CVE-2023-39910
📋 TL;DR
This vulnerability allows attackers to recover private keys from cryptocurrency wallets generated using Libbitcoin Explorer's 'bx seed' command due to weak entropy seeding. Anyone who used 'bx seed' in affected versions to generate wallet seeds is at risk of having their funds stolen. The vulnerability was actively exploited in mid-2023.
💻 Affected Systems
- Libbitcoin Explorer
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete loss of all cryptocurrency funds from wallets generated with vulnerable 'bx seed' command, with irreversible theft of assets.
Likely Case
Targeted attackers scanning for vulnerable wallet addresses and draining funds, as demonstrated by the Milk Sad exploitation campaign.
If Mitigated
No impact if users never used 'bx seed' command or have already migrated funds to secure wallets.
🎯 Exploit Status
Exploited in the wild in June-July 2023 (Milk Sad campaign). Attackers can brute-force the limited 32-bit entropy space to recover private keys without any authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 3.6.0
Vendor Advisory: https://github.com/libbitcoin/libbitcoin-explorer/wiki/CVE-2023-39910
Restart Required: No
Instructions:
1. Update Libbitcoin Explorer to version 3.6.1 or later. 2. Do not use 'bx seed' command for wallet generation. 3. Use secure entropy sources like hardware wallets or properly seeded CSPRNG.
🔧 Temporary Workarounds
Stop using bx seed
allImmediately cease using the 'bx seed' command for any wallet generation
Use alternative entropy sources
allGenerate wallet seeds using cryptographically secure methods like hardware wallets or OS-provided secure random
🧯 If You Can't Patch
- Immediately move all funds from wallets generated with 'bx seed' to new wallets created with secure entropy sources
- Audit all cryptocurrency wallets to identify any generated with vulnerable versions and migrate funds
🔍 How to Verify
Check if Vulnerable:
Check if you ever used 'bx seed' command with Libbitcoin Explorer versions 3.0.0-3.6.0 to generate wallet seedsCheck Version:
bx --versionVerify Fix Applied:
Update to version 3.6.1+ and verify you are using secure entropy sources for wallet generation📡 Detection & Monitoring
Log Indicators:
- Unusual 'bx seed' command usage patterns
- Multiple failed wallet access attempts
Network Indicators:
- Unexpected cryptocurrency transactions from wallets
- Connections to known exploit infrastructure
SIEM Query:
Search for process execution of 'bx seed' command or related Libbitcoin Explorer activities🔗 References
- https://github.com/libbitcoin/libbitcoin-explorer/blob/20eba4db9a8a3476949d6fd08a589abda7fde3e3/src/commands/seed.cpp#L44
- https://github.com/libbitcoin/libbitcoin-explorer/blob/20eba4db9a8a3476949d6fd08a589abda7fde3e3/src/utility.cpp#L78
- https://github.com/libbitcoin/libbitcoin-explorer/wiki/CVE-2023-39910
- https://github.com/libbitcoin/libbitcoin-system/blob/a1b777fc51d9c04e0c7a1dec5cc746b82a6afe64/src/crypto/pseudo_random.cpp#L66C12-L78
- https://milksad.info/disclosure.html
- https://news.ycombinator.com/item?id=37054862
- https://github.com/libbitcoin/libbitcoin-explorer/blob/20eba4db9a8a3476949d6fd08a589abda7fde3e3/src/commands/seed.cpp#L44
- https://github.com/libbitcoin/libbitcoin-explorer/blob/20eba4db9a8a3476949d6fd08a589abda7fde3e3/src/utility.cpp#L78
- https://github.com/libbitcoin/libbitcoin-explorer/wiki/CVE-2023-39910
- https://github.com/libbitcoin/libbitcoin-system/blob/a1b777fc51d9c04e0c7a1dec5cc746b82a6afe64/src/crypto/pseudo_random.cpp#L66C12-L78
- https://milksad.info/disclosure.html
- https://news.ycombinator.com/item?id=37054862
