The End of the Closed-Source Era Is at Hand: Obscurity Was Never Security
A recent hack of the Coldcard hardware signer has exposed the vulnerability of closed-source software. The attack, which has resulted in the theft of nearly $90 million in Bitcoin, highlights the limitations of relying on obscurity for security. As AI-assisted audits beco…
Intelligence analysis by Llama
The recent hack of the Coldcard hardware signer has exposed the vulnerability of closed-source software. The attack, which has resulted in the theft of nearly $90 million in Bitcoin, highlights the limitations of relying on obscurity for security. As AI-assisted audits become more common, the era of closed-source software is coming to an end.
Imagine you have a special box that can keep your secrets safe. But what if someone could open the box and see all your secrets inside? That's what happened with the Coldcard hack. The hackers used a special tool to read the code and find a weakness. Now, people are worried that this could happen to other companies too. They're thinking about making their code more open and transparent so that it's harder for hackers to find weaknesses.
Analysis
The Coldcard Hack: A Preview of the End of Closed-Source Software
The recent hack of the Coldcard hardware signer has exposed the vulnerability of closed-source software. The attack, which has resulted in the theft of nearly $90 million in Bitcoin, highlights the limitations of relying on obscurity for security. As AI-assisted audits become more common, the era of closed-source software is coming to an end.
The Coldcard hack is a preview of what is to come. The attack was made possible by a preprocessor guard that checked the wrong thing, allowing an attacker to use a weak software PRNG instead of the hardware entropy source. This flaw was shipped in March 2021 and sat in publicly readable firmware for more than five years. Attackers swept 500 addresses before anyone understood why; within days Galaxy Research's tally reached 4,585 addresses and nearly $90 million; the attack is ongoing as of the date of this article.
Coinkite's working assumption, with wide agreement on X, is that someone used AI to comb the publicly available firmware to find the bug. Whether or not that's how this attacker found it, the next one will. While an AI-assisted audit was run weeks before the theft, it found nothing (potentially due to the capabilities of the model, potentially due to the specific construction of the search). Since the attack started, researchers have shown several frontier models locating the same flaw in minutes from a single prompt.
The End of Obscurity as Security
The Coldcard hack is not an isolated incident. It is a symptom of a larger problem: the limitations of relying on obscurity for security. In the age of highly skilled AI, everything that is distributed is readable, or soon will be. Strip a binary of its symbols, run it through a decompiler, and out comes the pseudo-C that greets anyone who has opened Ghidra: nameless variables, flattened control flow, functions labeled FUN_00401a20. Unreadable to most people. That high barrier to human understanding was the entire security premium of 'closed source.'
A compiled program has no choice but to tell the truth. Code that stays encrypted cannot run. At the moment of execution the processor must receive the actual instructions, so whatever the program does, it hands the machine a complete and exact account of how to do it. The information is all there in the machine code. Obfuscation does not, and cannot, remove it.
The Future of Security
The future of security is not in obscurity, but in transparency. As AI-assisted audits become more common, companies that rely on closed-source software may find themselves vulnerable to attacks. This highlights the need for companies to adopt more secure practices, such as open-source software development. By making their code transparent, companies can ensure that their software is secure and reliable.
In conclusion, the hack of the Coldcard hardware signer has significant implications for the security of closed-source software. As AI-assisted audits become more common, companies that rely on closed-source software may find themselves vulnerable to attacks. This highlights the need for companies to adopt more secure practices, such as open-source software development.
Key points
- The Coldcard hack has exposed the vulnerability of closed-source software.
- The attack was made possible by a preprocessor guard that checked the wrong thing.
- The flaw was shipped in March 2021 and sat in publicly readable firmware for more than five years.
- Attackers swept 500 addresses before anyone understood why.
- The attack is ongoing as of the date of this article.
- Coinkite's working assumption is that someone used AI to comb the publicly available firmware to find the bug.
- The next one will find it too.
- The era of closed-source software is coming to an end.
The use of AI-assisted audits and open-source software development could lead to a significant increase in the security of software. By making their code transparent, companies can ensure that their software is secure and reliable. This could lead to a decrease in the number of successful hacks and a increase in trust in the software industry.
The use of AI-assisted audits and open-source software development may not be enough to prevent all hacks. Some companies may still choose to use closed-source software, which could leave them vulnerable to attacks. Additionally, the use of AI-assisted audits may not be foolproof, and some weaknesses may still be missed.
