magoo / blockchain-graveyard Goto Github PK

https://www.reddit.com/r/Bitcoin/comments/37oxow/the_security_issue_of_blockchaininfos_android/crolfk4

tl;dr: Their Android app tried using /dev/urandom. If that wasn't available, they'd fall back to getting a seed from the website http://random.org (!) via HTTP (!!). At some point the website started redirecting to HTTPS and the app didn't check the status code (!!!), so the random seed was based on the (always equal) redirect message and generated a private key for 1Bn9ReEocMG1WEW1qYjuDrdFzEFFDCq43F.

This resulted in "only" ~45 BTC of affected users being lost, but I think it's very interesting nonetheless.

I'd like to know shifts in attack trends of defense deficiencies over time. At least on a 1 year granularity. It looks like incidents back to 2011 are catalogued. Splitting them up into year by year groupings would be helpful.

https://peckshield-94632.medium.com/the-spartan-incident-root-cause-analysis-b14135d3415f

This would at least add the dao fomo3d and both parity multisig hacks.

May we input this information

Would be easier to contribute to project

https://cointelegraph.com/news/rari-capital-falls-victim-to-11-million-exploit

The latest entry for the Bithumb hack is listed as "Coinrail". See diff:

fe5a24a#diff-38f2e8283acec2e9642813ccc8ebe946

(I'd submit a pull request myself, but I am not up to speed on how to do that. If there is handy guide anywhere, let me know.)

1. It is extremely difficult to read the website, the quoted text is in very similar color to the background.
2. You can polish a shoe but if you talk about nationality or language it is Polish, not polish (see entry about Bitcurex).