Android vulnerability hits Bitcoin apps and more

When a random number is not so random, security pays the price

Android users of Bitcoin are being advised to upgrade their apps and re-secure their wallets after the discovering of a weakness in a component of the operating system responsible for generating secure random numbers. The weakness also affects some secure communication networks, and renders users vulnerable to theft of their digital currency.

The weakness lies with the Android implementation of a piece of code which is supposed to spit out purely random numbers. Instead of working as it should, the numbers it produces aren’t as random as they seem. These numbers are used by Bitcoin users as the public and private keys in the series of mathematical problems which makes up the “blockchain”, the record of transactions. If they are slightly predictable, then as a result, it is theoretically possible to work out someone’s private key from the public signatures they post, and steal money contained in the wallet.

The vulnerability was highlighted by developer Mike Hearn, who created the Bitcoin Wallet app. That app has since been updated, as have Mycelium Wallet and blockchain.info, two other popular wallet apps for Android. Bitcoin.org, a key website for the decentralised development community, advises users to “rotate” their keys. “This involves generating a new address with a repaired random number generator and then sending all the money in your wallet back to yourself”, they write. “Once your wallet is rotated, you will need to contact anyone who has stored addresses generated by your phone and give them a new one.”

However, the weakness in the random number generator has the potential to affect more than just bitcoin apps. Any app which relies on the generator for security is at risk, particularly if the programme requires a public and a private key. The nature of the flaw makes it overly easy to determine a private key if given a public key generated around the same time; as a result, any app which uses a form of public key cryptography, where the security of the encrypted content relies on the public and private keys being unrelated, is at risk if those keys were generated using the faulty generator.

In practice, though, the Bitcoin community is at the most risk here. It's one of the few situations where a public key is very public indeed, and the rewards for cracking it are so immediate that if people can try, they will. But it's hardly a mortal wound; the apps can be updated, and wallets resecured. If Bitcoin is really in danger, it comes from a source which many advocates of the digital money are celebrating. Earlier this month, a Texas court officially declared Bitcoin a "currency" in order to take action against a man accused of running a Bitcoin Ponzi scheme. What sounds like much-needed mainstream recognition is actually a double-edged sword, though. As a currency, it is now fair game for regulators. And sure enough, the New York Department of Financial Services is looking into the "Wild West for narcotraffickers and other criminals". Bitcoin will shortly need to grow up or shut up, it seems.

Photograph: Bitcoin.org

Alex Hern is a technology reporter for the Guardian. He was formerly staff writer at the New Statesman. You should follow Alex on Twitter.

Getty
Show Hide image

Air pollution: 5 steps to vanquishing an invisible killer

A new report looks at the economics of air pollution. 

110, 150, 520... These chilling statistics are the number of deaths attributable to particulate air pollution for the cities of Southampton, Nottingham and Birmingham in 2010 respectively. Or how about 40,000 - that is the total number of UK deaths per year that are attributable the combined effects of particulate matter (PM2.5) and Nitrogen Oxides (NOx).

This situation sucks, to say the very least. But while there are no dramatic images to stir up action, these deaths are preventable and we know their cause. Road traffic is the worst culprit. Traffic is responsible for 80 per cent of NOx on high pollution roads, with diesel engines contributing the bulk of the problem.

Now a new report by ResPublica has compiled a list of ways that city councils around the UK can help. The report argues that: “The onus is on cities to create plans that can meet the health and economic challenge within a short time-frame, and identify what they need from national government to do so.”

This is a diplomatic way of saying that current government action on the subject does not go far enough – and that cities must help prod them into gear. That includes poking holes in the government’s proposed plans for new “Clean Air Zones”.

Here are just five of the ways the report suggests letting the light in and the pollution out:

1. Clean up the draft Clean Air Zones framework

Last October, the government set out its draft plans for new Clean Air Zones in the UK’s five most polluted cities, Birmingham, Derby, Leeds, Nottingham and Southampton (excluding London - where other plans are afoot). These zones will charge “polluting” vehicles to enter and can be implemented with varying levels of intensity, with three options that include cars and one that does not.

But the report argues that there is still too much potential for polluters to play dirty with the rules. Car-charging zones must be mandatory for all cities that breach the current EU standards, the report argues (not just the suggested five). Otherwise national operators who own fleets of vehicles could simply relocate outdated buses or taxis to places where they don’t have to pay.  

Different vehicles should fall under the same rules, the report added. Otherwise, taking your car rather than the bus could suddenly seem like the cost-saving option.

2. Vouchers to vouch-safe the project’s success

The government is exploring a scrappage scheme for diesel cars, to help get the worst and oldest polluting vehicles off the road. But as the report points out, blanket scrappage could simply put a whole load of new fossil-fuel cars on the road.

Instead, ResPublica suggests using the revenue from the Clean Air Zone charges, plus hiked vehicle registration fees, to create “Pollution Reduction Vouchers”.

Low-income households with older cars, that would be liable to charging, could then use the vouchers to help secure alternative transport, buy a new and compliant car, or retrofit their existing vehicle with new technology.

3. Extend Vehicle Excise Duty

Vehicle Excise Duty is currently only tiered by how much CO2 pollution a car creates for the first year. After that it becomes a flat rate for all cars under £40,000. The report suggests changing this so that the most polluting vehicles for CO2, NOx and PM2.5 continue to pay higher rates throughout their life span.

For ClientEarth CEO James Thornton, changes to vehicle excise duty are key to moving people onto cleaner modes of transport: “We need a network of clean air zones to keep the most polluting diesel vehicles from the most polluted parts of our towns and cities and incentives such as a targeted scrappage scheme and changes to vehicle excise duty to move people onto cleaner modes of transport.”

4. Repurposed car parks

You would think city bosses would want less cars in the centre of town. But while less cars is good news for oxygen-breathers, it is bad news for city budgets reliant on parking charges. But using car parks to tap into new revenue from property development and joint ventures could help cities reverse this thinking.

5. Prioritise public awareness

Charge zones can be understandably unpopular. In 2008, a referendum in Manchester defeated the idea of congestion charging. So a big effort is needed to raise public awareness of the health crisis our roads have caused. Metro mayors should outline pollution plans in their manifestos, the report suggests. And cities can take advantage of their existing assets. For example in London there are plans to use electronics in the Underground to update travellers on the air pollution levels.

***

Change is already in the air. Southampton has used money from the Local Sustainable Travel Fund to run a successful messaging campaign. And in 2011 Nottingham City Council became the first city to implement a Workplace Parking levy – a scheme which has raised £35.3m to help extend its tram system, upgrade the station and purchase electric buses.

But many more “air necessities” are needed before we can forget about pollution’s worry and its strife.  

 

India Bourke is an environment writer and editorial assistant at the New Statesman.