@cadenjara Your waiting in line at Starbucks… your still in the system. Buy an espresso machine, recreate your own version of what you like there, and quit being a slave to overpriced crap coffee
Issue Update 07-12-2023 20:06 GTM-3
After conducting a thorough investigation, we have determined that all the wallets that were impacted by suspicious activity on July 12th were affected by an already known exploit caused by low entropy mnemonic, like the one reported by TrustWallet explorer extension in April 2023. This algorithm, known as Random Generation used by Bip39 implementation, was previously used by numerous cryptocurrency wallet providers. The flaw in the algorithm compromised the security and unpredictability of the generated keys, potentially making them susceptible to unauthorized access or malicious activities. It is important to address this issue promptly and take necessary measures to ensure the security of your wallets and funds.
How wallets are created
Entropy generation is a complex concept that challenges scientists' preference for reproducibility and the ability to explain phenomena through cause-and-effect principles. In general, it is difficult to intentionally generate randomness. Additionally, verifying the correctness of random numbers is a challenging task, as even a flawed random number generator can deceive an observer without being completely unreliable.
To achieve good randomness, certain characteristics are necessary. Firstly, there should be a uniform distribution of bits and bytes, as well as consistency in the size of all data chunks. This ensures that each possible outcome has an equal chance of occurring. Secondly, unpredictability is crucial. An observer should be unable to gather any information about the next part of the sequence to be generated, making it impossible to predict or anticipate the sequence.
In summary, generating true randomness is a challenging endeavor, requiring uniformity, unpredictability, and the absence of any observable patterns or dependencies in the generated sequence.
The Hierarchical Deterministic (HD) scheme has gained widespread adoption due to its convenience in key management and portability. Users can easily create backups of an extensive number of keys, thanks to the hierarchical structure, and carry them wherever they go.
One of the notable advantages of the HD scheme is signer roaming. This feature allows users to switch to another wallet seamlessly if their preferred wallet fails or fails to meet their expectations. By simply taking their mnemonic (a seed phrase used to derive keys) with them, users can retain control over their funds, maintain financial freedom, and mitigate the impact of any wallet downtime or issues.
However, it's important to emphasize that flawless entropy generation is a crucial requirement for the HD scheme. Entropy refers to the measure of randomness or unpredictability. In the context of HD schemes, a flawless entropy source is essential for generating secure and unpredictable keys. If the entropy source is flawed or compromised in any way, it can weaken the security of the keys and expose them to potential vulnerabilities.
In summary, the HD scheme offers users the ability to easily manage and back up numerous keys, as well as the flexibility to switch between wallets through signer roaming. However, it is crucial to ensure a flawless entropy source to maintain the security and integrity of the scheme.
Issue Overview
In the incident mentioned, all the wallets involved were imported into Klever Wallet K5. These wallets had not been originally created using Klever Wallet K5, instead all the wallets were created using an old and weak pseudorandom number generator (PRNG) algorithm as their entropy source. This algorithm was commonly used in early versions of various cryptocurrency wallet providers, which relied on the Javascript platform. The use of such a weak PRNG algorithm can significantly compromise the security and unpredictability of the generated keys, potentially making them more vulnerable to attacks or unauthorized access.
On the Klever platform, the core codes responsible for entropy and mnemonic generation that utilize the PRNG algorithm are implemented with robust security measures and are native to the operating system. Specifically, for iOS devices, the SecRandomCopyBytes function is utilized to provide entropy. On Android, the entropy is sourced from an instance of the https://t.co/pn2uxxsACT.SecureRandom class. These mechanisms ensure that the generation of entropy and mnemonics on Klever is conducted in a secure manner, leveraging the built-in security features of the respective operating systems.
Additionally, KleverSafe, a specific component of Klever, employs a true Random Number Generator (RNG) that utilizes physical phenomena to generate entropy. This true RNG is designed to provide a reliable and highly secure source of randomness. The implementation of KleverSafe involves an analog entropy source, which is processed by a high-quality conditioning stage. This includes an analog noise source, a digitization stage with post-processing, a conditioning algorithm, a health monitoring block, and two interfaces for interaction with the entropy source.
The combination of these features and processes ensures that the random numbers generated by KleverSafe are not only secure but also resistant to brute-force attacks or attempts at key guessing. By utilizing physical phenomena and employing rigorous conditioning and monitoring stages, KleverSafe provides a robust and trustworthy source of randomness for cryptographic operations within the Klever ecosystem.
Action Required
Therefore, we highly recommend that if you currently possess any old wallets that were created before Klever Wallet, it is crucial to promptly migrate to new wallets created on Klever Wallet K5 or Klever Safe. By migrating to these newer wallet solutions, you can ensure that you benefit from the enhanced security measures and improved entropy generation implemented in Klever. This proactive step will help safeguard your funds and protect them from potential vulnerabilities associated with outdated or weak pseudorandom number generator algorithms. Migrating to the latest wallet offerings provided by Klever will provide you with a more secure and reliable environment for managing your cryptocurrencies.
If you encounter any anomalies, please report them to our support team immediately at https://t.co/p6MhogqxQU. We have expanded our support staffing to promptly address any user concerns during this time.
We understand the concern and inconvenience this situation may cause and want to assure all our users that we are doing everything within our power to address this issue swiftly and securely.
Going forward, we will keep our users informed about the ongoing situation. We are committed to maintaining open lines of communication as we navigate through this incident together.
Thank you for your patience and understanding during this time. Rest assured that Klever remains dedicated to providing a secure platform and an optimal user experience for all.
@yungNleveraged Got to love spindrift, I can say I will never crave a soda again after those. Beautiful thing is they have two-4 actual ingredients that aren’t hiding behind natural flavors or some other thing.