vit05 (OP)
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 27, 2019, 07:36:46 AM Merited by bones261 (3), ABCbits (2), OgNasty (1), vapourminer (1), NeuroticFish (1), BitMaxz (1), Lucius (1), Wind_FURY (1), TryNinja (1), bitmover (1), HCP (1) |
|
https://www.reddit.com/r/Bitcoin/comments/av987o/security_vulnerability_coinomi_wallet_sends_your/?utm_source=reddit-androidmore info and for those that don't want to click through to twitter: Demo video: https://streamable.com/keq40When you enter your seed phrase to recover a new wallet, the Coinomi app makes a request to Google's spellcheck api to spellcheck the seed phrase. Yup, I know. The plain text seed phrase is accessible to Google (although transport uses SSL so it's encrypted over the wire). However this does mean that if you're using Coinomi your seed phrase is likely sitting in plain text logfiles at Google, accessible to a large number of employees. I'd recommend if you use Coinomi wallet to immediately move all of your funds to a different wallet. I'd suggest something open source and well known or ideally a hardware wallet. Full credit goes to https://twitter.com/warith2020 for finding the vuln. He's also claimed he's lost about $70k of funds from his wallet and Coinomi are avoiding the question of whether they'll reimburse him. This is why he's now decided to go public. Read more from him here: https://www.avoid-coinomi.com/
O didn't check, and I do not use coinomi. But it appears to be something serious and stupid.
|
|
|
|
Lucius
Legendary
Offline
Activity: 3346
Merit: 5995
Crypto Swap Exchange🈺
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 27, 2019, 10:50:51 AM |
|
vit05, thanks for this information, it is really unbelievable that a company which provide cryptocurrency wallet can allow this kind of security flaw. From provided links we can also see that Coinomi is attempting to cover it up by deleting anything related to this incident.
I read a lot of different opinions on Reddit, some users say that it is not possible that someone in Google reach such data, and also that this is inside job involved some bad employee of Coinomi and Google. Some others say that it was stupid to keep so much money in such wallet, and I agree with that. Imagine that some 60$+ less or more would save all that money, so we can not blame hackers because they exploiting all possible failures, from people and from unsafe technologies.
|
|
|
|
|
bitmover
Legendary
Online
Activity: 2408
Merit: 6192
Crypto Swap Exchange🈺
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 27, 2019, 12:30:04 PM |
|
Thanks for sharing this
I use coinomi for years. I really like that wallet, as it is easy to use and I consider it safe (but I just keep small amounts of money there). Usually I put at the most the value of my smartphone in a mobile wallet.
It's practical and the UI is very good. Easy to set fees , add any token or and most of coins, etc...
I will look for more information about this incident, and I will consider moving my funds somewhere else.
|
|
|
|
gentlemand
Legendary
Offline
Activity: 2590
Merit: 3014
Welt Am Draht
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 27, 2019, 06:20:54 PM |
|
I use coinomi for years. I really like that wallet, as it is easy to use and I consider it safe (but I just keep small amounts of money there). Usually I put at the most the value of my smartphone in a mobile wallet.
It's one of the few non open source ones out there and this proves why it's a bad idea. I've got plenty of shitcoins on mine and there probably isn't another place for some of them. I'll stay put and take it like a man when the CEO of Google chooses to enrich himself at my expense. According to that - https://twitter.com/RichardHeartWin/status/1100681518199042048 it's a desktop only issue that's now been sorted but I'm sure there are plenty more holes out there.
|
|
|
|
ABCbits
Legendary
Offline
Activity: 2982
Merit: 7846
Crypto Swap Exchange
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 27, 2019, 06:28:28 PM |
|
FYI, Coinomi made official response regarding this matter at https://medium.com/coinomi/official-statement-on-spell-check-findings-547ca348676b. It doesn't like official statement, especially on this part The spell-check requests that were sent over to Google API were not processed, cached or stored and the requests themselves returned an error (code: 400) as they were flagged as “Bad Request”¹ and weren’t processed further by Google²
They act like they know how Google API works or simply assume Google API discard all bad request even though only Google engineer who knows Google API's behavior. While i doubt it's the reason Warith's coins is stolen, it clearly shows that they're not being professional or try to blame Warith instead. Glad i stopped using Coinomi after they decide made their wallet closed-source.
|
|
|
|
bitmover
Legendary
Online
Activity: 2408
Merit: 6192
Crypto Swap Exchange🈺
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 27, 2019, 10:13:31 PM |
|
It's one of the few non open source ones out there and this proves why it's a bad idea.
This is true I don't get why those companies insist in making closed source wallets. I am glad this is a desktop only issue, as I am using it on Mobile. Desktop version is quite new, so this will probably be fixed
|
|
|
|
Coiner.de
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 27, 2019, 10:29:02 PM |
|
The spell-check requests that were sent over to Google API were not processed, cached or stored and the requests themselves returned an error (code: 400) as they were flagged as “Bad Request”¹ and weren’t processed further by Google²
They act like they know how Google API works or simply assume Google API discard all bad request even though only Google engineer who knows Google API's behavior. While i doubt it's the reason Warith's coins is stolen, it clearly shows that they're not being professional or try to blame Warith instead. You didn't read the footnote ², did you? It says "We have asked Google to confirm that bad requests’ text body isn’t stored on their servers, we will update our statement accordingly." I would believe that Google logs bad requests until the end of time. I wonder if they will answer.
|
|
|
|
BuySomeBitcoins
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 27, 2019, 10:53:00 PM |
|
That's why everyone should use a hardware wallet with cable connection ONLY (not bluetooth) and an light client like Electrum.
|
|
|
|
BitMaxz
Legendary
Offline
Activity: 3360
Merit: 3094
BTC price road to $80k
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 27, 2019, 11:39:42 PM |
|
Wow didn't realize that they use the Google's spell check API to suggest a word in Coinomi, I thought that they develop it without any 3rd party API's. This is big discourage for the user's who use Coinomi including me. I'm not holding a big amount but I have few altcoins from the wallet. So, I think it's time to switch to a new wallet and transfer all funds to better and secured wallet. I'm sorry for that man the one who lost $70k it's honestly a big amount and I am sure that the big G still monitoring Coinomi user's wallet who holds a large number of funds and sooner it becomes another victim of this. That's why everyone should use a hardware wallet with cable connection ONLY (not bluetooth) and an light client like Electrum.
I agree with this but not for Electrum, it is just a Bitcoin wallet. Coinomi supports many coins and token so hardware wallet is the best for this.
|
|
|
|
|
BuySomeBitcoins
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 28, 2019, 01:34:54 AM |
|
Wow didn't realize that they use the Google's spell check API to suggest a word in Coinomi, I thought that they develop it without any 3rd party API's. This is big discourage for the user's who use Coinomi including me. I'm not holding a big amount but I have few altcoins from the wallet. So, I think it's time to switch to a new wallet and transfer all funds to better and secured wallet. I'm sorry for that man the one who lost $70k it's honestly a big amount and I am sure that the big G still monitoring Coinomi user's wallet who holds a large number of funds and sooner it becomes another victim of this. That's why everyone should use a hardware wallet with cable connection ONLY (not bluetooth) and an light client like Electrum.
I agree with this but not for Electrum, it is just a Bitcoin wallet. Coinomi supports many coins and token so hardware wallet is the best for this. Why would anyone use a wallet supporting shitcoins to store his bitcoins. Never mix gold with cow dungs, so I do think bitcoin should be stored in a BITCOIN-ONLY wallet.
|
|
|
|
pooya87
Legendary
Offline
Activity: 3556
Merit: 10825
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
February 28, 2019, 03:51:14 AM |
|
FYI, Coinomi made official response regarding this matter at https://medium.com/coinomi/official-statement-on-spell-check-findings-547ca348676b. It doesn't like official statement, especially on this part The spell-check requests that were sent over to Google API were not processed, cached or stored and the requests themselves returned an error (code: 400) as they were flagged as “Bad Request”¹ and weren’t processed further by Google²
They act like they know how Google API works or simply assume Google API discard all bad request even though only Google engineer who knows Google API's behavior. While i doubt it's the reason Warith's coins is stolen, it clearly shows that they're not being professional or try to blame Warith instead. Glad i stopped using Coinomi after they decide made their wallet closed-source. it doesn't matter what Google API does or doesn't do, they shouldn't have done it in first place! "spell-check" is pure bullshit, why don't other wallets do it? that doesn't even make sense to do something like that. imagine your Electrum wallet sending your seed to some server to be "checked" ![Cheesy](https://bitcointalk.org/Smileys/default/cheesy.gif)
|
|
|
|
Wind_FURY
Legendary
Offline
Activity: 3024
Merit: 1884
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 01, 2019, 06:23:52 AM |
|
Hahaha. Sends seeds to Google spell checker API. What could go wrong? ![Cool](https://bitcointalk.org/Smileys/default/cool.gif) I believe they also had some privacy issues with their mobile wallet, which they handled badly, instead of rewarding the person who found the problem.
|
| .SHUFFLE.COM.. | ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ | ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ | . ...Next Generation Crypto Casino... |
|
|
|
Pmalek
Legendary
Offline
Activity: 2870
Merit: 7430
Playgram - The Telegram Casino
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 01, 2019, 09:29:32 AM |
|
So, I think it's time to switch to a new wallet and transfer all funds to better and secured wallet. I have some coins in a Coinomi Android wallet as well. But I don't keep any Bitcoin there. The problem is that Coinomi was a good choice for storing alts up until this issue was made public. And the question is do some other brands use the same method for seed verification? I guess time will tell.
|
|
|
|
▄▄███████▄▄███████ ▄███████████████▄▄▄▄▄ ▄████████████████████▀░ ▄█████████████████████▄░ ▄█████████▀▀████████████▄ ██████████████▀▀█████████ █████████████████████████ ██████████████▄▄█████████ ▀█████████▄▄████████████▀ ▀█████████████████████▀░ ▀████████████████████▄░ ▀███████████████▀▀▀▀▀ ▀▀███████▀▀███████ | ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ Playgram.io ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ | ▄▄▄░░ ▀▄ █ █ █ █ █ █ █ ▄▀ ▀▀▀░░
| │ | ▄▄▄███████▄▄▄ ▄▄███████████████▄▄ ▄███████████████████▄ ▄██████████████▀▀█████▄ ▄██████████▀▀███▄██▐████▄ ██████▀▀████▄▄▀▀█████████ ████▄▄███▄██▀█████▐██████ ██████████▀██████████████ ▀███████▌▐██▄████▐██████▀ ▀███████▄▄███▄████████▀ ▀███████████████████▀ ▀▀███████████████▀▀ ▀▀▀███████▀▀▀ | | │ | ██████▄▄███████▄▄████████ ███▄███████████████▄░░▀█▀ ███████████░█████████░░█ ░█████▀██▄▄░▄▄██▀█████░█ █████▄░▄███▄███▄░▄██████ ████████████████████████ ████████████████████████ ██░▄▄▄░██░▄▄▄░██░▄▄▄░███ ██░░░█░██░░░█░██░░░█░████ ██░░█░░██░░█░░██░░█░░████ ██▄▄▄▄▄██▄▄▄▄▄██▄▄▄▄▄████ ███████████████████████ ███████████████████████ | | │ | ► | |
|
|
|
gentlemand
Legendary
Offline
Activity: 2590
Merit: 3014
Welt Am Draht
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 01, 2019, 11:15:33 AM |
|
[ And the question is do some other brands use the same method for seed verification? I guess time will tell.
Most wallets are open source so a hole as gaping as this would be picked up and screeched about rather more rapidly. I'm keeping my shit in there. For the real coins there are plenty of other sound choices.
|
|
|
|
franckuestein
Legendary
Offline
Activity: 1960
Merit: 1130
Truth will out!
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 04, 2019, 05:39:31 PM |
|
It's one of the few non open source ones out there and this proves why it's a bad idea.
This is true I don't get why those companies insist in making closed source wallets. I am glad this is a desktop only issue, as I am using it on Mobile. Desktop version is quite new, so this will probably be fixed Because despite the existence of open source solutions, unfortunately people keep using and recommending it. Reasons: ignorance questionable ease of use marketing few research before importing private keys
|
[ AVAILABLE SIGNATURE SPACE ]
|
|
|
joniboini
Legendary
Offline
Activity: 2296
Merit: 1802
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 05, 2019, 01:51:23 AM |
|
I believe they also had some privacy issues with their mobile wallet, which they handled badly, instead of rewarding the person who found the problem.
Luke Childs case right? I still wonder how can Coinomi act like a spoiled child and start to attack him when he tried to help them fix probably one of the most important issues in crypto. Looks like they did it again now. Time to add Coinomi to my shitwallet list.
|
| | . .Duelbits. | │ | ..........UNLEASH.......... THE ULTIMATE GAMING EXPERIENCE | │ | DUELBITS FANTASY SPORTS | ████▄▄▄█████▄▄▄ ░▄████████████████▄ ▐██████████████████▄ ████████████████████ ████████████████████▌ █████████████████████ ████████████████▀▀▀ ███████████████▌ ███████████████▌ ████████████████ ████████████████ ████████████████ ████▀▀███████▀▀ | . ▬▬ VS ▬▬ | ████▄▄▄█████▄▄▄ ░▄████████████████▄ ▐██████████████████▄ ████████████████████ ████████████████████▌ █████████████████████ ███████████████████ ███████████████▌ ███████████████▌ ████████████████ ████████████████ ████████████████ ████▀▀███████▀▀ | /// PLAY FOR FREE /// WIN FOR REAL | │ | ..PLAY NOW.. | |
|
|
|
Brenny431
Newbie
Offline
Activity: 7
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 27, 2019, 12:19:05 PM |
|
|
|
|
|
bitmover
Legendary
Online
Activity: 2408
Merit: 6192
Crypto Swap Exchange🈺
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
March 27, 2019, 06:25:11 PM |
|
Lol, I didn't feel any better after reading it The seed phrase wasn’t being transmitted at all unless the user chose to explicitly restore their Desktop wallets Of course users will want to restore their wallets. If they restore it's because there are funds at it.
|
|
|
|
|