On Wednesday, Android Security Engineer Alex Klyubin confirmed the existence of an Android vulnerability that could be exploited by a malicious user to empty Bitcoin wallets (applications that store your personal Bitcoins ). The security issue was reported in the SecureRandom service .
"We discovered that applications that use the Java Cryptography Architecture (JCA) to create a digital signature do not produce cryptographically strong values on Android devices, which is due to a poor initialization of the underlying PRNG," Klyubin said.
Google, realizing the importance of the Android security flaw, immediately deployed a patch to ensure that the OpenSSL PRNG would work properly. It also notified all developers using JCA to create digital signatures on how to address the issue.
According to Symantec, over 360,000 Android apps use the SecureRandom service. 320,000 of them use the SecureRandom service in the same way.
The vulnerability has of course already been exploited and at least 55.82152538 Bitcoins have disappeared from their owners' wallets.
