giantdragon (OP)
Legendary
Offline
Activity: 1582
Merit: 1002
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 19, 2013, 03:27:16 PM |
|
I used Blockchain.info online wallet for small transactions on my Windows 7 64-bit PC with strong password kept in KeePass. Today I noticed that about 1.8 BTC was stolen from one of the addresses (which used for Anonymous Ads earnings), but funds from other addresses in this wallet were not affected. This leads me on thoughts that Blockchain.info or Firefox may have some weakness in random number generator like the vulnerability was recently found in the Android. TXID with my funds gone: https://blockchain.info/tx/975412ecc21a0ad949deba3f47c6ac41e42fb7bd3f7eeb36cc071f151003d8c9
|
|
|
|
|
giantdragon (OP)
Legendary
Offline
Activity: 1582
Merit: 1002
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 19, 2013, 03:40:05 PM |
|
Same address, are you sure that you never used wallet on android cell? I mean same identifier etc.
Newer used on Android. Only on Windows 7 and few times on Linux Mint. P.S. Does it mean that all Blockchain.info addresses are vulnerable and funds from them could be stolen at any time? ![Huh](https://bitcointalk.org/Smileys/default/huh.gif)
|
|
|
|
gmaxwell
Staff
Legendary
Offline
Activity: 4228
Merit: 8644
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 19, 2013, 06:40:37 PM |
|
Were any of the keys imported / brainwallets / or vanity?
|
|
|
|
Mike Hearn
Legendary
Offline
Activity: 1526
Merit: 1129
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 19, 2013, 09:15:46 PM |
|
We need the tool that scans for re-used R values.
|
|
|
|
giantdragon (OP)
Legendary
Offline
Activity: 1582
Merit: 1002
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 19, 2013, 09:19:10 PM |
|
Were any of the keys imported / brainwallets / or vanity?
No one address was ever imported. All generated into the browser (mostly Chrome, few times Firefox).
|
|
|
|
Jesse James
Newbie
Offline
Activity: 29
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 19, 2013, 11:14:12 PM |
|
Your transaction with the repeated signature R values is this one: https://blockchain.info/tx/e05d98ee17d4610eb4e63cf27dd4e63f7128dc28187ae73588ca5562d9391bb8Inputs 0 and 2 specifically. If you can 100% confirm the exact client software / platform / browser that generated this transaction, that would be helpful. The 'k' value was 0x7f561ff2d0a848480f575773dd8b72f17cabc9f202951d9c7392b331b0565f28 I have a tool that can find these things and solve for the private keys but it's a total kludge and I don't use it to snatch funds nor run it on a rolling basis. However, at this point I'm thinking of augmenting it so that it snatches weak funds immediately so I can return funds to peeps who are able to prove ownership of the victim address by signing a message with a bunch of keys with a 1-degree relationship to that address. ... since the guy currently exploiting this at the moment https://blockchain.info/address/1HKywxiL4JziqXrzLKhmB6a74ma6kxbSDj is just cleaning em up and I'm not holding out hope he has plans to return anything.
|
|
|
|
Luke-Jr
Legendary
Offline
Activity: 2576
Merit: 1186
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 19, 2013, 11:27:58 PM |
|
However, at this point I'm thinking of augmenting it so that it snatches weak funds immediately so I can return funds to peeps who are able to prove ownership of the victim address by signing a message with a bunch of keys with a 1-degree relationship to that address. I'd suggest just requiring the signature of the key itself, plus verifying a name/address. Then share the name/address with others signing for it and let the legit party sue the fraudulent claimee(s) in court. ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif)
|
|
|
|
smolen
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 19, 2013, 11:59:35 PM |
|
I'm thinking of augmenting it so that it snatches weak funds immediately
The legal risk is too high. On the other hand, I thought about writing and releasing such scanner without touching funds myself and letting people to catch and sue each other. I see every bitcoin-related court case as a good thing that make adoption of Bitcoin by business easier.
|
Of course I gave you bad advice. Good one is way out of your price range.
|
|
|
gmaxwell
Staff
Legendary
Offline
Activity: 4228
Merit: 8644
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 20, 2013, 12:11:06 AM |
|
FWIW, My logs show someone was complaining at one point a while back their new wallet under chrome had someone elses coin in it. They dropped out before I could extract useful information from them. May be related.
One thing that has long really frightened me about all these webwallets is that if they fail to read from the secure rng they just use some snake oil "randomness" (the mouse position) that has practically no entropy.
|
|
|
|
Jesse James
Newbie
Offline
Activity: 29
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 20, 2013, 12:22:16 AM |
|
I'm thinking of augmenting it so that it snatches weak funds immediately
The legal risk is too high. On the other hand, I thought about writing and releasing such scanner without touching funds myself and letting people to catch and sue each other. I see every bitcoin-related court case as a good thing that make adoption of Bitcoin by business easier. There's only one address implicated in all the recent thefts so I'm not sure how useful releasing a scanner would be ... other than increasing competition for snatching funds from weak addresses. Although your first point brings up a larger legal question ... if someone makes their private key public (intentionally or non-intentionally) ... under what conditions (if any) and under what legal theory could a 3rd party be liable for signing with it? Any lawyers out there?
|
|
|
|
|
smolen
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 20, 2013, 12:44:21 AM |
|
There's only one address implicated in all the recent thefts so I'm not sure how useful releasing a scanner would be ... other than increasing competition for snatching funds from weak addresses.
I'm eager to refresh my math skills and play with modern cryptography a bit. Looks like RNGs are good target to try bit diffusion methods. But if such attempt will succeed, touching any weak address by myself would be both unethical and legally risky. And by publishing research results I'll shift all such problems to someone else ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif) Although your first point brings up a larger legal question ... if someone makes their private key public (intentionally or non-intentionally) ... under what conditions (if any) and under what legal theory could a 3rd party be liable for signing with it? Any lawyers out there?
The only way I can see under Russian Federation laws to get to such third party is deriving private key from something protected by copyright. OK, IANAL and that's offtopic here.
|
Of course I gave you bad advice. Good one is way out of your price range.
|
|
|
|
giantdragon (OP)
Legendary
Offline
Activity: 1582
Merit: 1002
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 20, 2013, 12:49:12 AM |
|
The only way I can see under Russian Federation laws to get to such third party is deriving private key from something protected by copyright. OK, IANAL and that's offtopic here.
According to Russian criminal code it seems to be fraud (article 159 applies to any property, not only fiat money).
|
|
|
|
gmaxwell
Staff
Legendary
Offline
Activity: 4228
Merit: 8644
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 20, 2013, 12:52:43 AM |
|
I created this address in April 2013 with Google Chrome on Windows 7 64-bit.
We need to know what system created the transactions that were linked above as reusing R values. Though the sudden reports suggests to me that this was a product of recent bc.i code changes, not the browsers.
|
|
|
|
giantdragon (OP)
Legendary
Offline
Activity: 1582
Merit: 1002
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 20, 2013, 12:58:19 AM |
|
We need to know what system created the transactions that were linked above as reusing R values.
Do you mean that need to know what was hacker's system?
|
|
|
|
smolen
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 20, 2013, 01:03:37 AM |
|
The only way I can see under Russian Federation laws to get to such third party is deriving private key from something protected by copyright. OK, IANAL and that's offtopic here.
According to Russian criminal code it seems to be fraud (article 159 applies to any property, not only fiat money). It would be rather article 158 or freshly minted 159.6. But the Bitcoin should pass tests defined in article 128 of Civil Code first. When (and if) it will be deemed as some kind of property, the advances in tax planning art would be astounding!
|
Of course I gave you bad advice. Good one is way out of your price range.
|
|
|
giantdragon (OP)
Legendary
Offline
Activity: 1582
Merit: 1002
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 20, 2013, 01:11:36 AM |
|
It would be rather article 158 or freshly minted 159.6. But the Bitcoin should pass tests defined in article 128 of Civil Code first. When (and if) it will be deemed as some kind of property, the advances in tax planning art would be astounding!
In Russia class-action lawsuits are impossible, but individual litigation is too time-consuming and just not worth.
|
|
|
|
Jesse James
Newbie
Offline
Activity: 29
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 20, 2013, 01:25:07 AM Last edit: August 20, 2013, 03:06:44 AM by Jesse James |
|
Holy shit ... I just re-examined my research on all repeated R-values in signatures made in July/Aug. I now suspect blockchain.info was responsible for all of these R repeats except the last .... (note this data is through today - block 253081). The more serious of the 2 android SecureRandom bugs as detailed by the commenter Nikolay Elenkov, only could cause repeated R's across application invocations (and not in the same transaction), thus one would expect to see a R repeat from an android client spaced in time (across transactions) and not relayed directly through blockchain.info. This fits the pattern of the last example. All the other R repeats happen within the same transaction and the transactions are relayed directly through blockchain.info. Being relayed directly though blockchain.info means it was likely submitted by their wallet (or less likely but also possible ... another wallet that uses their API). Edit 1: Updated research to include repeats from recent blocks.
|
|
|
|
|