Sprint Adds Google Wallet Into New NFC Capable Phones

The New Acunetix V12 Engine


Oh look, another aspect of security and privacy to consider as Google pushes its’ mobile payment solution ‘Wallet’ onto two new NFC capable phones – the Galaxy Nexus & LG Viper.

If you haven’t heard of the service you can find out more here – Google Wallet (Wikipedia).

The main concern here (security wise) is that this relies on a secure storage on the phone of your cryptographic keys that allow you to carry out transactions.

Sprint’s two newly announced 4G handsets both support Google Wallet, bringing an important boost to Google’s aspirations, but they also hammer the death nail into WiMAX in the USA.

Sprint’s last 4G handset, the “Sprint Nexus S 4G”, was a WiMAX device, but Sprint has admitted backing the wrong 4G horse and is now transitioning to LTE across its network. So the operator will now be selling Google’s Galaxy Nexus and LG’s Viper handsets, both with support for Google Wallet for those wanting pay-by-bonk functionality.

Supporting the ability to make payments by tapping the phone against a reader isn’t just a matter of supporting Near Field Communications (NFC), you also need a secure element in which to store the cryptographic keys, which will be under the control of a mutually-trusted party, and then an application with which to make the payments.

Both the Galaxy Nexus and the Viper have a module built into the phone, under the control of Google – which is trusted by Mastercard and Visa. So far only Google itself and Citibank have created applications with which a user can make payments, and despite offering to pay for users’ groceries, Google Wallet is proving something of a slow burner at best.

I’d imagine the wallet system will have functionality to auto-reload from your credit card too, so if someone can manage to grab those cryptographic keys from the ‘secure’ area on your phone – you might be in for a surprise when you get your next credit card statement.

The plus side is, the adoption rate so far seems to be super low – so it’s not much of a risk right now.


It has not been helped by Verizon asking to have the functionality disabled in its spin of the Galaxy Nexus. The operator claims the decision was down to integration issues, but it is widely believed to have made the call in order to hold back a competitor until the US-operator-consortium wallet, ISIS, comes online.

ISIS uses a secure element held in the SIM – and thus under the operators’ control – and should work with any handset supporting the SWP (Single Wire Protocol) standard for NFC/SIM communications.

So once ISIS is available then the operators will start pushing it out to everyone with an SWP-supporting handset, including the Google Galaxy Nexus and LG Viper. Google needs to move fast and grab some market share before the operators shut it out, which is why these new handsets are so important to the Chocolate Factory as well as to Sprint.

There’s a whole lot of politics going on too with a new mobile payment system set to come online soon – ISIS – founded by…wait for it…AT&T, T-Mobile and Verizon. Yah, screw whoever tries to mess with ISIS – because they are gonna be in big trouble – the only major US operator missing is Sprint.

I’m guessing that’s why they are going with Google Wallet, there’s a very short article on Wikipedia about ISIS here.

Source: The Register

Posted in: Cryptography, Hardware Hacking, Privacy


Latest Posts:


HTTP Security Considerations - An Introduction To HTTP Basics HTTP Security Considerations – An Introduction To HTTP Basics
HTTP is ubiquitous now with pretty much everything being powered by an API, a web application or some kind of cloud-based HTTP driven infrastructure. With that HTTP Security becomes paramount and to secure HTTP you have to understand it.
Cangibrina - Admin Dashboard Finder Tool Cangibrina – Admin Dashboard Finder Tool
Cangibrina is a Python-based multi platform admin dashboard finder tool which aims to obtain the location of website dashboards by using brute-force, wordlists etc.
Enumall - Subdomain Discovery Using Recon-ng & AltDNS Enumall – Subdomain Discovery Using Recon-ng & AltDNS
Enumall is a Python-based tool that helps you do subdomain discovery using only one command by combining the abilities of Recon-ng and AltDNS.
RidRelay - SMB Relay Attack For Username Enumeration RidRelay – SMB Relay Attack For Username Enumeration
RidRelay is a Python-based tool to enumerate usernames on a domain where you have no credentials by using a SMB Relay Attack with low privileges.
NetBScanner - NetBIOS Network Scanner NetBScanner – NetBIOS Network Scanner
NetBScanner is a NetBIOS network scanner tool that scans all computers in the IP addresses range you choose, using the NetBIOS protocol.
Metta - Information Security Adversarial Simulation Tool Metta – Information Security Adversarial Simulation Tool
Metta is an information security preparedness tool in Python to help with adversarial simulation and assess security defense preparation and alerts.


Comments are closed.