Insecure Randomness

What is Insecure Randomness?

Insecure randomness occurs when an application uses a predictable or non-cryptographic random number generator (PRNG) to produce values that must be unpredictable for security, such as session tokens, password reset links, CSRF tokens, encryption keys, or one-time passwords.

Standard PRNGs like Math.random() (JavaScript), java.util.Random, random.random() (Python), and rand() (PHP/C) are designed for speed and statistical distribution, not for security. Their internal state can often be inferred from a small number of observed outputs, allowing an attacker to predict past or future values.

How exploitation works

A password reset token is generated with Math.random():

// 16 hex chars from Math.random() - ~53 bits, observable seed
const token = Math.random().toString(16).substr(2);

An attacker requests multiple password resets, observes the tokens, and uses them to reconstruct the V8 engine’s PRNG state, then predicts future tokens for other accounts. Tools like untwister automate Mersenne Twister state recovery from observed Math.random() outputs.

Vulnerable code examples

JavaScript / Node.js

// VULNERABLE: Math.random() is not cryptographically secure
function generateResetToken() {
    return Math.random().toString(36).substr(2, 16); // Predictable
}

Java

// VULNERABLE: java.util.Random is seeded from system time - predictable
import java.util.Random;

public String generateSessionId() {
    Random rng = new Random(); // Or new Random(System.currentTimeMillis())
    return Long.toHexString(rng.nextLong());
}

PHP

// VULNERABLE: rand() and mt_rand() are not cryptographically secure
$token = bin2hex(pack('N', mt_rand()));

Secure code examples

JavaScript / Node.js - crypto.randomBytes

// SECURE: Node.js crypto module uses OS entropy source (CSPRNG)
const crypto = require('crypto');

function generateResetToken() {
    return crypto.randomBytes(32).toString('hex'); // 256-bit secure token
}

Java - SecureRandom

// SECURE: java.security.SecureRandom uses OS entropy (e.g., /dev/urandom)
import java.security.SecureRandom;
import java.util.Base64;

public String generateSessionId() {
    SecureRandom secureRng = new SecureRandom();
    byte[] bytes = new byte[32];
    secureRng.nextBytes(bytes);
    return Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);
}

Python - secrets module

# SECURE: secrets module is designed for security-sensitive values (Python 3.6+)
import secrets

def generate_otp():
    return secrets.token_hex(16)  # 128 bits of randomness

def generate_numeric_otp(digits=6):
    return str(secrets.randbelow(10**digits)).zfill(digits)

PHP - random_bytes

// SECURE: random_bytes() uses CSPRNG
$token = bin2hex(random_bytes(32)); // 256-bit token

What Offensive360 detects

• Math.random() in security contexts - Usage of Math.random() for generating tokens, IDs, nonces, or keys
• java.util.Random for security values - Use of non-secure Random class in token/session generation paths
• rand()/mt_rand() in PHP - PHP pseudo-random functions used where cryptographic randomness is required
• random.random()/random.randint() in Python - Python’s random module used in authentication or token flows
• Short token lengths - Token generation producing fewer than 128 bits of entropy

Remediation guidance

1. Use platform CSPRNG APIs - crypto.randomBytes() (Node.js), SecureRandom (Java), secrets module (Python 3.6+), random_bytes() (PHP 7+), crypto/rand (Go).

2. Generate at least 128 bits (16 bytes) of entropy, For tokens, session IDs, and reset links. 256 bits is preferred for long-lived credentials.

3. Never seed secure random with timestamps - new Random(System.currentTimeMillis()) or srand(time()) are as predictable as unseeded PRNGs.

4. Store token hashes, not plaintext - Even with secure generation, store SHA-256 hashes of reset tokens in the database to prevent exposure in case of a database breach.

5. Set short expiry windows - Limit the attack surface by expiring tokens quickly (e.g., 15 minutes for password reset tokens).

References

• CWE-330: Use of Insufficiently Random Values
• OWASP Cryptographic Storage Cheat Sheet
• OWASP A02:2021 - Cryptographic Failures