Android detective explains Bitcoin borkage breadcrumbs

A tale of twisted pseudo-random number generators


Over the weekend, it emerged that a flaw in Android's Java-derived pseudo-random number generator (PRNG) created a vulnerability that allowed the theft of Bitcoins.

The individual responsible identifying the nasty bug, Jean-Pierre Rupp, has now contacted The Register by e-mail to confirm how he was able to track down the problem.

Rupp says his investigations began as the result of a complaint from a friend, who suspected that his Android phone had been hacked. However, Rupp says, he considered a successful remote Bitcoin-theft hack was unlikely. This, Rupp told Vulture South, led him instead to speculate that “somebody found his private key through cryptanalysis on the Bitcoin blockchain (the public ledger where all transactions are kept).”

Rupp's investigations then led him to a similar complaint in July (here). His reply to that post (as user Xeno-Genesis) reported his friends experience and noted that he was investigating the problem.

“The common factor seemed to be Android, and I immediately thought about the possibility of a flaw in its pseudo-random number generator (PRNG),” Rupp told The Register.

Rupp identified this conference paper, also linked in The Register's earlier story, and brought it to the attention of Google security engineer Mike Hearn. “I also pointed to him that his BitcoinJ code was using that PRNG in the regular non-seeded way, which triggered the flaw,” Rupp told The Register.

“I originally suggested that private key collisions may have being found and exploited. Later on the weekend a reply to the Bitcoin forum post by johoe clarified that the issue with the PRNG was leading to collisions in the random number parameter /k/ that the elliptic curve signature algorithm needs in order to be secure, making it trivial to extract the private key from two transactions that used the same /k/,” Rupp told Vulture South.

Hearn has told The Register that one of the posts, referred to in yesterday's story relates to a different key-collision issue.

“Nils' [ Schneider] blog post isn't anything to do with this incident. If you read to the end, the bad transaction he found was generated using a prototype hardware wallet not an Android device. His blog post is a nice walkthrough of the maths involved with recovering a private key given two colliding signatures, but it has no relevance beyond that.”

The Register is happy to include this correction. We have also asked Google to comment on why developers were not warned earlier about issues with using SecureRandom, given the March publication date of the RSA conference paper. ®

Similar topics


Other stories you might like

  • The future: Windows streaming through notched Apple screens

    Choice is the word for Jamf's Dean Hager

    Interview As Apple's devices continue to find favour with enterprise users, the fortress that is Windows appears to be under attack in the corporate world.

    Speaking to The Register as the Jamf Nation User Conference wound down, the software firm's CEO, Dean Hager, is - unsurprisingly - ebullient when it comes to the prospects for Apple gear in the world of suits.

    Jamf specialises in device management and authentication, and has long been associated with managing Apple hardware in business and education environments. In recent years it has begun connecting its products with services such as Microsoft's Azure Active Directory as administrators face up to a hybrid working future.

    Continue reading
  • There’s a wave of ransomware coming down the pipeline. What can you do about it?

    AI can help. Here’s how…

    Sponsored The Colonial Pipeline attack earlier this year showed just how devastating a ransomware attack is when it is targeted at critical infrastructure.

    It also illustrated how traditional security techniques are increasingly struggling to keep pace with determined cyber attackers, whether their aim is exfiltrating data, extorting organisations, or simply causing chaos. Or, indeed an unpleasant combination of all three.

    So, what are your options? More people looking for more flaws isn’t going to be enough – there simply aren’t enough skilled people, there are too many bugs, and there are way too many attackers. So, it’s clear that smart cyber defenders need to be supplemented by even smarter technology incorporating AI. You can learn what this looks like by checking out this upcoming Regcast, “Securing Critical Infrastructure from Cyber-attack” on October 28 at 5pm.

    Continue reading
  • Ransomware criminals have feelings too: BlackMatter abuse caused crims to shut down negotiation portal

    Or so says infsec outfit Emsisoft

    Hurling online abuse at ransomware gangs may have contributed to a hardline policy of dumping victims' data online, according to counter-ransomware company Emsisoft.

    Earlier this month, the Conti ransomware gang declared it would publish victims' data and break off ransom negotiations if anyone other than "respected journalist and researcher personalities" [sic] dared publish snippets of ransomware negotiations, amid a general hardening of attitudes among ransomware gangs.

    Typically these conversation snippets make it into the public domain because curious people log into ransomware negotiation portals hosted by the criminals. The BlackMatter (aka DarkSide) gang's portal credentials (detailed in a ransom note) became exposed to the wider world, however, and the resulting wave of furious abuse hurled at the crims prompted them to pull up the virtual drawbridge.

    Continue reading

Biting the hand that feeds IT © 1998–2021