How to find the private key of any Etherum account ?
In this article, we will review all the means a hacker have, to hack your private account with all your ETH.
▶ How key works ?
What is an Etherum private key?
Step 1: To be simple this is a random number between 0 and 2²⁵⁶ (in fact this is a bit less than 2²⁵⁶, but that doesn’t matter.) and nothing more.
so:
- 1 is a private Etherum key
- 2 is a private Ethereum key
- and the same for 3,4,10,10000,99999,1011091910190…
To verify that can try to import: 0000000000000000000000000000000000000000000000000000000000000001 on metamask. (The format should be a hex number coded in 64 hex numbers.)
Step 2. With this private key, a public key is determined. (by using elliptic curve multiplication)
Step 3. a hash is derived from the public key, the 40 first hex digits is the public address.
For example, the public address of 0000….001 (the private key you’ve imported) is 0x7E5F4552091A69125d5DfCb7b8C2659029395Bdf.
The goal of a hacker will be to get the private key by using all strategies he can.
▶ Too simple private key…
As said before, you can easily choose your private key, this is just a random number. You just need to hit the import button on metamask.
OK i like the number 7, so I will choose 00000….000007 as my private key. As a result, i won’t need to remember my 12 word. What a genius idea!!!
But you’re not the only one which has the same idea…
There are several thousands of bots, which continuously monitor these “easy to guess” private keys in order to steal funds if someone sends ETH to them.
As you can see in the image, every time, some ETH were send tho this address, a bot is instantly withdrawing the money.
▶ Too Simple seed Words…
Do you know what is an HD wallet ?
HD stands for hierarchical deterministic wallet.
- You create a random number (the master key), and you derive all addresses from the master key by a series of hashing only by using this random number.
- So every time you use this random number to derive new addresses, you get the sames one every time.
This is how metamask work, you can test by writing down your words (if you’re never done that), deleting your metamask account and entering your words again.
You should see all the same accounts as before in the same order.
To help you remember the master key, it’s possible to convert these 132 bits of entropy, into 12 groups of 11 bits.
And each groups of bits can be represented by a word in English.
But some people got the genius idea to choose “easy to guess” seed words like:
- test test test test test test test test test test test test
- one two three one two three one two three one two three
- you see the pattern…
Here is the full list of possible Ethereum seed words: https://github.com/bitcoin/bips/blob/master/bip-0039/english.txt
As for a private key, there is a big number of bots which are constantly monitoring the network in order to guesses these kinds of passphrases…
▶ Weak parameters/Nounce reuse
To sign a transaction, you need:
- A private key (d)
- Your message hash (h)
- A nonce which need to be different between signatures (k)
The (r,s) signature can be calculated as follows:
- R = G*k (G is a constant number used for all signatures)
- S = (h + d*r)/k
Note: the * is the multiplication in the Elliptic curve field.
If the same nonce (the number k) is reused between 2 signatures of the same private key, the R number will be the same.
And most importantly, given TWO signatures A = (r,s) and B = (r,s’) reusing the same k (so the r is the same), you can recompute the full private key.
Some wallets, have this vulnerability and as a result a lot of Ethers were stolen.
Capture the Ether made a CTF if you want to put this vulnerability in practice: https://capturetheether.com/challenges/accounts/account-takeover/
▶ Extract the private Key
In metamask you can extract the private key which was used for generating the public key address. (and so for signing transactions)
Go to metamask > menu > account details, and click on “export private key”
▶ Using a too old metamask version.
Before the version of 10.11.3 metamask, you may have be exposed to vulnerabilities, if some conditions are met metamask could be hacked. So if your version is too old, you need to upgrade your wallet…
▶ Storing private key in plain text
Let’s say you have an hardhat project, and you store all the information about you address in the hardhat config file. (hardhat.config.js)
When you upload your code to github, the private key is still here and may be disclosed to rest of the world.
As for generating random private key/seed phrases there is boot too which are monitoring github accounts to steal you ETH.
▶ Brute force attack?
If all the previous ways failed, you can still brute force by choosing random private keys (random numbers), derive the public key and hash the public key to get the address.
But how unlikely is to find a secret key containing some funds?
There are about 50 000 000 accounts with ETH in them (let’s say 10⁸)
An Ethereum address is 40 hex number of length, this means that there is 16⁴⁰ of possible address.
So by dividing the number of possible addresses and the addresses containing money, you get 16⁴⁰ / 10⁸ = 10⁴⁵.
Each time you generate an address there is 1/10⁴⁵ chance to get something, this is largely enough to say that event by creating 1 billion address per second (or more) the probability to find something interesting is negligible.
That guarantees you (even by using the anniversary attack) that if you create a random number (between 1 and 2²⁵⁶) which is your private key.
You won’t get the same Ethereum address that another one who generated.
However, you can still try to generate random keys here : https://keys.lol/ethereum/
▶ Conclusion
There is still a lot of ways for hackers to steel your keys but they are to specific to each people, like installing a keylogger/malware or using phishing.
➕ Want to learn More about Ethereum ?
▶▶▶ Follow me on twitter: https://twitter.com/TrustChain_DEFI or in medium.
