Blockchain.info security [FUNDS STOLEN]

[giantdragon]

I used Blockchain.info online wallet for small transactions on my Windows 7 64-bit PC with strong password kept in KeePass.
Today I noticed that about 1.8 BTC was stolen from one of the addresses (which used for Anonymous Ads earnings), but funds from other addresses in this wallet were not affected.
This leads me on thoughts that Blockchain.info or Firefox may have some weakness in random number generator like the vulnerability was recently found in the Android.

TXID with my funds gone: https://blockchain.info/tx/975412ecc21a0ad949deba3f47c6ac41e42fb7bd3f7eeb36cc071f151003d8c9

[1714287496]

1714287496

[1714287496]

1714287496

[escrow.ms]

https://bitcointalk.org/index.php?topic=271486.msg2907468#msg2907468

Same address, are you sure that you never used wallet on android cell?
I mean same identifier etc.

[giantdragon]

Same address, are you sure that you never used wallet on android cell?
I mean same identifier etc.

Newer used on Android. Only on Windows 7 and few times on Linux Mint.

P.S. Does it mean that all Blockchain.info addresses are vulnerable and funds from them could be stolen at any time?

[gmaxwell]

Were any of the keys imported / brainwallets / or vanity?

[Mike Hearn]

We need the tool that scans for re-used R values.

[giantdragon]

Were any of the keys imported / brainwallets / or vanity?

No one address was ever imported. All generated into the browser (mostly Chrome, few times Firefox).

[Jesse James]

Your transaction with the repeated signature R values is this one:

https://blockchain.info/tx/e05d98ee17d4610eb4e63cf27dd4e63f7128dc28187ae73588ca5562d9391bb8

Inputs 0 and 2 specifically.  If you can 100% confirm the exact client software / platform / browser that generated this transaction, that would be helpful.

The 'k' value was 0x7f561ff2d0a848480f575773dd8b72f17cabc9f202951d9c7392b331b0565f28

I have a tool that can find these things and solve for the private keys but it's a total kludge and I don't use it to snatch funds nor run it on a rolling basis.   However, at this point I'm thinking of augmenting it so that it snatches weak funds immediately so I can return funds to peeps who are able to prove ownership of the victim address by signing a message with a bunch of keys with a 1-degree relationship to that address.

... since the guy currently exploiting this at the moment https://blockchain.info/address/1HKywxiL4JziqXrzLKhmB6a74ma6kxbSDj is just cleaning em up and I'm not holding out hope he has plans to return anything.

[Luke-Jr]

However, at this point I'm thinking of augmenting it so that it snatches weak funds immediately so I can return funds to peeps who are able to prove ownership of the victim address by signing a message with a bunch of keys with a 1-degree relationship to that address.

I'd suggest just requiring the signature of the key itself, plus verifying a name/address.
Then share the name/address with others signing for it and let the legit party sue the fraudulent claimee(s) in court.

[smolen]

I'm thinking of augmenting it so that it snatches weak funds immediately

The legal risk is too high.
On the other hand, I thought about writing and releasing such scanner without touching funds myself and letting people to catch and sue each other. I see every bitcoin-related court case as a good thing that make adoption of Bitcoin by business easier.

[gmaxwell]

FWIW, My logs show someone was complaining at one point a while back their new wallet under chrome had someone elses coin in it. They dropped out before I could extract useful information from them. May be related.

One thing that has long really frightened me about all these webwallets is that if they fail to read from the secure rng they just use some snake oil "randomness" (the mouse position) that has practically no entropy.

[Jesse James]

I'm thinking of augmenting it so that it snatches weak funds immediately

The legal risk is too high.
On the other hand, I thought about writing and releasing such scanner without touching funds myself and letting people to catch and sue each other. I see every bitcoin-related court case as a good thing that make adoption of Bitcoin by business easier.

There's only one address implicated in all the recent thefts so I'm not sure how useful releasing a scanner would be ... other than increasing competition for snatching funds from weak addresses.

Although your first point brings up a larger legal question ... if someone makes their private key public (intentionally or non-intentionally) ... under what conditions (if any) and under what legal theory could a 3rd party be liable for signing with it?  Any lawyers out there?

[millsdmb]

Another blockchain.info wallet here loss https://bitcointalk.org/index.php?topic=277601.0

[smolen]

There's only one address implicated in all the recent thefts so I'm not sure how useful releasing a scanner would be ... other than increasing competition for snatching funds from weak addresses.

I'm eager to refresh my math skills and play with modern cryptography a bit. Looks like RNGs are good target to try bit diffusion methods. But if such attempt will succeed, touching any weak address by myself would be both unethical and legally risky. And by publishing research results I'll shift all such problems to someone else

Although your first point brings up a larger legal question ... if someone makes their private key public (intentionally or non-intentionally) ... under what conditions (if any) and under what legal theory could a 3rd party be liable for signing with it?  Any lawyers out there?

The only way I can see under Russian Federation laws to get to such third party is deriving private key from something protected by copyright. OK, IANAL and that's offtopic here.

[giantdragon]

If you can 100% confirm the exact client software / platform / browser that generated this transaction, that would be helpful.

I created this address in April 2013 with Google Chrome on Windows 7 64-bit.

P.S. This hacker stole 0.02 BTC again from the same address right after I received earnings from Anonymous Ads!
https://blockchain.info/tx/edf891400feba38339738910aeb40545a77e7c69ad9ff58ab208999df3d6db4f

[giantdragon]

The only way I can see under Russian Federation laws to get to such third party is deriving private key from something protected by copyright. OK, IANAL and that's offtopic here.

According to Russian criminal code it seems to be fraud (article 159 applies to any property, not only fiat money).

[gmaxwell]

I created this address in April 2013 with Google Chrome on Windows 7 64-bit.

We need to know what system created the transactions that were linked above as reusing R values.

Though the sudden reports suggests to me that this was a product of recent bc.i code changes, not the browsers.

[giantdragon]

We need to know what system created the transactions that were linked above as reusing R values.

Do you mean that need to know what was hacker's system?

[smolen]

The only way I can see under Russian Federation laws to get to such third party is deriving private key from something protected by copyright. OK, IANAL and that's offtopic here.

According to Russian criminal code it seems to be fraud (article 159 applies to any property, not only fiat money).

It would be rather article 158 or freshly minted 159.6. But the Bitcoin should pass tests defined in article 128 of Civil Code first. When (and if) it will be deemed as some kind of property, the advances in tax planning art would be astounding!

[giantdragon]

It would be rather article 158 or freshly minted 159.6. But the Bitcoin should pass tests defined in article 128 of Civil Code first. When (and if) it will be deemed as some kind of property, the advances in tax planning art would be astounding!

In Russia class-action lawsuits are impossible, but individual litigation is too time-consuming and just not worth.

[Jesse James]

Holy shit ... I just re-examined my research on all repeated R-values in signatures made in July/Aug.  

I now suspect blockchain.info was responsible for all of these R repeats except the last .... (note this data is through today - block 253081).

• 2013-07-03 16:33:04 - Relayed by Blockchain.info
• 2013-07-05 22:14:05 - Relayed by Blockchain.info
• 2013-07-13 14:42:39 - Relayed by Blockchain.info
• 2013-07-23 03:16:38 - Relayed by Blockchain.info
• 2013-08-04 07:33:50 - Relayed by Blockchain.info
• 2013-08-06 05:43:31 - Relayed by Blockchain.info
• 2013-08-16 15:39:48 - Relayed by Blockchain.info
• 2013-08-18 16:58:44 - Relayed by Blockchain.info
• 2013-08-19 20:13:31 - Relayed by Blockchain.info

• 2013-07-31 13:27:03 & 2013-08-04 15:41:30 - Relayed from EU and US respectively

The more serious of the 2 android SecureRandom bugs as detailed by the commenter Nikolay Elenkov, only could cause repeated R's across application invocations (and not in the same transaction), thus one would expect to see a R repeat from an android client spaced in time (across transactions) and not relayed directly through blockchain.info.  This fits the pattern of the last example.  

All the other R repeats happen within the same transaction and the transactions are relayed directly through blockchain.info.  Being relayed directly though blockchain.info means it was likely submitted by their wallet (or less likely but also possible ... another wallet that uses their API).  

Edit 1: Updated research to include repeats from recent blocks.