Google patches Android after Bitcoin wallet issue

Applications that used the random number generator within Android could be at risk

Google is distributing patches for a cryptography flaw in Android that may affect hundreds of thousands of applications.

The patches have been passed to partners belonging to the Open Handset Alliance, a trade group dedicated to development of Android, wrote Alex Klyubin, an Android security engineer.

Affected applications are those that rely on the pseudo random number generator (PRNG) within the Java Cryptography Architecture or "directly invoke the system-provided OpenSSL PRNG without explicit initialization on Android," Klyubin wrote.

Random numbers are used in part to generate secure encryption keys and for other cryptography processes. In some cases, the numbers were not "cryptographically strong values," Klyubin wrote.

Application developers are advised to "evaluate whether to regenerate cryptographic keys or other random values previously generated," he wrote.

The flaw became widely known after a Bitcoin developer group warned Sunday that it made bitcoins stored in some Android software clients vulnerable to theft.

According to a post on a popular Bitcoin forum on Saturday, several users reported they were victims of theft, with their coins sent to an address that had amassed 55.82 bitcoins, worth around US$6,200 at market price on Thursday.

In the case of the Bitcoin clients, the random numbers are used to formulate transaction IDs that are entered into the blockchain, the public ledger of Bitcoin transactions.

If the same random number is used in some transactions associated with the same Bitcoin address, it could allow an attacker to figure out the private key. With the private key, an attacker could steal someone's bitcoins.

At least four Android Bitcoin clients -- Bitcoin Wallet, Blockchain, Mycelium Bitcoin Wallet and BitcoinSpinner -- were fixed just before Google's patch release.

Symantec found that as many as 360,000 other Android applications rely on the component in a similar fashion as the Bitcoin software applications.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags GooglepatchesExploits / vulnerabilities

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Cool Tech

Bang and Olufsen Beosound Stage - Dolby Atmos Soundbar

Learn more >

Toys for Boys

Nakamichi Delta 100 3-Way Hi Fi Speaker System

Learn more >

Sony WF-1000XM3 Wireless Noise Cancelling Headphones

Learn more >

ASUS ROG, ACRONYM partner for Special Edition Zephyrus G14

Learn more >

Family Friendly

Mario Kart Live: Home Circuit for Nintendo Switch

Learn more >

Philips Sonicare Diamond Clean 9000 Toothbrush

Learn more >

Stocking Stuffer

Teac 7 inch Swivel Screen Portable DVD Player

Learn more >

SunnyBunny Snowflakes 20 LED Solar Powered Fairy String

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?