Feeds

Android detective explains Bitcoin borkage breadcrumbs

A tale of twisted pseudo-random number generators

Internet Security Threat Report 2014

Over the weekend, it emerged that a flaw in Android's Java-derived pseudo-random number generator (PRNG) created a vulnerability that allowed the theft of Bitcoins.

The individual responsible identifying the nasty bug, Jean-Pierre Rupp, has now contacted The Register by e-mail to confirm how he was able to track down the problem.

Rupp says his investigations began as the result of a complaint from a friend, who suspected that his Android phone had been hacked. However, Rupp says, he considered a successful remote Bitcoin-theft hack was unlikely. This, Rupp told Vulture South, led him instead to speculate that “somebody found his private key through cryptanalysis on the Bitcoin blockchain (the public ledger where all transactions are kept).”

Rupp's investigations then led him to a similar complaint in July (here). His reply to that post (as user Xeno-Genesis) reported his friends experience and noted that he was investigating the problem.

“The common factor seemed to be Android, and I immediately thought about the possibility of a flaw in its pseudo-random number generator (PRNG),” Rupp told The Register.

Rupp identified this conference paper, also linked in The Register's earlier story, and brought it to the attention of Google security engineer Mike Hearn. “I also pointed to him that his BitcoinJ code was using that PRNG in the regular non-seeded way, which triggered the flaw,” Rupp told The Register.

“I originally suggested that private key collisions may have being found and exploited. Later on the weekend a reply to the Bitcoin forum post by johoe clarified that the issue with the PRNG was leading to collisions in the random number parameter /k/ that the elliptic curve signature algorithm needs in order to be secure, making it trivial to extract the private key from two transactions that used the same /k/,” Rupp told Vulture South.

Hearn has told The Register that one of the posts, referred to in yesterday's story relates to a different key-collision issue.

“Nils' [ Schneider] blog post isn't anything to do with this incident. If you read to the end, the bad transaction he found was generated using a prototype hardware wallet not an Android device. His blog post is a nice walkthrough of the maths involved with recovering a private key given two colliding signatures, but it has no relevance beyond that.”

The Register is happy to include this correction. We have also asked Google to comment on why developers were not warned earlier about issues with using SecureRandom, given the March publication date of the RSA conference paper. ®

Beginner's guide to SSL certificates

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Mitigating web security risk with SSL certificates
Web-based systems are essential tools for running business processes and delivering services to customers.