November 16, 2023 at 12:57PM
Researchers at Unciphered have discovered a vulnerability in cryptocurrency wallets generated between 2011 and 2015, which allows threat actors to use brute-force methods to recover passwords. The vulnerability is related to an outdated randomization function in BitcoinJS. Millions of wallets with potentially hundreds of millions of dollars are at risk. Unciphered has been working with affected companies to inform users and recommend moving assets to newly generated wallets created with trusted software. This vulnerability was previously reported in 2018 by another security researcher.
Key takeaways from the meeting notes:
– Cryptocurrency wallets generated between 2011 and 2015 are vulnerable to an attack that allows threat actors to use brute-force methods to recover passwords for accessing funds.
– The vulnerability is due to a no-longer-used randomization function in BitcoinJS, a JavaScript library for building Bitcoin and other cryptocurrency applications.
– Several projects that used the vulnerable BitcoinJS library are no longer active, but others like Blockchain.com, Bitgo, Dogechain.info, and Blocktrail are still active.
– The vulnerability in BitcoinJS, combined with a weakness in pseudo-random number generators in major browsers at that time, resulted in keys being generated for crypto wallets that were not random enough.
– Unciphered, a startup that helps recover cryptocurrency wallets, discovered the vulnerability while helping a customer recover access to a Bitcoin wallet created in 2014 on Blockchain.com.
– The vulnerability, dubbed “Randstorm,” has been reported to affected entities, and millions of users have been alerted.
– The flaw in BitcoinJS was previously reported in 2018 by a security researcher, who warned about the deficiency in the SecureRandom() function and the lack of a function for generating cryptographically strong random numbers in major web browsers at that time.
– Wallets generated with vulnerable BitcoinJS often had less entropy than required, making them vulnerable to attacks.
– Unciphered was able to successfully recover keys to cryptographic wallets that had been generated with less entropy.
– Wallets generated before March 2012 were the easiest to attack, but even wallets between 2012 and 2015 were vulnerable.
– Users of affected wallets are advised to transition to new options and create new wallets with trusted software.
Please let me know if you need further information or clarification on any of these points.