Android vulnerability hits Bitcoin apps and more

When a random number is not so random, security pays the price

Android users of Bitcoin are being advised to upgrade their apps and re-secure their wallets after the discovering of a weakness in a component of the operating system responsible for generating secure random numbers. The weakness also affects some secure communication networks, and renders users vulnerable to theft of their digital currency.

The weakness lies with the Android implementation of a piece of code which is supposed to spit out purely random numbers. Instead of working as it should, the numbers it produces aren’t as random as they seem. These numbers are used by Bitcoin users as the public and private keys in the series of mathematical problems which makes up the “blockchain”, the record of transactions. If they are slightly predictable, then as a result, it is theoretically possible to work out someone’s private key from the public signatures they post, and steal money contained in the wallet.

The vulnerability was highlighted by developer Mike Hearn, who created the Bitcoin Wallet app. That app has since been updated, as have Mycelium Wallet and blockchain.info, two other popular wallet apps for Android. Bitcoin.org, a key website for the decentralised development community, advises users to “rotate” their keys. “This involves generating a new address with a repaired random number generator and then sending all the money in your wallet back to yourself”, they write. “Once your wallet is rotated, you will need to contact anyone who has stored addresses generated by your phone and give them a new one.”

However, the weakness in the random number generator has the potential to affect more than just bitcoin apps. Any app which relies on the generator for security is at risk, particularly if the programme requires a public and a private key. The nature of the flaw makes it overly easy to determine a private key if given a public key generated around the same time; as a result, any app which uses a form of public key cryptography, where the security of the encrypted content relies on the public and private keys being unrelated, is at risk if those keys were generated using the faulty generator.

In practice, though, the Bitcoin community is at the most risk here. It's one of the few situations where a public key is very public indeed, and the rewards for cracking it are so immediate that if people can try, they will. But it's hardly a mortal wound; the apps can be updated, and wallets resecured. If Bitcoin is really in danger, it comes from a source which many advocates of the digital money are celebrating. Earlier this month, a Texas court officially declared Bitcoin a "currency" in order to take action against a man accused of running a Bitcoin Ponzi scheme. What sounds like much-needed mainstream recognition is actually a double-edged sword, though. As a currency, it is now fair game for regulators. And sure enough, the New York Department of Financial Services is looking into the "Wild West for narcotraffickers and other criminals". Bitcoin will shortly need to grow up or shut up, it seems.

Photograph: Bitcoin.org

Alex Hern is a technology reporter for the Guardian. He was formerly staff writer at the New Statesman. You should follow Alex on Twitter.

GETTY
Show Hide image

Erdogan’s purge was too big and too organised to be a mere reaction to the failed coup

There is a specific word for the melancholy of Istanbul. The city is suffering a mighty bout of something like hüzün at the moment. 

Even at the worst of times Istanbul is a beautiful city, and the Bosphorus is a remarkable stretch of sea. Turks get very irritated if you call it a river. They are right. The Bosphorus has a life and energy that a river could never equal. Spend five minutes watching the Bosphorus and you can understand why Orhan Pamuk, Turkey’s Nobel laureate for literature, became fixated by it as he grew up, tracking the movements of the ocean-going vessels, the warships and the freighters as they steamed between Asia and Europe.

I went to an Ottoman palace on the Asian side of the Bosphorus, waiting to interview the former prime minister Ahmet Davu­toglu. He was pushed out of office two months ago by President Recep Tayyip Erdogan when he appeared to be too wedded to the clauses in the Turkish constitution which say that the prime minister is the head of government and the president is a ceremonial head of state. Erdogan was happy with that when he was prime minister. But now he’s president, he wants to change the constitution. If Erdogan can win the vote in parliament he will, in effect, be rubber-stamping the reality he has created since he became president. In the days since the attempted coup, no one has had any doubt about who is the power in the land.

 

City of melancholy

The view from the Ottoman palace was magnificent. Beneath a luscious, pine-shaded garden an oil tanker plied its way towards the Black Sea. Small ferries dodged across the sea lanes. It was not, I hasten to add, Davutoglu’s private residence. It had just been borrowed, for the backdrop. But it reminded a Turkish friend of something she had heard once from the AKP, Erdogan’s ruling party: that they would not rest until they were living in the apartments with balconies and gardens overlooking the Bosphorus that had always been the preserve of the secular elite they wanted to replace.

Pamuk also writes about hüzün, the melancholy that afflicts the citizens of Istanbul. It comes, he says, from the city’s history and its decline, the foghorns on the Bosphorus, from tumbledown walls that have been ruins since the fall of the Byzantine empire, unemployed men in tea houses, covered women waiting for buses that never come, pelting rain and dark evenings: the city’s whole fabric and all the lives within it. “My starting point,” Pamuk wrote, “was the emotion that a child might feel while looking through a steamy window.”

Istanbul is suffering a mighty bout of something like hüzün at the moment. In Pamuk’s work the citizens of Istanbul take a perverse pride in hüzün. No one in Istanbul, or elsewhere in Turkey, can draw comfort from what is happening now. Erdogan’s opponents wonder what kind of future they can have in his Turkey. I think I sensed it, too, in the triumphalist crowds of Erdogan supporters that have been gathering day after day since the coup was defeated.

 

Down with the generals

Erdogan’s opponents are not downcast because the coup failed; a big reason why it did was that it had no public support. Turks know way too much about the authoritarian ways of military rule to want it back. The melancholy is because Erdogan is using the coup to entrench himself even more deeply in power. The purge looks too far-reaching, too organised and too big to have been a quick reaction to the attempt on his power. Instead it seems to be a plan that was waiting to be used.

Turkey is a deeply unhappy country. It is hard to imagine now, but when the Arab uprisings happened in 2011 it seemed to be a model for the Middle East. It had elections and an economy that worked and grew. When I asked Davutoglu around that time whether there would be a new Ottoman sphere of influence for the 21st century, he smiled modestly, denied any such ambition and went on to explain that the 2011 uprisings were the true succession to the Ottoman empire. A century of European, and then American, domination was ending. It had been a false start in Middle Eastern history. Now it was back on track. The people of the region were deciding their futures, and perhaps Turkey would have a role, almost like a big brother.

Turkey’s position – straddling east and west, facing Europe and Asia – is the key to its history and its future. It could be, should be, a rock of stability in a desperately un­stable part of the world. But it isn’t, and that is a problem for all of us.

 

Contagion of war

The coup did not come out of a clear sky. Turkey was in deep crisis before the attempt was made. Part of the problem has come from Erdogan’s divisive policies. He has led the AKP to successive election victories since it first won in 2002. But the policies of his governments have not been inclusive. As long as his supporters are happy, the president seems unconcerned about the resentment and opposition he is generating on the other side of politics.

Perhaps that was inevitable. His mission, as a political Islamist, was to change the country, to end the power of secular elites, including the army, which had been dominant since Mustafa Kemal Atatürk created modern Turkey after the collapse of the Ottoman empire. And there is also the influence of chaos and war in the Middle East. Turkey has borders with Iraq and Syria, and is deeply involved in their wars. The borders do not stop the contagion of violence. Hundreds of people have died in the past year in bomb attacks in Turkish cities, some carried out by the jihadists of so-called Islamic State, and some sent by Kurdish separatists working under the PKK.

It is a horrible mix. Erdogan might be able to deal with it better if he had used the attempted coup to try to unite Turkey. All the parliamentary parties condemned it. But instead, he has turned the power of the state against his opponents. More rough times lie ahead.

Jeremy Bowen is the BBC’s Middle East editor. He tweets @bowenbbc

This article first appeared in the 28 July 2016 issue of the New Statesman, Summer Double Issue