{
  "url": "https://fahrplan.events.ccc.de/congress/2024/fahrplan/talk/PEN9QU/",
  "id": 527,
  "guid": "76ee194a-c269-50e0-b616-04f38fa329cb",
  "date": "2024-12-30T11:00:00+01:00",
  "start": "11:00",
  "logo": null,
  "duration": "00:40",
  "room": "Saal GLITCH",
  "slug": "38c3-527-dude-where-s-my-crypto-real-world-impact-of-weak-cryptocurrency-keys",
  "title": "Dude, Where's My Crypto? - Real World Impact of Weak Cryptocurrency Keys",
  "subtitle": "",
  "track": "Security",
  "type": "Talk",
  "language": "en",
  "abstract": "We present Milksad, our research on a class of vulnerabilities that exposed over a billion dollars worth of cryptocurrency to anyone willing to 'crunch the numbers'.\r\nThe fatal flaw? Not enough chaos.\r\nLearn how we found and disclosed issues in affected open source wallet software, brute-forced thousands of individual affected wallets on a budget, and traced over a billion US dollars worth of prior transactions through them.",
  "description": "In July 2023, people in our circle of friends noticed a series of seemingly impossible cryptocurrency thefts, which added up to over one million US dollars. \r\nA common denominator was discovered across the set of victims we knew: the wallet software `libbitcoin-explorer`. Vulnerable versions used a weak pseudorandom number generator when creating cryptocurrency wallets. Within a short period of time, we disclosed the vulnerability, [CVE-2023-39910](https://milksad.info/disclosure.html). \r\nUsing this weakness, attackers were able to compute private keys of victims, which is supposed to be impossible under normal circumstances.\r\n\r\nIn this talk we \r\n* \ud83d\udcdc - tell the story of uncovering a digital currency heist\r\n* \ud83c\udf10 - dive into similar vulnerabilities\r\n* \ud83d\udd0d - trace the movement of coins\r\n* \u2696 - outline ethical challenges of cryptocurrency security research\r\n* \ud83d\udee1 - explore methods to defend and protect against this bug class\r\n\r\nOur intention is to share the story of how little details can have big consequences and the importance of quality chaos.",
  "recording_license": "",
  "do_not_record": false,
  "persons": [
    {
      "guid": "84eedbb8-c286-5534-b772-ae7c938276e8",
      "id": 361,
      "code": "9PCECD",
      "public_name": "John Naulty",
      "avatar": "https://fahrplan.events.ccc.de/congress/2024/fahrplan/media/avatars/il-postino_u8OTvGo.jpeg",
      "biography": "- Grew up with big trees, waves, and creatures along the Mendocino Coast\r\n- Fell in love with the magic of open source medical hardware + software in university and helped establish [NeuroTechX](https://neurotechx.com/)\r\n- Drawn to \u2018safety + security\u2019 work of all kinds\r\n- Discovered open source money systems and dove into the cryptocurrency security field\r\n- Worked at some of the larger cryptocurrency institutions in the industry\r\n- Distrusts Software Supply Chains as much as residents of Flint, Michigan distrust water supply chains\r\n- Sometimes helps distribute security tokens to the people [great-mfa-project](https://github.com/ossf/great-mfa-project) [36c3 -- Session: Yubikey 101](https://events.ccc.de/congress/2019/wiki/index.php/Session:Yubikey_101)\r\n- Enjoy environments where \u201cAll Creatures are Welcome\u201d\r\n- Somehow affiliated with the [Church of Cryptography](https://matrix.to/#/#churchofcrypto:matrix.org)\r\n- Typically hanging out with friends who provide free shell services for the curious [hashbang.sh](https://hashbang.sh/#!)",
      "answers": []
    }
  ],
  "links": [],
  "attachments": []
}