7

The Bitcoin Project recently announced a bug in the SecureRandom implementation on Android, which caused Bitcoin wallet apps to generate weak private keys that leave bitcoins vulnerable to theft. The major wallet apps have released updates which apparently include their own RNGs instead of using SecureRandom.

However, in principle, weak random numbers could cause vulnerability in any crypto system where they're used. Thus this could affect any app that uses this function for secure communication: perhaps pgp, ssh, remote access and tracking, or even the built in ssl and https implementations.

Is there any information about other affected apps? Has Google announced an OS update to fix the bug, or otherwise responded to the issue?

  • I believe that Android's SSL/HTTPS uses OpenSSL which has its own RNG. – Peanut Aug 15 '13 at 23:15
3

I do not know of any specific apps, but it certainly CAN (on probably does) affect other apps. Read here for Google's notes on the problem, as well as info for developers on how to avoid the bug. They have also issued patches and sent them to their OHA partners, but it is up to each of them to roll out the update.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.