Popular paper wallet app falls prey to mysterious vulnerability

A deadly vulnerability in WalletGenerator, a service that generates printable private and public keys for storing cryptocurrencies, could affect users who have put funds in wallets generated by the site after August 17, 2018.

- Advertisement -

Analysts at MyCrypto found today that WalletGenerator’s capacity to truly “randomize” public and private keys (keypairs)—an essential part of ensuring that the funds are cryptographically secure and unhackable—has been contaminated. Instead of being generated randomly, they are instead being spawned from a single, static data source; an image rendered on the WalletGenerator website itself.

This means that keypairs can be easily reproduced by a bad actor with access to the image data. “It illustrates fully that the randomness is not random,” said Harry Denley, MyCrypto’s director of security, in an interview.

He described the bug as “brilliant” for its ability to remain undetected. “Usually with malicious key generators, they send the generated secrets back to their server once the user has generated them,” he said. This one leaves the secrets with the user, leaving its methods untraceable.

In other words, only the person with access to the images—whoever is behind the WalletGenerator website—can reproduce the keypairs.

Denley, in a Medium post, added that the bugs had been mysteriously removed after he reached out to the site’s operator on May 22. The vulnerability was originally caused by “changes to the code” apparently introduced in August last year, and the changes are preserved in the Wayback Machine.

“In this strange turn of events, we still have no idea whether the current site owner is the malicious party, if the server is insecure, or both,” Denley wrote in the Medium post.

- Advertisement -

For the afflicted? Denley advises users to immediately “create a new keypair / wallet and move your funds to that new, secure address.” MyCrypto also recommends sending funds to BitAddress, an offline cold-wallet service.

WalletGenerator appears fairly popular, and racks up some 140,000 monthly users according to SimilarWeb. Its service allows users to download a—supposedly—randomized keypair onto a paper wallet, which they can then print and store offline.  

We were unable to reach WalletGenerator for comment.

- Advertisement -

Source

Previous Articles:

- Advertisement -

Latest News

Nissan Recalls 480,000 Vehicles; Stock Surges Despite Engine Issue

Nissan is recalling over 480,000 vehicles in the U.S. and Canada due to engine...

Bitcoin Risks $2.67B in Longs if Price Falls Below $108K Level

Bitcoin's price approaches its all-time high, with traders watching for signs of a breakout...

CrowdStrike Stock Hits Record High After Analysts Hike Price Target

CrowdStrike Holdings (CRWD) stock reached an all-time high with a gain of more than...

Amber International Raises $25.5M to Grow $100M Crypto Reserve Fund

Amber International Holding raised $25.5 million in a private placement to expand its $100...

Traders Flock to Hyperliquid Apps Amid Hopes for Airdrop Rewards

Investors are moving millions into projects on the Hyperliquid blockchain in hopes of future...

Must Read

5 Best Hacking eBooks for Beginners

In this article we present the 5 Best Hacking eBooks for beginners as ranked by our editorial teamWelcome to the world of hacking, where...