Google confirms critical Android crypto flaw used in Bitcoin heist

http://arstechnica.com/security/2013/08/google-confirms-critical-android-crypto-flaw-used-in-5700-bitcoin-heist/

by shawndumas • 13 years ago

131 43 13 years ago

arstechnica.com

marshray3• 13 years ago

I thought OpenSSL's default code already pulled from /dev/[u]random at initialization?

Afforess• 13 years ago

The Official Sun/Oracle JDK SecureRandom class already pulls from /dev/random. The Android class does not.

gsibble4• 13 years ago

Larry Ellison is ROFLing right now.

kolinko2• 13 years ago

where does it pull from?

e12e2• 13 years ago

But they only copied the API, remember. Not the implementation... ;-)

gsibble4• 13 years ago

Yeah......that looks like an easy fix o_O

flyt• 13 years ago

And now we simply wait for cell carriers/handset manufacturers to push out updates for all the handsets in the field.

enraged_camel2• 13 years ago

Yep. Everyone who normally pretends that Android fragmentation is "not that big a deal" is going to squirm.

jmomo• 13 years ago

This is why I use Cyanogenmod. I get better support from a bunch of unpaid yahoos who like to dork around with phones than from the carriers and handset manufactures.

I am willing to bet Cyanogenmod will have a fix out in days, if not hours.

This goes for other ROMs like Paranoid too.

I refuse to buy hardware which isn't supported by the open-source community, such as Cyanogen.

If I don't 0wn it, I don't own it.

rednukleus3• 13 years ago

I know, right? Things would be so much better if the dominant OS was a closed platform, and only ran on hardware made by the same company and only ran apps purchased though a tightly controlled store run by the same company. Of course then they could shut out other service providers such as maps and cloud services, and basically wreck the industry for almost everyone except themselves, but at least we would get timely updates.

eli• 13 years ago

It's the carriers. What are you supposed to do, tell them they can't test updates for phones running on their network?

panarky• 13 years ago

No need to wait for the carriers. Google published sample code for app developers to get good entropy.

http://android-developers.blogspot.com/2013/08/some-securera...

gsibble4• 13 years ago

I'm actually shocked that someone used a zero-day Android exploit to steal $5,700 of BTC. Couldn't they have sold it for significantly more on the black market?

cstavish• 13 years ago

It's possible that the exploit was used previously and the incident went unreported.

gsibble4• 13 years ago

Which is perhaps even more frightening considering many other high security apps use these libraries.

nwh2• 13 years ago

Well no, not with Bitcoin at any rate. Every transaction is visible, that's how the attacker knew which funds were stealable.

zorpner• 13 years ago

It may not have been identified specifically as an Android exploit -- there are people (I used to be one of them, though I wouldn't have used the result to exploit wallets) who constantly run crypto attacks on transactions in the blockchain to identify weak wallet keys. The person who stole the BTC probably automated the attack, left it running against the blockchain, and never even knew what the real vulnerability was.

qnr• 13 years ago

They didn't use an Android exploit specifically, they simply scanned the blockchain for vulnerable private keys. They probably didn't even know that Android was the culprit - it could be hardware wallet, a buggy homebrew client or whatever.

mike-cardwell• 13 years ago

I'm more shocked that some people actually trust their phones enough to install bitcoin clients on them.

kolinko2• 13 years ago

Well, keeping 1-2 BTC as a personal wallet for real-world transactions makes some sense.

As for keeping ~50 BTC - a possible scenario is that the guy/gal bought a specific, cheap Android phone as a "safe" - that is, installed only the blockchain app, and cut off the internet/cellular connection. One would expect the phone being offline and the app being from a trustable source to be secure :)

marshray3• 13 years ago

Alternatively, someone decided it was worth $5700 to learn whether or not this bug was being exploited in the wild.

e12e2• 13 years ago

We don't really know that. The other obvious implication would be that we now might need new/expanded openssl/ssh key blacklists, for keys generated on Android devices.

kirian• 13 years ago

Yes, $5,700 seems a bargain to uncover a flaw like this. Shows an interesting potential use of bitcoin, can act as a warning system to identify bugs or insecure systems, like a honeypot. If the bitcoins are taken you know there is a weakness somewhere.

dspillett• 13 years ago

Depends on the attackers attitude to risk: $5,700 worth of BTC might be a lot harder to track than the sale of an exploit. He doesn't have to trust any other human beings (i.e. the person he is selling to at least) not to dob him in at a moment's notice. A safe 5K might be very much preferable to him than a less safe 20+K.

(caveat: unless otherwise stated numbers in this post, and many of my others, are plucked from thin air)

marshray3• 13 years ago

Has anyone looked to see if the NSA Secure Android project has this bug?

gcb0• 13 years ago

irony of the month: anyone NOT following the age old advice about not implementing your own crypto would have been spared from this.

lvh• 13 years ago

Why?

This is a failure of the CSPRNG. What "not implementing your own crypto" usually means is trying to cobble together primitives like AES, RSA, and some mode of operation (and, if you're lucky, there's a MAC algorithm in there too), which would still probably have been horribly broken in some way. That's completely orthogonal to this issue.

Are you insinuating that explicitly seeding the CSPRNG with information from the OS' CSPRNG is somehow a bad thing, or that it is frowned upon, or that it constitutes "implementing your own crypto"?

thirsteh• 13 years ago

Indeed. The irony is that anyone following that (good) advice were affected by this.

plasma• 13 years ago

Why does the blog post also suggest /dev/random?

I thought urandom should only be used for crypto.

nwh2• 13 years ago

Other way around.

aa0• 13 years ago

Random blocks when waiting for entropy. Urandom is "unblocking random" and will return strictly predictable results when the pool becomes drained enough.

VikingCoder• 13 years ago

How much would a good hardware RNG cost, and when can we have a phone with one that can run Cyanogenmod?

Google confirms critical Android crypto flaw used in Bitcoin heist

Related Stories