Topic: Need analysis on possible hack (Read 5386 times)

Uhm,.. No I don't.
I think are right if the same public key was used.

You think any other wallets are coded to use exactly the same crap entropy source as Blockchain.info Wallet and generate the same exact private key for 1Bn9ReEocMG1WEW1qYjuDrdFzEFFDCq43F from exactly the same crap entropy source as Blockchain.info Wallet?


I would if Google+ wasn't required to leave reviews. Even if it wasn't, we'd need a significant amount of the 58,208 out of 70,278 total reviewers to downgrade their 3-5 stars to 2s and 1s to lower the average enough for anyone to pay attention.

Got it now (although post #35 contains some links to reddit, which I didn't click, I suppose that's where I woulda found the info).  Anyway, I guess the best that can be done is to downvote the app on google play store?  The only android wallet I've used is Andreas' and it's been great.

You're sure? I did not see OP say it was blockchain.info wallet.
Only someone else who had similar problems which could also be accidentally another wallet.

Incorrect. We know which wallet it was, it's the same one that has had the same crap PRNG code gmaxwell has been complaining about for years: Blockchain.info Wallet. See post #35 directly above yours.

If I'm following this thread correctly, we still don't know which wallet software was used?  Is that correct?

@amaclin above who mentioned law of excluded middle.  While it's true that any proposition is true or it's contradictory is true, it's completely possible that dude has a bad PRNG & was hacked.  There's no logical reason why both can't be true---they're not contradictories.

They got a complete refund - https://www.reddit.com/r/Bitcoin/comments/37ei2b/ive_just_been_hacked_6_btc_to/cro88o3

Breakdown - https://www.reddit.com/r/Bitcoin/comments/37oxow/the_security_issue_of_blockchaininfos_android/crolfk4


If I owned bitcoin.com I'd have gathered a bunch of translators and made a hitchhikers guide to bitcoin, with bc.i's entry having instructions on how to safely GTFO.

Another victim:

http://www.reddit.com/r/Bitcoin/comments/37ei2b/ive_just_been_hacked_6_btc_to/

amazon apk

Also it helps track if other users get this error with wallet.   I see no reason it is a secret on wallet.  Since you already had a problem, releasing the wallet is not going to hurt you more.  I would switch wallets from whatever it is.

Do you install any games/apps from "untrusted sources"?  For the fun of it have you tried to use one of the phone anti virus's to see if it finds anything?

*After reading and typing all this just saw date.... I hate when old threads are bumped up.

the wallet you downloaded might have generated a week bitcoin address with reused r values. u can see more about it here https://now.avg.com/android-bitcoin-vulnerability-explained/  u should use only official and updated  software

Hi, something similar happened to me. I installed Blockchain Wallet, created a new address and got this 1Bn9Re...
https://bitcointalksearch.org/topic/how-was-my-mobile-wallet-hacked-1065804

An unethical dev could also insert code in the wallet that would occasionally "generate" an address that he already has the privkey for. These might be pre-made and hardcoded into the walletsoftware, so there wouldn't even be signs of nefarious network traffic, or previous usage of said keys. The only way to be reasonably sure the wallet software is legit is to review it's source, then compile it yourself. In general with mobile wallets, don't store more BTC than you can afford to lose.

On the other hand, it's also important to present proper evidence, as anyone could really make an accusation against any wallet-developer. But if the wallet developer chose to, he could make available the source code for review, which would prove without doubt that the source code does not contain anything nefarious. Of course there could be malicious code inserted in the distribution process by a party with the necessary resources to do so.

I am not very familiar with deterministic builds myself, but here's an article about it:
http://www.conifersystems.com/2008/10/17/build-determinism/

Basically, the same input, should give the same output, so interested parties can run sha256sum on the binaries, to check they're legit, also checksums can be signed by the developer. If you download an app from any appstore, and there's no such security mechanisms in play, how can you be sure the software is legit?

Also, it's worth noting that for a very popular mobile wallet, if only a very low percentage of users are hit with theft, the overall negative impact will probably not be very big, so for the unethical dev, this brings a small but steady income stream.

Personally I think all possible details should be disclosed to the community as early as possible

PRNG bug for sure or a hack. Its not possible to generate the same priv key for a random address that was used, this might be a PRNG bug that actually made that event possible or someone has hacked the way onto your cellphone.

Not revealing the wallet is a really big mistake and unethical thing to do.

I just realized because I didn't read carefully before.   Just sent off the email.   

It is now looking a lot more like a PRNG bug than a malicious hack.

Have you tried to contact kidcratedigger? Might be he thought that was a donation...

tertium non datur

IFLrTIFGi3t8H1zVuKhr4FScU0RUgUWU26U8dpIyCT7XMXB0HmEFJt6ouyBTwpyhOz+3WcydRU7FQauHuyBxZGg=

I think it is probable that it is a weak PRNG, but it may be that the device was compromised and altered the PRNG seed in some way.

Mostly, I am wondering if the output transactions appear "suspicious", such as going to a mixer, which would imply that the other key owner targeted this address on purpose.  The address does have a public label, not set by me, on blockchain.info of "000000"

Can you sign a message with a private key of 1Bn9ReEocMG1WEW1qYjuDrdFzEFFDCq43F to be sure that you own this private key?

Seems to me that your application has bad random number generator.

The key was "generated" on Mar 7th.  Not my site.  None of the transactions are mine, except for the input transaction on that date for 2.57~ btc which was initiated by myself by sending coin from localbitcoins.   I have verified that I do have the private key by signing then verifying a message with that address.

1) when?
2) is this your site? http://kidcratedigger.weebly.com/contact--donations.html

The wallet has been installed on my phone for about a year through Google Play.   The version on my phone was up-to-date when I checked it after the theft.

It would be irresponsible to blame the wallet app publicly if the fault lies in my phone being compromised.   I am in contact with support, and would like to give them a chance to figure out the cause and make it right, if they are to blame.  So far, they are assuming malware, since they claim they don't have reports of similar problems from other users.  If they drop the ball, they will be named. 

If it is a wallet bug, it must be due to a rare condition and not widespread.
 

Without providing the name of the wallet and source code it is impossible to say but you are doing the community a huge disservice by keeping the name of the wallet hidden.  

There are two likely possibilities:
a) your phone was compromised by malware
b) the wallet developer is grossly incompetent

If it is a wallet error you won't be the last person affected and maybe the next victim loses 10x or 100x as much.  The longer you wait the more victims and the greater the total losses.  If the issue is unrelated to the wallet then an open review of the code will reveal that.  Keeping the wallet and developer a secret doesn't help anyone.  An ethical developer would probably compensate you for bringing it to light and an unethical one is going to tell you tough luck even if you keep their secret.

Exactly, if there is a problem it would be good to know now so we can stop other people losing there bitcoins. It is unfortunate you lost yours but we should try to stop others losing theirs aswell if possible.

He prefers not to say...

Good point, and lesson learned for USERS as well: When trying out a new wallet, check the blockchain for previous activity on the initial addresses generated in the wallet. That's more than a huge red flag, that's a shout-your-screaming-head-off-to-alert-everyone kind of thing. If keys are being developed like they should, this should NEVER happen within the confines of this universe.

There was news about a month ago about the possibility of hackers releasing wallets with the potential for pre-designated keys. They could then monitor the blockchain and sweep funds from them, even offline, cold wallets, etc., since they would already have the corresponding private keys. I wonder if this is possibly what happened with you. Was the wallet you used a recent release? From a new source?

Actually you should mention the app so people don't happen to lose coins if its a wallet bug.

It was probably was using a flawed RNG when creating the address. A huge red flag should have been the fact that there was activity on an address when you created the address, the fact that funds were spent from the address 100% means that someone else controls the private keys