Bitcoin wallet Update

Yesterday I’ve written on RAT for Android today we will speak of a weakness in some Android wallet apps for the popular mobile operating system that exposes Bitcoin users to risk of theft. The news has been issued by the Bitcoin Foundation that Android “wallet” apps including Bitcoin Wallet and BitcoinSpinner are affected by a serious flaw that could be exploited by cybercriminals.

“We recently learned that a component of Android responsible for generating secure random numbers contains critical weaknesses, that render all Android wallets generated to date vulnerable to theft. Because the problem lies with Android itself, this problem will affect you if you have a wallet generated by any Android app. An incomplete list would be Bitcoin Wallet, blockchain.info wallet, BitcoinSpinner and Mycelium Wallet. Apps where you don’t control the private keys at all are not affected. For example, exchange frontends like the Coinbase or Mt Gox apps are not impacted by this issue because the private keys are not generated on your Android phone.”

The Android “wallet” apps vulnerability is related to OS’s ability to generate sequences of secure random numbers to secure the wallet, practically Android’s SecureRandom Java program sometimes repeats the number sequences instead to make unique.

The security issues is specific for Android OS and affect all Android wallet apps that devolve the generation of private keys to the user’s mobile device, Coinbase or Mt Gox apps are not impacted because the keys are not generated on Android phone

All Android wallet apps vulnerable need to change keys, it is possible “generating a new address with a repaired random number generator and then sending all the money in your wallet back to yourself”.

Principal Android wallet apps are in the process of updating to fix the bug:

• Bitcoin Wallet: Update has been prepared and is in beta testing now. Learn more.
• BitcoinSpinner: Update is being prepared.
• Mycelium Wallet: Update v0.6.5 can be installed from Google Play or mycelium.com.
• blockchain.info: Update is being prepared.