Topic: Recent breach at Blockchain.info -- Android App did a stupid. - page 3. (Read 4937 times)

=snip=
The result was that all of those clients generated the private key corresponding to 1Bn9ReEocMG1WEW1qYjuDrdFzEFFDCq43F and sent bitcoins to it.

And somebody who noticed a whole lot of coins accumulating at "his" address, spent them.  
=snip=

Right, but that is patentenly ridiculous (imo).  If you have a device with a radio, a gyroscope, a wifi-antenna, a java-random-number generator (that was recently hardened for use with crypto) and then you decide to make a call to a website to get a random number, that seems nuts.

What's even more nuts is that they weren't getting back a random number but an error page and somehow they weren't even looking at that.  It's pretty shocking.

To get increased randomness.

Damn. This is ridiculous. Why did they need to call random.org ?

Does not an android phone provide enough entropy ?

Most users' doesn't allow GPS connection to apps like these and also some users' doesn't want to expose their phone number because of privacy concerns. They may give access to these if everything is stored/done locally but Blockchain.info is a web-wallet.


I think they only call random.org in Android for increased randomness.

Obviously reputable is a matter of interepretation.  But for me, the fact that they're probably the longest running web-wallet service not to be completely hacked and lose everything says something.  Also (and again, this may be just due to their longevity), I think they're the go-to block explorer for most people.  Kinda like google, they may not be the "best" search engine, that's a matter of debate, but many people equate search with google.  I believe that many people equate looking something up on the blockchain with looking it up on blockchain.info.

So, I guess I don't know a lot about their fuckups, and I don't use a web-wallet anyway (for security purposes), but yah, I had thought they were reputable.  Presumably, I don't know the whole story.

Reputable? In terms of their track record of fucking up?

Not just could, it does explain those threads.  @Cryddit, you're right, it's quite mind-boggling that a site as reputable as blockchain.info screwed this up so completely.

This would explain all of those threads about the 1Bn9ReEocMG1WEW1qYjuDrdFzEFFDCq43F address which people were claiming that their bitcoins were stolen.

@OP: Could you please add '.info' after 'Blockchain' in the title?

I was in the middle of writing a breakdown of what went wrong, but you've beat me to it.

Basically, they have a LinuxSecureRandom class that's supposed to override the standard SecureRandom. This class reads from /dev/urandom and should provide cryptographically secure random values.

They also seed the generator using SecureRandom#setSeed with data pulled from random.org. With their custom SecureRandom, this is safe because it mixes the entropy using XOR, so even if the random.org data is dodgy it won't reduce security. It's just an added bonus.

BUT! On some devices under some circumstances, the LinuxSecureRandom class doesn't get registered. This is likely because /dev/urandom doesn't exist or can't be accessed for some reason. Instead of screaming bloody murder like any sensible implementation would, they just ignore that and fall back to using the standard SecureRandom.

If the above happens, there's a problem because the default implementation of SecureRandom#setSeed doesn't mix. If you set the seed, it replaces the entropy entirely. So now the entropy is coming solely from random.org.
And the final mistake: They were using HTTP instead of HTTPS to make the webservice call to random.org. On Jan 4, random.org started enforcing HTTPS and returning a 301 Permanently Moved error for HTTP - see https://www.random.org/news/. So since that date, the entropy has actually been the error message (turned into bytes) instead of the expected 256-bit number. Using that seed, SecureRandom will generate the private key for address 1Bn9ReEocMG1WEW1qYjuDrdFzEFFDCq43F 100% of the time. Ouch. This is around the time that address first appears, so the timeline matches.

I haven't had a thorough look at what they've replaced it with in the latest version, but initial impressions are that it's not ideal. Not disastrous, but not good.

This required an UNBELIEVABLE level of ignorance or wilful stupidity to achieve. 
...
I'm just ...  I can't.... wow.  I didn't think that level of ... whatever it is .... was even possible.