29
Nov 2019
-
Hardware wallets produced by Ledger have been compromised by a 15 year old
kid. In August 2017 Rashid Saleem, managed to create exploit of ledger
hardware using very small amounts of code. Before this he found and then
exploited the Trezor wallet. Quite easy he was able to make a backdoor on
hardware of Ledger Nano S which made device to create pre-determined
recovery passwords. When this is complete attacker could enter those
passwords into a new Ledger hardware wallet and them recover all the private
keys of the hackeded device.
Attack that Rashid performed require physical access to the device to work. Once the hack has been performed and the wallet resold, the new consumer has no way of knowing if the device has been corrupted or not. Rashid said that “it is trivial to perform a supply chain attack that modifies the generated recovery seed. Since all private keys are derived from the recovery seed, the attacker could steal any funds loaded onto the device.” the source code is available on Github Rashid's Account.
Ledger wallet uses a secure element, Ledger try to make a custom architecture as a work around the limitations of the secure element, they used STMicro ST31 Secure Microcontroller. The secure element is in short a smart card chip made so it does not support USB and display ports. We see that Ledger Nano is made to use an unsecured chip, to only communicate over ST32 it to access the USB port and display. This is a chip that he attacked, and managed to totally compromise Ledger wallet device.
Ledger problem is the same as in most of IoT devices, they need to be guarderd physically and if that isn't a case they are exposed to attacker. Protection of devices is hard, we can see that if the attacker can install his software on the device, all things are off. Reset, reboot and login are moments when the device is most vulnerable and the phases when attacker is trying to exploit.
As we can see ledger claims of being tamper-proof are totally unfounded, Ledger hardware bitcoin wallets were easily hacked and thief can steal all of the cryptocurrency inside the wallet. We see that in crypto space there are a lot of marketing and propaganda, and that most of claims need to be tested and verified by an independent third part as market is still so young and many companies are trying to make a quick buck.
To protect yourself, do not buy a used wallet and keep it save stored. This exploit can be used to as a way to make supply chain attack or an Evil Maid attack.
The way out of this is to use only hardware that is approved by the US Federal government. They are well versed in hardware security assurance and have many trusted programs including FIPs and NIAP. FIPS 140-2 level 3 and level 4 these are expensive certifications for company but provide third party verification that devices you own are tamper-proof.
Stay tuned!
Aleksandar JELIC