| NEW YORK
NEW YORK Feb 10 Security researchers say
they have found a vulnerability in the Google Inc
mobile payments platform which is currently available in phones
sold by Sprint Nextel Corp.
Mobile payment services that allow consumers to pay by
waving their phone at a check-out terminal instead of using a
credit card have long been available in Japan and some other
countries but are only just emerging in the United States.
Isis, a venture of Verizon Wireless, AT&T Inc and
T-Mobile USA, is expected to launch an offering to compete with
Google but has yet to announce a launch date.
The alleged vulnerability in the Google Wallet was
identified by Joshua Rubin, a senior engineer with zvelo, a
private Greenwood Village, Colorado, security firm.
Rubin developed an app dubbed Wallet Cracker that he says
can break the four-digit PIN required to launch the Google
Wallet app. He demonstrated how it works in a video on his blog
Rubin said that he had disclosed his findings to Google and
that the company "was able to confirm the issue and agreed to
work quickly to resolve it."
However, Google declined immediate comment to Reuters except
to say that it would have a response before long. Sprint
representatives were not immediately available for comment.
Google's Wallet partners also include Citigroup Inc
and payment network MasterCard.
Jimmy Shah, a security researcher for security software
specialist McAfee, said on Friday that the vulnerability did not
appear to be a very easy one to exploit.
But he said it was theoretically possible if a hacker was
able to physically steal a user's phone.
Shah said that a hacker would need time to install the
Cracker app and to install another piece of malware to disable
the phone's security system before being able to run the Cracker
app to retrieve the PIN number.
The hacker would also still need the phone itself in order
to be able to make payments using the stolen Google Wallet.
"It's a nice theoretical attack but it's not a very simple
attack," Shah told Reuters.
McAfee is owned by chipmaker Intel Corp.