WalletGenerator.net, an online crypto paper wallet former earlier ran on code which caused private key/public key pairs to be issued on multiple users. The latest vulnerability was explained in detail in a blog post by Security Researcher Harry Denley from MyCrypto.Com on May 24.
The core of the analysis links on WalletGenerator's original open-source code, which is available here. Till August 17, 2018, the online source code and the entire project generated wallets with the help of a client-side technique which made it real random entropy and produced a unique wallet. However, after some time of that date, the two sets of code stopped matching.
As per the blog post, the malicious code was present since August 2018 and was recently updated on May 23. The live code on the website is reportedly assumed to be open source and audited on GitHub, however, there were some differences between the two. On researching the live code, Denley found that the keys were certainly produced on the live version of the website, not randomly.
In one of the MyCrypto's tweets between May 18-23, they have tried to use the website's bulk generator in order to produce 1,000 keys. The GitHub version generated 1,000 keys, while the live version also returned 120 keys. Running a bulk generator only returned 120 keys instead of 1,000 keys even if they have change different factors such as refreshing the browser, changing VPN locations or changing users.
Randomness is required to produce the key pairings in a way that paper wallets remain secure. According to the blog post,
“ELI5: When generating a key, you take a super-random number, turn it into the private key, and turn that into the public key/address. However, if the ‘super-random' number is always ‘5,’ the private key that is generated will always be the same. This is why it’s so important that the super-
random number is actually random…not ‘5.’”
The official blog post states that code has been updated and the "malicious behavior" is not recently found as of May 24, but it may return anytime soon.
WalletGenerator solved the inevitable problem after MyCrypto reached out during the middle of its investigation. WalletGenerator later replied by saying that charges could not be verified and also asked the reporter if Crypto is a “phishing website.”
My Crypto said that all the users who have generated keypairs after August 17, 2018, should instantly transfer their funds to another wallet and recommended not to use WalletGenerator.net.
