Android vulnerability hits Bitcoin apps and more

When a random number is not so random, security pays the price

Android users of Bitcoin are being advised to upgrade their apps and re-secure their wallets after the discovering of a weakness in a component of the operating system responsible for generating secure random numbers. The weakness also affects some secure communication networks, and renders users vulnerable to theft of their digital currency.

The weakness lies with the Android implementation of a piece of code which is supposed to spit out purely random numbers. Instead of working as it should, the numbers it produces aren’t as random as they seem. These numbers are used by Bitcoin users as the public and private keys in the series of mathematical problems which makes up the “blockchain”, the record of transactions. If they are slightly predictable, then as a result, it is theoretically possible to work out someone’s private key from the public signatures they post, and steal money contained in the wallet.

The vulnerability was highlighted by developer Mike Hearn, who created the Bitcoin Wallet app. That app has since been updated, as have Mycelium Wallet and, two other popular wallet apps for Android., a key website for the decentralised development community, advises users to “rotate” their keys. “This involves generating a new address with a repaired random number generator and then sending all the money in your wallet back to yourself”, they write. “Once your wallet is rotated, you will need to contact anyone who has stored addresses generated by your phone and give them a new one.”

However, the weakness in the random number generator has the potential to affect more than just bitcoin apps. Any app which relies on the generator for security is at risk, particularly if the programme requires a public and a private key. The nature of the flaw makes it overly easy to determine a private key if given a public key generated around the same time; as a result, any app which uses a form of public key cryptography, where the security of the encrypted content relies on the public and private keys being unrelated, is at risk if those keys were generated using the faulty generator.

In practice, though, the Bitcoin community is at the most risk here. It's one of the few situations where a public key is very public indeed, and the rewards for cracking it are so immediate that if people can try, they will. But it's hardly a mortal wound; the apps can be updated, and wallets resecured. If Bitcoin is really in danger, it comes from a source which many advocates of the digital money are celebrating. Earlier this month, a Texas court officially declared Bitcoin a "currency" in order to take action against a man accused of running a Bitcoin Ponzi scheme. What sounds like much-needed mainstream recognition is actually a double-edged sword, though. As a currency, it is now fair game for regulators. And sure enough, the New York Department of Financial Services is looking into the "Wild West for narcotraffickers and other criminals". Bitcoin will shortly need to grow up or shut up, it seems.


Alex Hern is a technology reporter for the Guardian. He was formerly staff writer at the New Statesman. You should follow Alex on Twitter.

Show Hide image

Can Trident be hacked?

A former defence secretary has warned that Trident is vulnerable to cyber attacks. Is it?

What if, in the event of a destructive nuclear war, the prime minister goes to press the red button and it just doesn't work? 

This was the question raised by Des Browne, a former defence secretary, in an interview witht the Guardian this week. His argument, based on a report from the defence science board of the US Department of Defense, is that the UK's Trident nuclear weapons could be vulnerable to cyberattacks, and therefore rendered useless if hacked. 

Browne called for an "end-to-end" assessment of the system's cybersecurity: 

 The government ... have an obligation to assure parliament that all of the systems of the nuclear deterrent have been assessed end-to-end against cyber attacks to understand possible weak spots and that those weak spots are protected against a high-tier cyber threat. If they are unable to do that then there is no guarantee that we will have a reliable deterrent or the prime minister will be able to use this system when he needs to reach for it.

Is he right? Should we really be worried about Trident's potential cyber weaknesses?

Tangled webs 

The first, crucial thing to note is that Trident is not connected to the "internet" we use every day. Sure, it's connected to the main Ministry of Defence network, but this operates totally independently of the network that you visit Facebook through. In cyber-security terms, this means the network is "air-gapped" - it's isolated from other systems that could be less secure. 

In our minds, Trident is old and needs replacing (the submarines began patrolling in the 1990s), but any strike would be ordered and co-ordinated from Northwood, a military bunker 100m underground which would use the same modern networks as the rest of the MoD. Trident is basically as secure as the rest of the MoD. 

What the MoD said

I asked the Ministry of Defence for a statement on Trident's security, and while it obviously can't offer much information about how it all actually works, a spokesperson confirmed that the system is air-gapped and added: 

We wouldn't comment on the detail of our security arrangements for the nuclear deterrent but we can and do safeguard it from all threats including cyber.

What security experts said

Security experts agree that an air-gapped system tends to be more secure than one connected to the internet. Sean Sullivan, a security adviser at F-secure, told Infosecurity magazine that while some hackers have been able to "jump" air-gaps using code, this would cause "interference" at most and a major attack of this kind is still "a long way off". 

Franklin Miller, a former White House defence policy offer, told the Guardian that the original report cited by Browne was actually formulated in response to suggestions that some US defence networks should be connected to the internet. In that case, it actually represents an argument in favour of the type of air-gapped system used by the MoD. 

So... can it be hacked?

The answer is really that any system could be hacked, but a specialised, independent defence network is very, very unlikely to be. If a successful hack did happen, it would likely affect all aspects of defence, not just Trident. That doesn't mean that every effort shouldn't be made to make sure the MoD is using the most secure system possible, but it also means that scaremongering in the context of other, unrelated cybersecurity scares is a little unjustified. 

Barbara Speed is a technology and digital culture writer at the New Statesman and a staff writer at CityMetric.