Main discussion about vulnerability

[randomchoice2]

Hi, sorry for not opening discussion in here for the first time

This is for discussing about the vulnerability

[randomchoice2]

More about mwc1616, I found blog-post about how to predict Math.random(): https://ifsec.blogspot.com/2012/05/cross-domain-mathrandom-prediction.html

[randomchoice2]

Btw, I am in the process of building a lab and testing the old Math.random() if it actually is working (Windows 7 VM)

[RandstormBTC]

I got this working to predict all the next values of Math.random https://github.com/PwnFunction/v8-randomness-predictor/tree/main

[randomchoice2]

I also saw that one, but what I'm concerning is that V8 changed it's algo in 2016 from mvc1616 to xorshift128+. You can check it out by searching it on Google. I am testing one js algo that tries to replicate mwc1616, it's not fully working, it was able to find the first case, but the next generated values are not correct. Will upload the screenshot later.

[randomchoice2]

Also, there will be hell of a problem due to different browsers implemented different kind of algos before 2016. That means we have to specifically target one browser first to try it out, then move on to others. In 2012-2013 timeline IE was declining rapidly but it was being used the most after Chrome.

[randomchoice2]

Btw, haven't u checked Brainwallet's code out, they were using that vulnerable version but I'm not sure how were they using it

[RandstormBTC]

I looked at Brainwallet's code. Even the really old versions gathered entropy from mouse movements when you load the page.

I found many projects from 2010 - 2014 like this that generate the paper wallet using the math.random implementation

https://github.com/CryptoStories/storiespaperwallet/blob/master/generate-wallet.html

Although new versions use this for additional entropy:

	sr.seedInt(window.screenX);
	sr.seedInt(window.screenY); 

There are other ways to predict Math.Random values based on different browsers. Even if you could predict every future and past value, I am still not sure how to take the this.seedTime() and figure out the BTC public / private key. Then you have to take the output from math.random and use seedTime(), in this case 1294200190000 for example and run it through the Arcfour PRNG. If the same seedTime() is used the PRNG always returns the same value. But the Math.Random values are usually always different.

[demonluca]

Hi Karl thanks for the ongoing support into this project lots of positive advances have been made. I’ve created a randstorm group on telegram if you and anyone else involved in the this project wants to join. I think we can share information and have discussions more easily on there.

[RandstormBTC]

Sure we could use all the people we could get.

I added some debugging output to the function to get a better idea what's happening:

https://github.com/RandstormBTC/randstorm/blob/main/debug.txt

[randomchoice2]

Karl hope u are also in group chat. I will help too as much I as I can. Hope we can figure that one together

[demonluca]

If anyone wants to join

[RandstormBTC]

I have been playing around with this and it's working very well:

https://github.com/d0nutptr/v8_rand_buster/tree/master

With about 20 inputs it can find all future values of the 16-bit integers generated in Math.random

[randomchoice2]

bro it would be great if you join us on telegram...

[demonluca]

Hi Karl are you still working on this project?