Bitcoin app issues critical update after rare bug leads to total crypto breakdown
Bitcoin Blockchain has issued an update for the Android version of its bitcoin wallet after discovering a critical failure which breaks the cryptocurrency’s security wallet application Blockchain has rushed to release an update after a critical bug left multiple users unaware that they were sharing a bitcoin wallet, leaving their cryptocurrency completely unsecured.
The bug affected users running Blockchain’s app on Android version 4.1 or older, the company says, and it “resulted in one specific address being generated multiple times, leading to a loss of funds for a handful of users.”
Blockchain advises users who fear they were affected to update their app, create a new bitcoin address, and transfer their funds out of the affected wallet.
The flaw apparently came about through a series of bad development choices which all failed in the worst way possible. Bitcoin wallets are typically created by randomly generating a public address and a related private key. As a result, it is important for address and key to be truly random, or else it may be possible to guess the private key by looking at the public address.
To that end, Blockchain used two sources of random numbers, in what ought to have been a belt-and-braces approach: it pulled a random number from the Android operating system’s built-in random number generator, and then connected to online service Random.org to get a second random number, which it combined with the first.
Unfortunately, on some Android phones (reportedly including devices from the Sony Xperia range), the built-in random number generator failed to report back to the blockchain app. Normally, this should have been survivable, because the app used a second source of random numbers.
But on 4 January, Random.org strengthened the security of its website, requiring all visits to be made over an encrypted connection. The blockchain app, however, continued to access the site through an unencrypted connection. So rather than getting a random number, as expected, it got an error code telling it that the site had moved.
It then used that error code as the random number, every single time.
A representative from Blockchain told the Guardian that “the issue we identified related to an extremely rare case where address entropy could create multiple duplicate addresses (meaning more than one wallet essentially was in custody of the address simultaneously). We immediately disclosed the issue and released a fix.
Blockchain denied that the incident was a total cryptobreakdown, and said that “only a very small number of users were affected; we’ve counted just three users who have reached out related to the address in question, which is an extremely minor amount compared to the 3.5 million wallets we have.”
In the meantime, Blockchain has asked users who think they may have been affected to contact its helpdesk.
Via:http://www.theguardian.com/technology/2015/jun/01/bitcoin-app-critical-update-bug-crypto-breakdown
by 