Concern mounts as Google confirms Android cryptographic vulnerability - The Guardian

Google has confirmed reports of a weakness in Android's Java Cryptography Architecture (JCA) that has left bitcoin wallets generated on Android devices vulnerable to theft.

The issue came to light last weekend, with reports that around $5,700 worth of the bitcoin cryptocurrency had been stolen as a result of the vulnerability on Android.

"We have now determined that applications which use the Java Cryptography Architecture (JCA) for key generation, signing, or random number generation may not receive cryptographically strong values on Android devices due to improper initialization of the underlying PRNG," explained Android security engineer Alex Klyubin in a post on Google's Android developers blog.

"Applications that directly invoke the system-provided OpenSSL PRNG without explicit initialization on Android are also affected."

The Bitcoin Foundation, which oversees the bitcoin economy, warned developers of Android wallet apps to update them over the weekend, while also encouraging users to update their apps when possible, or transfer their bitcoins to more secure wallets on their computers when not.

"We recently learned that a component of Android responsible for generating secure random numbers contains critical weaknesses, that render all Android wallets generated to date vulnerable to theft," explained the Foundation's blog post.

"Because the problem lies with Android itself, this problem will affect you if you have a wallet generated by any Android app."

Google's Klyubin has published instructions for developers on one way to update their applications to fix the vulnerability, and announced that Google's Android team have developed patches to "ensure that Android's OpenSSL PRNG is initialized correctly" and provided these to handset partners.

Earlier in the day, security firm Symantec claimed that hundreds of thousands of Android apps – not just bitcoin wallets but games, productivity, music and other categories of apps – may be affected by the vulnerability in Android's SecureRandom component for generating secure random numbers.

Symantec's chart showing the breakdown of Android apps potentially affected by the SecureRandom vulnerability

"Looking at Norton Mobile Insight data, we have found over 360,000 applications that make use of SecureRandom and over 320,000 of them use SecureRandom in the same way the bitcoin wallets did," explained a post on Symantec's blog.

"We strongly advise users of Android bitcoin wallet apps to check whether their applications are affected and to follow the steps outlined by bitcoin.org to make their funds safe."

According to the Bitcoin Foundation, the total value of all bitcoins in circulation is more than $1.3bn, with its website boasting that there has been "only one major security incident in the protocol which was fixed in August 2010".

Bitcoin-sceptics are likely to point to this week's events as a further reason to be cautious about bitcoin as a currency, but supporters are more likely to focus on the speed with which the vulnerability was identified and addressed.