Joe & Bruno Hack Time: Regenerate Passwords from RoboForm's Password Generator
Reverse engineers vintage RoboForm password generator routines to exploit weak PRNG randomness and recover millions in locked Bitcoin wallets.
Summary
Recovering Locked Cryptocurrency Wallets
Security researchers Joe Grand and Bruno Krauss investigated recovering over three million dollars in Bitcoin trapped in an encrypted software wallet protected by a forgotten password.
Reverse Engineering RoboForm PRNG
Reverse engineering legacy versions of the RoboForm password manager using Ghidra, Cheat Engine, and x64dbg uncovered predictable pseudorandom number generator (PRNG) seeding.
Reconstructing Past Password States
Because the password generator tied its PRNG seed to the exact system clock timestamp, researchers built a custom tool to generate all possible password permutations within a target time window.
Responsible Disclosure and Password Security
While the flaw was fixed in subsequent RoboForm releases, the research highlights the enduring risks of weak entropy in cryptographic password generation.
Related talks
Main Stage·53 min
atlas
Security researcher atlas demonstrates partial CPU emulation with Unicorn Engine, bypassing tedious static assembly analysis to rapidly discover vulnerabilities.
Black Hat Europe 2025·38 min
Thomas Mogensen · Diego De Freitas Aranha
Presenters detail vulnerability discovery and exploitation in LINE-Break: Cryptanalysis And Reverse Engineering Of Letter Sealing.
DragonJAR - Hacking y Seguridad Informática·4 min
Evaluates ransomware Rap and evaluates key implications for security practitioners.