Popular paper wallet app falls prey to mysterious vulnerability

A deadly vulnerability in WalletGenerator, a service that generates printable private and public keys for storing cryptocurrencies, could affect users who have put funds in wallets generated by the site after August 17, 2018.

- Advertisement -

Analysts at MyCrypto found today that WalletGenerator’s capacity to truly “randomize” public and private keys (keypairs)—an essential part of ensuring that the funds are cryptographically secure and unhackable—has been contaminated. Instead of being generated randomly, they are instead being spawned from a single, static data source; an image rendered on the WalletGenerator website itself.

This means that keypairs can be easily reproduced by a bad actor with access to the image data. “It illustrates fully that the randomness is not random,” said Harry Denley, MyCrypto’s director of security, in an interview.

He described the bug as “brilliant” for its ability to remain undetected. “Usually with malicious key generators, they send the generated secrets back to their server once the user has generated them,” he said. This one leaves the secrets with the user, leaving its methods untraceable.

In other words, only the person with access to the images—whoever is behind the WalletGenerator website—can reproduce the keypairs.

Denley, in a Medium post, added that the bugs had been mysteriously removed after he reached out to the site’s operator on May 22. The vulnerability was originally caused by “changes to the code” apparently introduced in August last year, and the changes are preserved in the Wayback Machine.

“In this strange turn of events, we still have no idea whether the current site owner is the malicious party, if the server is insecure, or both,” Denley wrote in the Medium post.

- Advertisement -

For the afflicted? Denley advises users to immediately “create a new keypair / wallet and move your funds to that new, secure address.” MyCrypto also recommends sending funds to BitAddress, an offline cold-wallet service.

WalletGenerator appears fairly popular, and racks up some 140,000 monthly users according to SimilarWeb. Its service allows users to download a—supposedly—randomized keypair onto a paper wallet, which they can then print and store offline.  

We were unable to reach WalletGenerator for comment.

- Advertisement -

Source

Previous Articles:

- Advertisement -

Latest News

Coinbase Base App Rebrand Sparks Zora Token and SocialFi Surge

Coinbase rebranded its Wallet to the Base App on July 16, sparking a surge...

Solana Holds $177 Support as ETF Delays Weigh, Eyes $205 Rebound

Solana (SOL) saw its price fall by 3.2% this week after a strong rise...

Astronomer Turns Viral CEO Kiss Cam Scandal Into Data-Driven Win

Astronomer, a data infrastructure company, faced a viral public incident involving its CEO and...

Japan’s Crypto Bottleneck: Regulation, Not Taxes, Drives Talent Out

Regulatory approval delays are causing crypto startups to leave Japan.A proposed 20% flat tax...

Solana Rallies 5%, Eyes $200 as Bulls Challenge $188 Resistance

Solana (SOL) has recovered, rising over 5% in 24 hours and 30% in the...

Must Read

7 Best Audiobooks on Cybersecurity

Cybersecurity has become an essential topic in our increasingly digital world. As technology evolves and becomes more integrated into our daily lives, the importance...