Home

Sunday, May 29, 2011

Google Wallet Security Has a Weakness

Google unveiled details of Google Wallet this week. Google Wallet is an ambitious mobile payment plan designed to let your Android smartphone be your wallet, but you should consider very carefully just how secure your credit card data will be in Google Wallet.

Don't get me wrong, Google understands the inherent security risks of storing credit card information, and it has gone to great lengths to ensure sensitive data is protected in every way possible. But, at the end of the security chain is an "authorized" Android app, and that is the Achilles heel of Google Wallet security.

The Wallet app could be the weak link in Google Wallet security.Consider the whole system, and the steps of the process. On the processing end, you really have nothing to worry about. The NFC technology used by Google is not any different than the wireless signals used in many credit and debit cards, or gas station swipe-to-pay systems now.

I can already tap properly-equipped payment terminals--like those at most McDonald's--to make payments with my Chase Bank debit card, so doing the same thing with my smartphone wouldn't be any less secure per se. On the back end, the processing and storage of my credit card information is still being protected by the PCI-DSS (payment card industry data security standards) rules that govern such things.

That credit card data is also stored on the Android smartphone. But, Android smartphones equipped for NFC mobile payments have a separate chip to store the sensitive credit card data. The credit card information is encrypted and the chip itself is tamper proof. Seems secure enough, even if a thief has physical possession of the smartphone.

Then comes the weak link--the Android app. Here too, Google has done its part and developed a system that relies on a PIN from the user to open the app or initiate a transaction using Google Wallet. That alone represents one weak point in the Google Wallet security. Have you seen the kinds of passwords people use because they can't be bothered to remember something more complex? How many Google Wallet PINs will end up being "1111", or "1234", or something equally trivial to guess?

But, even with a strong PIN in place, if there is one Android app that can access the encrypted credit card data and process payments, then it is possible for malicious developers to create other apps, or spoof the Google Wallet app somehow to access that sensitive data as well.

Jimmy Shah, mobile security researcher at McAfee Labs, points out in a blog post that the secure chip that stores the credit card information uses assymetric encryption for authentication--implying that the Google Wallet app contains the key necessary to authenticate and access the data, and that attackers can hack or reverse-engineer the Wallet app to extract that key.

Shah says, "The next step would be to create a malicious application that emulates the official Wallet app to fool the "secure element" chip into giving up your credentials. From here, the attacker can collect account information for sale or for attempts at cloning the data to new NFC cards."

On an iPhone this might be less of a concern because of the walled garden approach and the fact that iPhone apps have to get past the Apple gatekeepers first. But, with the "open" environment of Android, and all of the various unofficial Android app marketplaces out there, distributing a malicious app capable of cracking Google Wallet might not be too difficult.

I am not trying to suggest that Google Wallet is completely insecure, or scare you away from using it. I am still looking forward to the day when mobile payments using a smartphone becomes a mainstream method of doing business. But, I do think you need to be aware of the potential security holes in the system so you can exercise an appropriate level of caution when using Google Wallet.

Google Pulls Yongzh's Emulator Apps Off Android Market

The no-man's land of software development. Video game console and handheld manufacturers don't like 'em but, legally, there's only so much they can do against them.
Well, be it the result of manufacturer complaints or other issues, Google has taken a heavy hand against one of the Android emulation scene's brightest stars. The company has suspended the Android developer account for Yongzh, otherwise known as Yong Zhang. He's the creator of the popular "-oid" series of android emulation apps, including Nesoid, Snesoid, N64oid, and Gameboid, to name a few.
According to Zhang, his developer account has been officially removed from Google's Android Market and all his apps have been deleted. This was allegedly Zhang's primary moneymaker. Though he's since moved his emulation apps over to the third-party market SlideME, he's listed them all as free downloads. Zhang says that the apps will stay free for a bit of time as prior purchasers migrate over to the new app store—presumably so that they can receive the latest updates for the emulators as Zhang releases them.
So what got Zhang the boot? Or, rather, who? Neither Zhang nor Google have commented on the primary source of the complaints against the developer's emulator apps. While most speculate that one of the Big Three are behind the purge–Nintendo, Sony, or Microsoft–there's also speculation that Zhang allegedly violated the open source licenses for projects that parts of his programs were derived from.
Depending on the terms of the licensing, Zhang could have likely still charged money for his applications. He would have probably had to release the source code for anything he created, however–violating this principle would open Zhang's apps up for takedown requests.
If one of the manufactures went after Zhang, it's likely more an issue of trademark than of the legality of an emulator itself. Sony has previously lost lawsuits against emulator developers when the company attempted to argue that the software was itself illegal (based on various claims).
Following the company's two big losses after it went after PlayStation emulators Bleem! And Connectix Virtual Game Station, Sony has found more success in pursuing claims of trademark infringement against emulator developers instead of outright illegality. For example, the company was successfully able to pull the PlayStation emulator "PSX4Droid" off the Android Market, likely the result of the use of the company's trademarked "PSX" acronym within the app's title.
And don't forget: While emulators might be legal to download (in some cases), the corresponding ROM files—copies of a game's core data–are themselves illegal to download! Hey, we didn't say it wasn't confusing... as Zhang himself is likely learning right now.

Rivals likely to reach for Google's "Wallet"

NEW YORK — With the announcement of "Google Wallet" the Internet giant became the first player to dash into a future where people use smartphones as credit cards, but rivals are expected to cut its lead short.
EBay quickly threw up a hurdle in the form of a lawsuit accusing Google of building the mobile payments platform with trade secrets swiped from the online auction titan's PayPal financial transactions unit.
Apple, Amazon.com, eBay and Facebook are each believed to be working on ways to let people use smartphones to pay for items or services but Google was the first to introduce such a system, in the form of "Google Wallet."
At this point, the move is largely symbolic. A test version of the system will go to live in coming months in just two US cities, New York and San Francisco.
Google Wallet will work with Android-powered phones like Google's Nexus S equipped with near-field-communication (NFC) chips, serviced by US telecom Sprint and only at merchants that have partnered with Google for the launch.
Google partners on the mobile payment platform include major chains such as Macy's, Subway sandwiches, and American Eagle Outfitters clothing shops.
For Justin Post, financial analyst at Bank of America Merrill Lynch, being first into the market with Wallet positions the California Internet firm as an early leader in mobile payments.
"Google Wallet has big ambitions but also faces great obstacles, but (its operating system for mobile) Android and location-based search are key assets that could help launch the ecosystem," he said.
Within hours of the unveiling of Wallet on Thursday, eBay and PayPal filed a lawsuit charging that Google tapped into the online financial transaction service's know-how for the mobile payments project.
PayPal spent three years trying to work out a deal in which it would handle payments for Android smartphones, only to see Google scuttle the talks and hire PayPal lead negotiator Osama Bedier, according to court documents.
"Silicon Valley was built on the ability of individuals to use their knowledge and expertise to seek better employment opportunities, an idea recognized by both California law and public policy," a Google spokesman told AFP.
"We respect trade secrets, and will defend ourselves against these claims."
Bedier worked at the eBay-owned online financial services unit as a vice president of platform, mobile, and new ventures until being hired in January by Google.
Piper Jaffray analyst Gene Munster saw the lawsuit as "a sign that (PayPal and eBay) are nervous that they have big players coming after them."
Boston University professor of law Michael Meurer shared two possible theories based on the apparent merits of the freshly-filed lawsuit.
Bedier is either a bad guy who stole trade secrets or PayPal "is a bit desperate, sees that Google is going to enter their market in a big way and will try to do whatever it can to delay Google," Meurer theorized.
Even if the lawsuit fails, the litigation can disrupt Google's momentum as executives and engineers spend time testifying and PayPal perhaps tries to get the court to stall the service until matters are resolved.
No matter how the case plays out, Google can expect to see other Internet titans enter the mobile payments arena.
"It's nice to be first to market...but it's going to be a ramp-up and there are going to be different approaches to this," said PeekYou website founder Michael Hussey, who keeps watch on the Internet economy.
"Amazon is going to want something I'm sure...Apple definitely has got to do something," he continued.
Apple's beloved iPhones are already compatible with Square software for accepting credit card payments and rumors building ahead of an Apple developers conference in June include talk that the smartphones may get NFC chips.
Apple gadget fans already trust the California company with financial information and are in the habit of shopping at iTunes and the App Store.
Internet retail powerhouse Amazon is also, understandably, in a strong position to add a smartphone payments platform to its service.
Globally popular online social network Facebook has been improving smartphone features and weaving deals at local shops into its platform, making the ability to consummate transactions a natural next step.

Intel to Map Plans for $200 Million, 10,000 Seniors Health Study

Intel Corp. will help fund work on a proposal for a $200 million study of technology used to provide in-home care for seniors, Eric Dishman, an Intel fellow and director of health innovation, said in an interview.

The study will examine use of technology by 10,000 seniors, Dishman said. Intel is looking for partners that can put up funding for the proposal and the study, and will complete a proposal outlining the study this year, he said.

As part of a five- to 10-year endeavor, researchers plan to use sensors, Web-connected computers and other devices to capture data about seniors’ daily activities, such as when they take medicine and how quickly they move about the house. The purpose is to prove that the technology can track cognitive and physical decline and to understand how technology can help providers better care for seniors in home settings, rather than hospitals and other facilities where care costs have skyrocketed in recent years. The market for so-called aging-in-place technology is expected to surge. Global revenues from home monitoring of patients with diseases like diabetes and cardiac arrhythmia should rise to $16.6 billion in 2015, from $11 billion last year, according to Swedish consultant Berg Insight.

“There are likely to be more older people who’ll need assistance living at home,” Andre Malm, senior analyst at Berg, said in an interview. “It’s a way to improve quality of living for patients who want to live at home. What’s needed is good, independent research” to prove that at-home technologies work. The number of Americans aged 65 or older will rise to 72.1 million by 2030, up from 39.6 million in 2009, according to Administration on Aging.

One goal is to prove that at-home technologies can be useful in early detection of diseases, and alerting caregivers to emergencies such as falls, Dishman said. “I am sure we’ll figure out ways to increase fall prevention and reduce depression,” he said. Computers might remind consumers with Alzheimer’s, for instance, what they discussed during a previous conversation. A door sensor may notify a caregiver that a senior hasn’t gone outside for four days.

“You can address a problem sooner, before it becomes clinical,” Paul Crawford, director of health product research for Intel Labs, said in an interview. “Intel is trying to bring independent living into the digital age. It’s in analog age now.” Crawford and Jeff Kaye, a professor at Oregon Health & Science University, are leading the work on the proposal. The study is expected to be administered by the Foundation for the National Institutes of Health.

The study may begin as early as 2012, if additional funds are secured, Dishman said. His SILvR (Senior Independent Living Research) Initiative study could cost $200 million over 10 years, and would eventually track some 10,000 households with seniors, he said. The exact cost of the study will be determined this year.

Potential backers of the proposal work include The Robert Wood Johnson Foundation and the National Science Foundation, Dishman said. Robert Wood Johnson Foundation, which provides funding for public health projects, is “intrigued by the idea,” Paul Tarini, senior program officer at the foundation, said in an interview. The organization has talked with Intel about the study and is now awaiting a funding proposal.

Intel makes chips and software used in at-home care. The company and GE Corp. formed a joint venture focused on telehealth and independent living technologies in August.

Intel has invested in senior healthcare technologies for 12 years, funding more than 100 university grants, Dishman said.

Once the proposal is completed by year-end, Intel will push U.S. and European Union authorities to fund the study, Dishman said. Intel has also talked with White House officials, including Federal Chief Technology Officer Aneesh Chopra, and is pushing for the study to become a presidential election issue in 2012, he said.

“It’s too expensive even for Intel to single-handedly produce the clinical and financial evidence that these technologies detect diseases and lower costs,” Dishman said. “Even competitors need to come together and co-invest.”

Microsoft Is Said to Plan Preview of Windows Tablet Software

Microsoft Corp. will preview its Windows operating system designed for tablet computers in demonstrations planned for next week, according to three people with knowledge of the company’s plans.

The company will showcase the software’s touch-screen interface running on hardware with an Nvidia Corp. Tegra chip, said the people, who declined to be identified because the plans are confidential. Windows President Steven Sinofsky is scheduled to present at the All Things D conference, while Vice President Steve Guggenheimer will address the Computex show in Taipei.

Microsoft is rushing to adapt Windows to better support devices that can compete with Apple Inc.’s iPad, which dominates the tablet market. The new operating system won’t be out until next year, people familiar with the plans said in March. Still, the company is eager to show it is moving forward, seeking to generate demand among computer makers and chip suppliers.

Nvidia’s Tegra microprocessor is based on the ARM Holdings Plc technology that dominates the smartphone market. ARM-based chips are also used in the iPad and tablets that run Google Inc.’s Android operating system.

Mark Martin, a spokesman for Microsoft, declined to comment. The company’s shares rose 48 cents, or 2 percent, to $24.67 at 4 p.m. New York time on the Nasdaq Stock Market. Nvidia gained 46 cents, or 2.5 percent, to $18.82.

Microsoft Chief Executive Officer Steve Ballmer said earlier this week that machines with the new operating system, which he referred to as Windows 8, would be released in 2012.

‘In a Race’

Microsoft, based in Redmond, Washington, later retracted the comments, claiming they were a misstatement. The company is scrambling to expand Windows to computing devices such as phones and tablets, Ballmer said in a speech in New Delhi today.

“We are in a race,” he said. “We are not doing that badly, frankly. We are doing pretty well in that race. But the race is on to continue to push Windows to a variety of new form factors.”

Apple sold 4.69 million iPads in the most recent quarter, for a total of 19.5 million since the device’s April 2010 release. If the next version of Windows does come out on tablets in 2012, Apple will likely be selling its third generation of iPad hardware by then, according to Michael Gartenberg, an analyst at researcher Gartner Inc.

While Microsoft works on the new Windows software, sales in the operating-system business are taking a hit as some consumers choose iPads instead of less-expensive netbook computers that run Windows.

PC Shipments Slip

Consumer personal-computer shipments dropped 8 percent in the quarter, Microsoft Chief Financial Officer Peter Klein said last month. Sales of netbooks plunged 40 percent, partially because of defections to tablet computers, he said.

That helped make last quarter the second in a row in which Windows revenue fell short of analyst estimates.

The demonstration may be a boon to Nvidia, a maker of graphics processors for PCs, which is trying to break into the market for tablet computer chips with Tegra. Most tablets are now built with mobile-phone processors made by Texas Instruments Inc., Qualcomm Inc. and Samsung Electronics Co.

Intel Corp., whose processors lead in PCs, has been unable to parlay that dominance into design wins in phones and tablets.

Technology website WinRumors reported earlier that Microsoft will demonstrate the tablet software design at All Things D, which is being held in Rancho Palos Verdes, California.

Zylog Systems Ltd. Recommends Final Dividend

Zylog Systems Ltd. announced that the Board of Directors has recommended a final dividend of INR8 per share (80% on face value of INR10) on the Equity Shares of the Company subject to approval of the Shareholders in the Annual General Meeting.

Datamatics Technologies Ltd Recommends Final Dividend

Datamatics Technologies Ltd announced that the Board of Directors of the Company at its meeting held on May 27, 2011, inter alia, has recommended a final dividend at 15% i.e. INR0.75 per share to the shareholders for the year ended March 31, 2011.