Ledger Bitcoin Wallet Hacked by 15 Year Old Researcher
Ledger hardware wallets have been thoroughly compromised by a 15-year-old researcher, Rashid Saleem, using very small amounts of code. Rashid is the same researcher that exploited the Trezor walletA wallet is a device (a hardware device, a program, or servi... More flaw in August 2017. He was able to install a backdoor on the Ledger Nano S that causes the device to generate pre-determined recovery passwords. An attacker could enter those passwords into a new Ledger hardware wallet to recover the private keys of the backdoored device.
Rashid performed a supply chain attack, and it does require physical access to the device to work. Once the hack has been performed the wallet can be resold, and the consumer has no way of knowing if the device has been corrupted or not. Rashid states “it is trivial to perform a supply chain attack that modifies the generated recovery seed. Since all private keys are derived from the recovery seed, the attacker could steal any funds loaded onto the device.” He has also made the source code available on Github.
Even though the wallet uses a secure element, Ledger used a custom architecture to work around the limitations of the secure element, STMicro ST31 Secure Micro Controller. The secure element is essentially a smart card chip that does not support USB or display ports. The Ledger Nano uses as an unsecured chip, only communicate over ST32 it to access the USB port and display. This chip is what is exposed to attack, and results in total compromise of the Ledger cryptocurrencyA cryptocurrency (or crypto currency) is a digital asset des... More device.
Ledger faces the same problem that most IoT devices face, and they are exposed to attackers when they are not physically guarded. Device protection is hard, and if the attacker can get software on the device, all bets are off. Reset, reboot and login are all events that often present the opportunity to inject software onto the device.
Despite claims of being tamper-proof, Ledger hardware bitcoinThe term "Bitcoin" can either refer to Bitcoin the network, ... More wallets were hacked enabling bad guys to steal all of the cryptocurrency inside the wallet. The event reinforces the old security adage “trust but verify.” Since rolling your own hardware security is complicated and nuanced, it is best to have an independent third party attest and certify the security of the entire system. Apparent corner cases, shortcuts and architectural mistakes can lead to systemic risks. In this case, it exposed over one million wallets and potentially billions of dollars worth of cryptocurrency to theft.
Clearly, buying a used wallet is fraught with peril. This attack which is now very public can be used to mount a supply chain attack or an Evil Maid attack.
The US Federal government is well versed in hardware security assurance and have many trusted programs including FIPs and NIAP. FIPS 140-2 level 3 and level 4 are expensive certifications for hardware vendors but provide externally validated proof the encryption devices are tamper-proof. The CipherTrace team deeply understands these issues because one of our previous products was the worlds first FIPS 140-2 level 3 mobile storage devices.