A Canadian programmer has published what he claims is a vulnerability in Coinbase's Android apps, one that could allow an attacker to gain full access to a user's account.
Software Engineer Bryan Stern went so far as to caution users not to use the Coinbase Bitcoin Wallet and Merchant apps for Android until the problem is fixed, and advised them to check their accounts for suspicious activity.
However, the company has since responded to Stern in a reddit thread stating that the vulnerabilities were not as serious as Stern claims.
, who works on Android development at Hootsuite, said he'd brought the issue to Coinbase's attention via their 'white hat' bug bounty program in early March, but there had been a disagreement over the seriousness of the issue.
Upon finding his issue present in the latest version of the app, he decided to release the information publicly on 27th June in the hope that prompt action would be taken.
The issue at hand
A lower level of security in the Android apps could allow eavesdroppers to launch a 'man in the middle' (MITM) attack against users, Stern said. He wrote in his report:
Thanks to this, an attacker could present a 'spoofed' SSL certificate (anything with a valid signature but from a different signing authority to the one Coinbase uses) and intercept communications.
The client_id and client_secret items, part of the application's API that should be secret, are in clear view in Coinbase's source code published on GitHub, Stern continued. These would then be revealed during a user's authentication process and provide a hacker with the all-important access_token.
With an attack established, plus this stolen token, a malicious hacker could make API requests at a later time on the user's behalf – essentially taking full control over their account.
Stern recommended Coinbase change client_id and client_secret and keep them confidential in future. He also recommended all apps validate SSL connections properly, and that they make use of the Coinbase API's improved authentication process and stop using the deprecated one.
said the threat was a minor one only, and an attack could only be performed successfully under a specific, but unlikely, set of circumstances.
Client_id and client_secret were intended to be public and not defenses against hack attacks, a company representative said, and while SSL Pinning might help against some attacks, it was not a defense against all malware or local modification of certificates.
Bug bounty program
After having his claims initially rejected by Coinbase on 14th March, Stern then wrote a draft blog post warning the public about the issue and sent it to the company in April.
This too was rejected, so he opened a report on HackerOne, a site where ethical hackers dissatisfied with existing bounty programs can disclose vulnerabilities privately.
Coinbase paid Stern $100 but said it would not be fixing the issue, leading HackerOne to make the report public. When he found the issue still not fixed in the latest version (2.2) of Coinbase's apps, Stern decided to publish the report on his blog.
Coinbase's bug bounty program pays a minimum $1,000 in bitcoin to anyone who can find a valid security hole in its code, but the company "reserves the right to decide if the minimum severity threshold is met".
The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.