Weak Randomness

What Is Weak Randomness?

Weak randomness is minting an unguessable value with a fast, non-cryptographic generator. Statistical uniformity is not unpredictability: the state is small and the transition function deterministic. Math.random() in V8 is xorshift128+, 128 bits of state reconstructable from four observed outputs. You'll collect reset tokens from an account you control, solve for the state, predict the next token, and take over a stranger's savings account without touching their inbox. The fix is one line, crypto.randomBytes(32).toString('hex') , and hashing weak output changes nothing.

What You'll Learn in Weak Randomness

• Distinguish a PRNG (fast, statistically uniform) from a CSPRNG (resistant to state recovery from observed outputs)
• Recognize that hashing the output of a weak PRNG does not make it safe, the hash is deterministic and the input is still predictable
• Apply <code>crypto.randomBytes</code> / <code>crypto.randomUUID</code> (Node), <code>crypto.getRandomValues</code> (Web Crypto), or <code>os.urandom</code> (Python) for every security-sensitive value
• Audit the codebase for adjacent call sites, reset tokens, invite tokens, MFA backup codes, OAuth state, signed-URL nonces, admin password generators all share the same vulnerability when derived from <code>Math.random</code>
• Internalize the rule: a value an attacker would benefit from predicting must come from a cryptographic source by default, every language makes this a one-import choice, so the wrong default has no excuse

Weak Randomness — Training Steps

1. Size up the target

   Bob makes his living getting into other people's accounts and taking the money inside. Today his target is Nestward, a savings app where a single account can hold real balances. He starts on the password-reset page, the front door he plans to walk through, to see how recovery works before he touches it.

2. How recovery works

   One detail on that page is the whole reason Bob is interested.

3. Request a reset for himself

   Bob starts with codes he is allowed to see. He owns the throwaway account bob.reeve@proton.me, so he requests a reset for it and opens the email Nestward sends back. The reset link in that email carries the code, in full.

4. Collect a second code

   One code is not enough to see a pattern, so Bob requests another reset for the same account and reads the second email.

5. One more code

   A third reset gives Bob the three codes his solver needs. He reads the last email and lines the codes up.

6. Predict the next code

   Nestward mints these codes with a fast, non-cryptographic generator that has a small internal state. Bob feeds the three codes he read out of his inbox into a solver that reconstructs that state and runs it forward. The tool prints the exact code the app will put in the very next reset link it sends, for whichever account that reset is for.

7. Trigger the victim's reset

   The predicted code is the next one the generator will issue, so Bob has to make it issue that code now. He requests a reset for a real customer, renata.voss@gmail.com. Nestward mints the next code, drops it into a link, and emails it to Renata, an inbox Bob cannot read.

8. Redeem the predicted code

   Now Bob spends the code he predicted. He sends it straight to the reset endpoint with a new password, and because it matches the code Nestward just mailed to Renata, the server accepts it and sets his password on her account.

9. The account is his

   The endpoint accepted the code and changed the password. Bob is now signed in to a savings account that is not his.

10. Knowledge check

    You just watched an attacker predict a reset code he was never shown. Lock in why that was possible.