A Canadian programmer has published what he claims is a vulnerability in Coinbase's Android apps, one that could allow an attacker to gain full access to a user's account.
Software Engineer Bryan Stern went so far as to caution users not to use the Coinbase Bitcoin Wallet and Merchant apps for Android until the problem is fixed, and advised them to check their accounts for suspicious activity.
However, the company has since responded to Stern in a reddit thread stating that the vulnerabilities were not as serious as Stern claims.
, who works on Android development at Hootsuite, said he'd brought the issue to Coinbase's attention via their 'white hat' bug bounty program in early March, but there had been a disagreement over the seriousness of the issue.
Upon finding his issue present in the latest version of the app, he decided to release the information publicly on 27th June in the hope that prompt action would be taken.
The issue at hand
A lower level of security in the Android apps could allow eavesdroppers to launch a 'man in the middle' (MITM) attack against users, Stern said. He wrote in his report:
Thanks to this, an attacker could present a 'spoofed' SSL certificate (anything with a valid signature but from a different signing authority to the one Coinbase uses) and intercept communications.
The client_id and client_secret items, part of the application's API that should be secret, are in clear view in Coinbase's source code published on GitHub, Stern continued. These would then be revealed during a user's authentication process and provide a hacker with the all-important access_token.
With an attack established, plus this stolen token, a malicious hacker could make API requests at a later time on the user's behalf – essentially taking full control over their account.
Stern recommended Coinbase change client_id and client_secret and keep them confidential in future. He also recommended all apps validate SSL connections properly, and that they make use of the Coinbase API's improved authentication process and stop using the deprecated one.
said the threat was a minor one only, and an attack could only be performed successfully under a specific, but unlikely, set of circumstances.
Client_id and client_secret were intended to be public and not defenses against hack attacks, a company representative said, and while SSL Pinning might help against some attacks, it was not a defense against all malware or local modification of certificates.
Bug bounty program
After having his claims initially rejected by Coinbase on 14th March, Stern then wrote a draft blog post warning the public about the issue and sent it to the company in April.
This too was rejected, so he opened a report on HackerOne, a site where ethical hackers dissatisfied with existing bounty programs can disclose vulnerabilities privately.
Coinbase paid Stern $100 but said it would not be fixing the issue, leading HackerOne to make the report public. When he found the issue still not fixed in the latest version (2.2) of Coinbase's apps, Stern decided to publish the report on his blog.
Coinbase's bug bounty program pays a minimum $1,000 in bitcoin to anyone who can find a valid security hole in its code, but the company "reserves the right to decide if the minimum severity threshold is met".
CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk offers all employees above a certain salary threshold, including journalists, stock options in Bullish Group as part of their compensation.