Google Acknowledges Android Security Issue That Led To Bitcoin Theft
Earlier this month, it surfaced that Bitcoin wallets based on Android were vulnerable to being robbed, something Bitcoin.org warned users about in a security advisory. In the advisory, the organization stated that the problem originated from a security issue regarding the randomly-generated secure numbers, and it was the fault of Android, meaning a wallet created with any app was vulnerable. Google has acknowledged this problem, explaining the cause in a write up over on the Android blogspot.
Although the security issue didn't affect apps where the end user had no control over the private keys, it did affect quite a bit who fell into the other end of the spectrum, with many taking to various Bitcoin-related forums to discuss and – on occasion – lament the vulnerability. Because of the complaints, Google kicked off an investigation into the issue, eventually uncovering the problem.
According to a blog post over at the Android Developers blogspot, the issue was caused by Java Cryptography Architecture issues. Said Alex Klyubin, an Android security engineer:
"We have now determined that applications which use the Java Cryptography Architecture (JCA) for key generation, signing, or random number generation may not receive cryptographically strong values on Android devices due to improper initialization of the underlying PRNG. Applications that directly invoke the system-provided OpenSSL PRNG without explicit initialization on Android are also affected."
To correct the issue, Google has rolled out some patches that it says make sure Android's OpenSSL PRNG initializes properly. In addition, it advises developers to take some specific steps in updating their applications to correct this issue, all of which can be found the write up over on the Android Developers blogspot.
The issue extends beyond just Bitcoins, however. As the folks over at Ars Technica point out, security firm Symantec beat Google to the punch in posting a write up of the issue, stating that the number of apps affected could be in the six-digit range.
SOURCE: ars technica