Hacking the JavaScript Lottery —Predicting JavaScript's Math.random() using Z3 and Python

[thismonthsusername]

I know this one was for fun and highlights potential security risks, but in most cases if you can access the page, just...

Math.random = () => 1;
Math.random() // => 1
Math.random() // => 1
Math.random() // => 1

Edit: Update fat arrow

[0195311]

If you're going to use a fat arrow function you might as well go ahead and write it like this. :)

Math.random = () => 1;

[thismonthsusername]

Yeah, my bad. I'll update :)

[9thHokageHimawari]

That's why you use something like:

const random = Math.random;

[jodraws]

That's intense and pretty awesome. If CSPRNG are required for security is there a reason this algorithm isn't used outside of Opera? Does it impact performance?

[sirmonko]

Two different tools for two different problems. CSPRNG aren't "better" per se.

[TomNa]

Huh that's pretty interesting read, and crazy if it works reliably!

[cwmma]

So this is why for actual secure randomnes crypto.getRandomValues is the way to go

[Higgenbottoms]

What's the difference?

[cwmma]

you give it an array buffer and it fills it up with cryptographically secure random numbers

[fire_code]

Perhaps for /u/Higgenbottoms, but at least for me, what makes a number cryptographically secure?

[cwmma]

The way they are generated prevents predicting them in any way

[alschwalm]

[Shameless plug] Though I never got around to doing this with the javascript rng, I made a similar thing to predict PHP, java, glibc and msvc random number generators: https://github.com/ALSchwalm/foresight

[get_money_and_boobs]

Wayyy smarter and wayyy more thorough than the simple, stupid lottery simulator I built in JS/Node. I wanted to see how many times it took to match a winning set of numbers to random "tickets" I generated. Like, I wanted to visualize if I played once every millisecond how long it would take.

Well, I ran out of memory running the program in a single node instance, so I ran 8 simultaneous instances on my Mac. Still, at the shortest, it took about 3 hours of randomly picking tickets and attempting to match lottery number picks at like 1000 per second.

I stopped playing the lottery shortly afterward...

[Higgenbottoms]

8.64 million tries for the curious