Android vulnerability hits Bitcoin apps and more

When a random number is not so random, security pays the price

Android users of Bitcoin are being advised to upgrade their apps and re-secure their wallets after the discovering of a weakness in a component of the operating system responsible for generating secure random numbers. The weakness also affects some secure communication networks, and renders users vulnerable to theft of their digital currency.

The weakness lies with the Android implementation of a piece of code which is supposed to spit out purely random numbers. Instead of working as it should, the numbers it produces aren’t as random as they seem. These numbers are used by Bitcoin users as the public and private keys in the series of mathematical problems which makes up the “blockchain”, the record of transactions. If they are slightly predictable, then as a result, it is theoretically possible to work out someone’s private key from the public signatures they post, and steal money contained in the wallet.

The vulnerability was highlighted by developer Mike Hearn, who created the Bitcoin Wallet app. That app has since been updated, as have Mycelium Wallet and blockchain.info, two other popular wallet apps for Android. Bitcoin.org, a key website for the decentralised development community, advises users to “rotate” their keys. “This involves generating a new address with a repaired random number generator and then sending all the money in your wallet back to yourself”, they write. “Once your wallet is rotated, you will need to contact anyone who has stored addresses generated by your phone and give them a new one.”

However, the weakness in the random number generator has the potential to affect more than just bitcoin apps. Any app which relies on the generator for security is at risk, particularly if the programme requires a public and a private key. The nature of the flaw makes it overly easy to determine a private key if given a public key generated around the same time; as a result, any app which uses a form of public key cryptography, where the security of the encrypted content relies on the public and private keys being unrelated, is at risk if those keys were generated using the faulty generator.

In practice, though, the Bitcoin community is at the most risk here. It's one of the few situations where a public key is very public indeed, and the rewards for cracking it are so immediate that if people can try, they will. But it's hardly a mortal wound; the apps can be updated, and wallets resecured. If Bitcoin is really in danger, it comes from a source which many advocates of the digital money are celebrating. Earlier this month, a Texas court officially declared Bitcoin a "currency" in order to take action against a man accused of running a Bitcoin Ponzi scheme. What sounds like much-needed mainstream recognition is actually a double-edged sword, though. As a currency, it is now fair game for regulators. And sure enough, the New York Department of Financial Services is looking into the "Wild West for narcotraffickers and other criminals". Bitcoin will shortly need to grow up or shut up, it seems.

Photograph: Bitcoin.org

Alex Hern is a technology reporter for the Guardian. He was formerly staff writer at the New Statesman. You should follow Alex on Twitter.

Parliament TV screengrab
Show Hide image

MP Michelle Thomson's full speech on rape at 14: "I am a survivor"

The MP was attacked as a teenager. 

On Thursday, the independent MP for Edinburgh West Michelle Thomson used a debate marking the UN’s International Day for the Elimination of Violence against Women to describe her own experience of rape. Thomson, 51, said she wanted to break the taboo among her generation about speaking about the subject.

MPs listening were visibly moved by the speech, and afterwards Thomson tweeted she was "overwhelmed" by the response. 

Here is her speech in full:

I am going to relay an event that happened to me many years ago. I want to give a very personal perspective to help people, both in this place and outside, understand one element of sexual violence against women.

When I was 14, I was raped. As is common, it was by somebody who was known to me. He had offered to walk me home from a youth event. In those days, everybody walked everywhere - it was quite common. It was early evening. It was not dark. I was wearing— I am imagining and guessing—jeans and a sweatshirt. I knew my way around where I lived - I was very comfortable - and we went a slightly differently way, but I did not think anything of it. He told me that he wanted to show me something in a wooded area. At that point, I must admit that I was alarmed. I did have a warning bell, but I overrode that warning bell because I knew him and, therefore, there was a level of trust in place. To be honest, looking back at that point, I do not think I knew what rape was. It was not something that was talked about. My mother never talked to me about it, and I did not hear other girls or women talking about it.

It was mercifully quick and I remember first of all feeling surprise, then fear, then horror as I realised that I quite simply could not escape, because obviously he was stronger than me. There was no sense, even initially, of any sexual desire from him, which, looking back again, I suppose I find odd. My senses were absolutely numbed, and thinking about it now, 37 years later, I cannot remember hearing anything when I replay it in my mind. As a former professional musician who is very auditory, I find that quite telling. I now understand that your subconscious brain—not your conscious brain—decides on your behalf how you should respond: whether you take flight, whether you fight or whether you freeze. And I froze, I must be honest.

Afterwards I walked home alone. I was crying, I was cold and I was shivering. I now realise, of course, that that was the shock response. I did not tell my mother. I did not tell my father. I did not tell my friends. And I did not tell the police. I bottled it all up inside me. I hoped briefly—and appallingly—that I might be pregnant so that that would force a situation to help me control it. Of course, without support, the capacity and resources that I had within me to process it were very limited.

I was very ashamed. I was ashamed that I had “allowed this to happen to me”. I had a whole range of internal conversations: “I should have known. Why did I go that way? Why did I walk home with him? Why didn’t I understand the danger? I deserved it because I was too this, too that.” I felt that I was spoiled and impure, and I really felt revulsion towards myself.

Of course, I detached from the child that I had been up until then. Although in reality, at the age of 14, that was probably the start of my sexual awakening, at that time, remembering back, sex was “something that men did to women”, and perhaps this incident reinforced that early belief.​
I briefly sought favour elsewhere and I now understand that even a brief period of hypersexuality is about trying to make sense of an incident and reframing the most intimate of acts. My oldest friends, with whom I am still friends, must have sensed a change in me, but because I never told them they did not know of the cause. I allowed myself to drift away from them for quite a few years. Indeed, I found myself taking time off school and staying at home on my own, listening to music and reading and so on.

I did have a boyfriend in the later years of school and he was very supportive when I told him about it, but I could not make sense of my response - and it is my response that gives weight to the event. I carried that guilt, anger, fear, sadness and bitterness for years.

When I got married 12 years later, I felt that I had a duty tell my husband. I wanted him to understand why there was this swaddled kernel of extreme emotion at the very heart of me, which I knew he could sense. But for many years I simply could not say the words without crying—I could not say the words. It was only in my mid-40s that I took some steps to go and get help.

It had a huge effect on me and it fundamentally - and fatally - undermined my self-esteem, my confidence and my sense of self-worth. Despite this, I am blessed in my life: I have been happily married for 25 years. But if this was the effect of one small, albeit significant, event in my life stage, how must it be for those women who are carrying it on a day-by-day basis?

I thought carefully about whether I should speak about this today, and it was people’s intake of breath and the comment, “What? You’re going to talk about this?”, that motivated me to do it, because there is still a taboo about sharing this kind of information. Certainly for people of my generation, it is truly shocking to talk in public about this sort of thing.

As has been said, rape does not just affect the woman; it affects the family as well. Before my mother died early of cancer, I really wanted to tell her, but I could not bring myself to do it. I have a daughter and if something happened to her and she could not share it with me, I would be appalled. It was possibly cowardly, but it was an act of love that meant that I protected my mother.

As an adult, of course I now know that rape is not about sex at all - it is all about power and control, and it is a crime of violence. I still pick up on when the myths of rape are perpetuated form a male perspective: “Surely you could have fought him off. Did you scream loudly enough?” And the suggestion by some men that a woman is giving subtle hints or is making it up is outrageous. Those assumptions put the woman at the heart of cause, when she should be at the heart of effect. A rape happens when a man makes a decision to hurt someone he feels he can control. Rapes happen because of the rapist, not because of the victim.

We women in our society have to stand up for each other. We have to be courageous. We have to call things out and say where things are wrong. We have to support and nurture our sisters as we do with our sons. Like many women of my age, I have on occasion encountered other aggressive actions towards me, both in business and in politics. But one thing that I realise now is that I am not scared and he was. I am not scared. I am not a victim. I am a survivor.

Julia Rampen is the editor of The Staggers, The New Statesman's online rolling politics blog. She was previously deputy editor at Mirror Money Online and has worked as a financial journalist for several trade magazines.