The security of the PIN that protects Google Wallet transactions has been compromised — though most users won't need to worry about the issue for now, as it only applies to users who have rooted their Android smartphone. The key issue is that the PIN is stored on the device itself instead of in the secure NFC element, although it is in an encrypted format. That means that if your Android smartphone is rooted, if somebody takes your phone, he or she will be able to access the encrypted file that stores your PIN. From there, it's a relatively simple matter of running a program that uses a brute force method to guess your PIN.

Protecting yourself against this issue is a fairly straightforward matter: either don't root your phone and if you do, be sure that you've set a lock screen code to lock your device from the start. Google is aware of the issue but will apparently have to fundamentally change how Wallet's security infrastructure is set up in order to resolve the issue, moving the responsibility for securing the PIN from Google to the banks that power Google Wallet. The security firm that discovered the hole, zvelo, says that the decision on the next step "is in the banks' hands," and offers a few additional ideas for securing your device until those banks make up their mind.

Update: Google has reached out with an official statement:

The zvelo study was conducted on their own phone on which they disabled the security mechanisms that protect Google Wallet by rooting the device. To date, there is no known vulnerability that enables someone to take a consumer phone and gain root access while preserving any Wallet information such as the PIN. We strongly encourage people to not install Google Wallet on rooted devices and to always set up a screen lock as an additional layer of security for their phone.



