4 ms·

I'm actually shocked that someone used a zero-day Android exploit to steal $5,700 of BTC. Couldn't they have sold it for significantly more on the black market

by gsibble 13y ago

I'm actually shocked that someone used a zero-day Android exploit to steal $5,700 of BTC. Couldn't they have sold it for significantly more on the black market?

e12e 13y ago
We don't really know that. The other obvious implication would be that we now might need new/expanded openssl/ssh key blacklists, for keys generated on Android devices.
cstavish 13y ago
It's possible that the exploit was used previously and the incident went unreported.
- gsibble 13y ago
  Which is perhaps even more frightening considering many other high security apps use these libraries.
- nwh 13y ago
  Well no, not with Bitcoin at any rate. Every transaction is visible, that's how the attacker knew which funds were stealable.
zorpner 13y ago
It may not have been identified specifically as an Android exploit -- there are people (I used to be one of them, though I wouldn't have used the result to exploit wallets) who constantly run crypto attacks on transactions in the blockchain to identify weak wallet keys. The person who stole the BTC probably automated the attack, left it running against the blockchain, and never even knew what the real vulnerability was.
qnr 13y ago
They didn't use an Android exploit specifically, they simply scanned the blockchain for vulnerable private keys. They probably didn't even know that Android was the culprit - it could be hardware wallet, a buggy homebrew client or whatever.
mike-cardwell 13y ago
I'm more shocked that some people actually trust their phones enough to install bitcoin clients on them.
- kolinko 13y ago
  Well, keeping 1-2 BTC as a personal wallet for real-world transactions makes some sense. As for keeping ~50 BTC - a possible scenario is that the guy/gal bought a specific, cheap Android phone as a "safe" - that is, installed only the blockchain app, and cut off the internet/cellular connection. One would expect the phone being offline and the app being from a trustable source to be secure :)
marshray 13y ago
Alternatively, someone decided it was worth $5700 to learn whether or not this bug was being exploited in the wild.
kirian 13y ago
Yes, $5,700 seems a bargain to uncover a flaw like this. Shows an interesting potential use of bitcoin, can act as a warning system to identify bugs or insecure systems, like a honeypot. If the bitcoins are taken you know there is a weakness somewhere.
dspillett 13y ago
Depends on the attackers attitude to risk: $5,700 worth of BTC might be a lot harder to track than the sale of an exploit. He doesn't have to trust any other human beings (i.e. the person he is selling to at least) not to dob him in at a moment's notice. A safe 5K might be very much preferable to him than a less safe 20+K. (caveat: unless otherwise stated numbers in this post, and many of my others, are plucked from thin air)

by gsibble 13y ago

I'm actually shocked that someone used a zero-day Android exploit to steal $5,700 of BTC. Couldn't they have sold it for significantly more on the black market?

e12e 13y ago

We don't really know that. The other obvious implication would be that we now might need new/expanded openssl/ssh key blacklists, for keys generated on Android devices.

cstavish 13y ago

It's possible that the exploit was used previously and the incident went unreported.

gsibble 13y ago
Which is perhaps even more frightening considering many other high security apps use these libraries.
nwh 13y ago
Well no, not with Bitcoin at any rate. Every transaction is visible, that's how the attacker knew which funds were stealable.

zorpner 13y ago

It may not have been identified specifically as an Android exploit -- there are people (I used to be one of them, though I wouldn't have used the result to exploit wallets) who constantly run crypto attacks on transactions in the blockchain to identify weak wallet keys. The person who stole the BTC probably automated the attack, left it running against the blockchain, and never even knew what the real vulnerability was.

qnr 13y ago

They didn't use an Android exploit specifically, they simply scanned the blockchain for vulnerable private keys. They probably didn't even know that Android was the culprit - it could be hardware wallet, a buggy homebrew client or whatever.

mike-cardwell 13y ago

I'm more shocked that some people actually trust their phones enough to install bitcoin clients on them.

kolinko 13y ago
Well, keeping 1-2 BTC as a personal wallet for real-world transactions makes some sense. As for keeping ~50 BTC - a possible scenario is that the guy/gal bought a specific, cheap Android phone as a "safe" - that is, installed only the blockchain app, and cut off the internet/cellular connection. One would expect the phone being offline and the app being from a trustable source to be secure :)

marshray 13y ago

Alternatively, someone decided it was worth $5700 to learn whether or not this bug was being exploited in the wild.

kirian 13y ago

Yes, $5,700 seems a bargain to uncover a flaw like this. Shows an interesting potential use of bitcoin, can act as a warning system to identify bugs or insecure systems, like a honeypot. If the bitcoins are taken you know there is a weakness somewhere.

dspillett 13y ago

Depends on the attackers attitude to risk: $5,700 worth of BTC might be a lot harder to track than the sale of an exploit. He doesn't have to trust any other human beings (i.e. the person he is selling to at least) not to dob him in at a moment's notice. A safe 5K might be very much preferable to him than a less safe 20+K. (caveat: unless otherwise stated numbers in this post, and many of my others, are plucked from thin air)