Android random number flaw implicated in Bitcoin thefts

Bitcoin thefts

Bitcoin is often in the news, not least because it is somewhat controversial.

It's a digital currency, backed by cryptography, not by any central issuing authority. Its "coins" are strings of bits, and anyone can generate one, given enough time (and assuming no-one else generates the same coin first). The calculations required to "mine" a Bitcoin are configured so that the complexity of finding them doubles every four years.

That means there's an exponential dropoff in the rate at which new Bitcoins appear, and that the supply is capped at 21 million Bitcoins.

The number remaining will quickly close in on zero, with 1/2 gone in 2012, 3/4 by 2016, 7/8 by 2020, and so on. By about 2030, we'll be close to that asmyptotic maximum of 21 million coins.

For what it's worth, and it is rather a lot, Bitcoin exchanges currently value each Bitcoin (BTC) around US$100.

Android random number flaw implicated in Bitcoin thefts | The Naked Security

Coinbase – Owning a Bitcoin Exchange Bug Bounty Program

When I first started analyzing the Coinbase website I had a quick look over the site layout and the functionality/attack surface available for potential exploitation. I quickly determined it was running Ruby on Rails based on the encoding of the “_coinbase_session” cookie. This was supported by the fact Coinbase’s founder Brian Armstrong had a lot of Ruby snippets on his Github Gist and some more Ruby questions on his Stack Overflow account.

Reflected XSS vulnerability on Coinbase

I had a lot of fun in the few hours I spent looking at Coinbase while procrastinating from exam study. They have done a lot of things right in regards to CSP, HttpOnly session cookies and two-step authentication but are let down with the integration of third party components such as Doorkeeper and ZeroClipboard. It is difficult to get any reasonably complex site completely secure and even sites doing more than $15 million USD per month in Bitcoin transaction volume can have a number of critical issues which a blackbox attacker could discover. I would recommend for all web developers to check out the guides on the OWASP website which cover all the key areas where security problems can occur in web apps.

The article will cover following vulnerabilities: 

• Reflected XSS
• Persistent XSS on Merchant Checkout Pages
• Insecure OAuth Application Approval
• Insecure OAuth Redirect URI in the Coinbase Mobile App

Full article | Donncha O'Cearbhaill