to find new suppliers and solutions