Incident: Google Wallet PIN Hack Vulnerability Impacting Users' Funds.

Published Date: 2012-02-10

Postmortem Analysis
Timeline 1. The software failure incident of the Google Wallet hack happened on the date the article was published, which is February 10, 2012. [10156]
System The system that failed in the Google Wallet software failure incident was: 1. Google Wallet app [10156]
Responsible Organization 1. Hackers identified by researchers and bloggers [10156] 2. Google Wallet app vulnerability [10156]
Impacted Organization 1. Google Wallet users [10156]
Software Causes 1. The software cause of the failure incident was a vulnerability in the Google Wallet app that allowed a stranger to gain access to the funds of Wallet users by clearing the data for the app in the smartphone's application settings menu, prompting the person to enter a new PIN upon relaunching the app [10156].
Non-software Causes 1. Lack of proper security measures in the Google Wallet app [10156] 2. Vulnerability of the Google Wallet PIN system [10156]
Impacts 1. The software failure incident allowed strangers to gain access to the funds of Google Wallet users by exploiting a vulnerability that didn't require extra software, root access, or specific skills [10156]. 2. The incident raised concerns about the security of Google Wallet, potentially leading to a loss of trust among users who may fear unauthorized access to their funds [10156]. 3. Google had to respond to the incident by advising users to contact support to disable the prepaid card, recommending setting up a screen lock for additional protection, and working on an automated fix to address the vulnerability [10156].
Preventions 1. Implementing a more secure authentication method for Google Wallet transactions, such as biometric authentication or two-factor authentication, could have prevented the software failure incident [10156]. 2. Conducting thorough security testing and audits of the Google Wallet app to identify and address vulnerabilities before they can be exploited by hackers could have prevented the software failure incident [10156]. 3. Providing regular software updates and patches to address security vulnerabilities and enhance the overall security of the Google Wallet app could have prevented the software failure incident [10156].
Fixes 1. Google Wallet users who lose their phones should call Google Wallet support at 855-492-5538 to disable the prepaid card [10156]. 2. Google is working on an automated fix that will be available soon to address the vulnerability [10156]. 3. Google advises all Wallet users to set up a screen lock as an additional layer of protection for their phone [10156].
References 1. The Smartphone Champ 2. Zvelo 3. Android and Me 4. Google spokesperson (as reported by CNET) [10156]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident related to Google Wallet hacking has happened again within the same organization. The article mentions a new hack that could let a stranger gain access to the funds of Google Wallet users, following an earlier hack reported by security blogging site Zvelo [10156]. This indicates a recurring issue with the security of Google Wallet within the same organization.
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the Google Wallet hack incident described in Article 10156. The vulnerability allowed a stranger to gain access to the funds of Wallet users by exploiting a flaw in the design of the Google Wallet app. By simply clearing the data for the app in the smartphone's application settings menu, the app could be reset, prompting the person to enter a new PIN and granting access to the owner's funds. This flaw in the design of linking the Google Wallet information to the device rather than the actual account contributed to the security breach [10156]. (b) The software failure incident related to the operation phase is evident in the Google Wallet hack as well. The ease with which the hack could be performed, requiring minimal technical skills and time, highlights an operational vulnerability in the system. The fact that the new hack did not require root access to the device, unlike a previous hack, indicates a weakness in the operational security measures of the Google Wallet system. This operational flaw made it easier for anyone to exploit the vulnerability within a matter of minutes, emphasizing the importance of operational security in preventing such incidents [10156].
Boundary (Internal/External) within_system (a) The software failure incident described in the article is within_system. The hack to gain access to Google Wallet funds does not require extra software, root access, or any particular skills in general. It involves clearing the data for the Google Wallet app within the smartphone's application settings menu, which then prompts the person to enter a new PIN the next time it launches, allowing access to the owner's funds [10156].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in the article is related to non-human actions. The hack described in the article does not require extra software, root access, or any particular skills in general. It involves a method where clearing the data for the Google Wallet app in the smartphone's application settings menu can reset the app and prompt the person to enter a new PIN, allowing access to the owner's funds [10156]. (b) The software failure incident in the article is also related to human actions. The hack described in the article can be performed by anyone within a matter of minutes, indicating that human actions can easily exploit this vulnerability. Additionally, the article mentions that Google advises users to set up a screen lock as an additional layer of protection, suggesting that human actions like not setting up proper security measures can contribute to the failure [10156].
Dimension (Hardware/Software) software (a) The software failure incident related to hardware: - The incident reported in the article is not directly attributed to hardware issues but rather to vulnerabilities in the Google Wallet software itself. The hack described in the article does not require any specific hardware manipulation but rather exploits a flaw in the Google Wallet app that allows unauthorized access to funds [10156]. (b) The software failure incident related to software: - The software failure incident described in the article is directly related to software vulnerabilities in the Google Wallet app. The hack detailed in the article exploits weaknesses in the app's security protocols, allowing unauthorized individuals to reset the app and gain access to the user's funds without needing root access or additional software [10156].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident described in Article 10156 is malicious in nature. The incident involves a hack that allows a stranger to gain access to the funds of Google Wallet users by exploiting a vulnerability in the Google Wallet app. The hack does not require extra software, root access, or specific skills, making it accessible to anyone within a matter of minutes. This malicious exploit poses a significant security risk to users' funds stored in Google Wallet [10156]. (b) The incident is non-malicious in the sense that it is not caused by accidental errors or system faults but rather by a deliberate exploitation of a vulnerability in the Google Wallet app. The hack described in the article is a result of a specific sequence of actions that can be taken to reset the app and prompt the user to enter a new PIN, thereby gaining unauthorized access to the funds linked to the device. This deliberate action by an individual to exploit the security flaw in the app falls under the category of a malicious software failure incident [10156].
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident related to the Google Wallet hack can be attributed to poor decisions made in the design and implementation of the Google Wallet app. The hack allowed strangers to gain access to users' funds by simply clearing the data for the Google Wallet app on the smartphone, resetting it, and prompting the person to enter a new PIN without requiring any extra software, root access, or particular skills [10156]. This design flaw in linking the Google Wallet information to the device rather than the actual account contributed to the vulnerability exploited by the hack. Additionally, the earlier hack reported by security blogging site Zvelo required root access to the device, indicating potential shortcomings in the security measures implemented in the Google Wallet app.
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident related to development incompetence is evident in the Google Wallet hack described in Article 10156. The hack to crack the Google Wallet PIN and gain access to users' funds did not require extra software, root access, or any particular skills. This lack of robust security measures and vulnerability in the system design can be attributed to a lack of professional competence in ensuring the safety and integrity of the payment system. (b) The accidental nature of the software failure incident is also highlighted in the same article. The hack to reset the Google Wallet app and prompt the user to enter a new PIN was a simple process that could be performed by anyone within a matter of minutes. This ease of exploiting the system without the need for specialized skills or tools indicates an accidental oversight or flaw in the design or implementation of the Google Wallet software.
Duration temporary The software failure incident described in the article is more aligned with a temporary failure rather than a permanent one. The incident involves a hack that allows a stranger to gain access to Google Wallet users' funds by exploiting a vulnerability in the Google Wallet app on smartphones. The hack is described as not requiring extra software, root access, or particular skills, making it relatively easy to perform within a matter of minutes. Google is also working on an automated fix to address the vulnerability, indicating that the issue is not a permanent one but rather a temporary flaw that can be remedied [10156].
Behaviour value (a) crash: The incident described in the article does not involve a crash where the system loses state and stops performing its intended functions. Instead, it involves a security vulnerability that allows unauthorized access to Google Wallet funds [10156]. (b) omission: The incident does not involve the system omitting to perform its intended functions at an instance(s). It is more about a security flaw that allows a stranger to gain access to the funds of Google Wallet users [10156]. (c) timing: The incident is not related to the system performing its intended functions too late or too early. It is primarily about a security vulnerability that can be exploited to reset the Google Wallet app and gain access to the owner's funds [10156]. (d) value: The software failure incident is related to the system performing its intended functions incorrectly. Specifically, the vulnerability allows a person to use the Google prepaid card tied to the device to gain full access to the owner's funds without authorization [10156]. (e) byzantine: The incident does not involve the system behaving erroneously with inconsistent responses and interactions. It is more about a straightforward security vulnerability that can be exploited to reset the Google Wallet app and access funds [10156]. (f) other: The behavior of the software failure incident can be categorized as a security vulnerability that allows unauthorized access to Google Wallet funds by exploiting a flaw in the app's reset process [10156].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident described in the article relates to a hack on Google Wallet that could allow a stranger to gain access to the funds of Wallet users. By exploiting a vulnerability in the Google Wallet app, an individual could clear the data for the app on a smartphone, prompting the user to enter a new PIN. Since the Google Wallet information is linked to the device and not the actual account, the hacker could then use the Google prepaid card tied to the device to gain full access to the owner's funds [10156]. This demonstrates a direct impact on people's property, specifically their money stored in the Google Wallet accounts.
Domain finance (a) The failed system in this incident is related to the finance industry as it involves the Google Wallet PIN used for making purchases with the smartphone-based payment system [10156].

Sources

Back to List