Advanced › Module 3 › Lesson 3
Weak RNG Named
Weak RNG literacy names predictable randomness failures — defender notes on CSPRNG and entropy; no exploitation of live gambling or token systems.
Visual · t28_weak_rng_named
Weak RNG literacy. $CRYPTO_LAB only. Original Cyberlium.
Opening
Random is not random if seeded badly — literacy names failure modes; exploitation stays off production services.
Weak RNG classes include predictable seeds (time-only), broken PRNG algorithms (Java Random for crypto), insufficient entropy at boot, and reused nonces in ECDSA. Historical examples (Debian OpenSSL key reduction, Dual_EC_DRBG concerns) teach defenders — not student exploit campaigns on live sites. Cyberlium documents weak RNG as attack class + defender notes on YOUR $CRYPTO_LAB — use OS CSPRNG (/dev/urandom, getrandom, CryptGenRandom), hardware where required — never predict tokens on stranger production APIs. Next: Classes Lab.
1. Weak RNG patterns (named)
Predictable seed: timestamp, PID-only seeding yields guessable keys. Broken PRNG: math.random, rand() for crypto keys. Low entropy VM clones: identical keys after snapshot restore if seed not injected.
On $CRYPTO_LAB, list three weak patterns and matching defender fix — no live token prediction scripts.
Command guide
Try these commands — Weak RNG patterns (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CWE-326 — https://cwe.mitre.org/data/definitions/326.html (inadequate key size) CWE-759 — https://cwe.mitre.org/data/definitions/759.html (one-way hash without salt) Cryptopals — https://cryptopals.com/ (authorized CTF challenges YOU choose)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export CRYPTO_LAB=${CRYPTO_LAB:-$HOME/cyberlium-lab/t28-crypto}
curl -sS https://cwe.mitre.org/data/definitions/326.html | head -10
curl -sS https://cwe.mitre.org/data/definitions/759.html | head -10
grep -E 'weak RSA|NEVER|salt' "$CRYPTO_LAB/notes/named-attacks-literacy.txt"Primary tools to practice this lesson: grep, curl. Reference sites: CWE-326 (https://cwe.mitre.org/data/definitions/326.html); CWE-759 (https://cwe.mitre.org/data/definitions/759.html); Cryptopals (https://cryptopals.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender remediation (named)
Use OS CSPRNG APIs — never roll your own. Seed HSM/KMS properly; audit VM clone entropy. Monitor duplicate keys and nonce reuse in signatures. Rotate keys after RNG incidents.
Reports cite CVE and entropy source — students write defender tickets, not exploit kits for live RNG.
3. Ethics boundary
Forbidden: predicting live session tokens, exploiting gambling site RNG without scope, sharing weak-seed scripts for production. Allowed: weak RNG card — three patterns, three fixes, refusal sentence.
Ship: weak RNG literacy card for $CRYPTO_LAB. Next: Classes Lab.
4. What you ship: weak RNG literacy card for $CRYPTO_LAB
Three weak patterns, three defender fixes, refusal sentence. $CRYPTO_LAB named. NO live exploitation. chmod 600.
5. What you record before the next lesson
Date. Weak RNG card. $CRYPTO_LAB named. File t28-m03-l03-weak-rng-named.txt chmod 600.
6. Wrong vs right: prod crypto oracles vs CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Predict production API tokens from timestamp seed. Use rand() for YOUR app's AES keys.
Right
Write weak RNG literacy card for YOUR $CRYPTO_LAB defender notes. Next: Classes Lab.
Mission: document weak RNG class
1) Name three weak RNG patterns. 2) Match each to defender fix. 3) Write refusal for live token prediction requests. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
If crypto needs random, call OS CSPRNG — one line saves careers.
Knowledge Check
APPLY: Weak RNG literacy on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Using OS CSPRNG is the defender standard for crypto keys.
True or False
Knowledge Check
APPLY: Predicting tokens on stranger production APIs is:
Multiple choice